> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Triage Rules

> Define Triage Rules that determine how alerts are processed in Blink's Automated Case Management and enforce your organization's policies.

Triage Rules let security teams define how alerts are processed in Blink’s Automated Case Management.

Rules evaluate incoming alerts and cases against organization-specific conditions, using case fields, alert fields, and observables. When a rule matches, its configured actions determine how the alert or case is handled, such as setting field values on the case, skipping the agentic investigation, or skipping case creation for the alert.

Triage Rules help security teams apply consistent handling policies, enforce organizational requirements, and control how alerts progress through case management.

> [!TIP]
>
> Rules are evaluated in order of priority, and only the first matching rule is applied.

***

## How Triage Rules Work

Triage Rules determine how alerts are processed based on their attributes and the organization's handling policies.

1. **Alert processing:** An alert enters Blink’s Automated Case Management for processing.
2. **Rule evaluation:** Enabled rules are evaluated in order of priority against case fields, alert fields, and observables.
3. **Condition matching:** The first rule whose conditions match is selected. Any rules below it are not applied.
4. **Rule enforcement:** The matching rule's actions are applied to determine how the alert or case is handled.

***

## Configuring Triage Rules

Each rule defines the conditions that determine which cases or alerts it applies to, the actions to perform when those conditions are met, and its priority.

**1. Navigate to Case Management Settings**

In [Case Management Settings](https://docs.blinkops.com/docs/case-management/case-management-settings.md), open the [Triage Rules](https://docs.blinkops.com/docs/case-management/case-management-settings.md#triage-rules) tab under the [General Settings](https://docs.blinkops.com/docs/case-management/case-management-settings.md#general-settings) section and add a new rule.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TriageRulesSettings.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=c7abb81c18b63946d233b02e34b033e9)

**2. Define the Triage Rule's Name and Description**

Give the rule a name and provide a short, clear description explaining the rule's purpose.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TRNameandDescription.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=17d4b587ca1c99d985ad7944c12e9f6c)

**3. Conditions**

**Case**

Case conditions are matched against the case fields of the case the alert lands on. Observable conditions are matched against each observable linked to it, and at least one observable must meet them.
\[!NOTE] **Note**: A rule with no conditions matches every case.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TRCaseConditions.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=a533364319e0927c62612a7f0902d4d4)

**Alert**

Alert conditions are matched against the fields of the incoming alert. Observable conditions are matched against each observable linked to it, and at least one observable must meet them.
\[!NOTE] **Note**: A rule with no conditions matches every alert.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TRAlertConditions.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=25ac1862a2ba8525d63b35749b41b9bd)

**4. Actions**

**Case**

When a Case rule matches, its actions are applied to the case:

* **Add field:** Set one or more field values on the case. For example, set the case's severity or verdict to a policy-defined value.

> [!TIP]
>
> Triage Rules are deterministic: the actions are applied every time the conditions match, independent of the model.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TRCaseActions.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=e87e075c63e3548cb824195c9d324a8b)

**Alert**

When an Alert rule matches, the following action is applied:

* **Skip create case:** No case is created for the matching alert.

> [!NOTE]
>
> A skipped alert is still saved in the [Alerts](https://docs.blinkops.com/docs/case-management/alerts/alerts.md) table. Its observables are still extracted, but they aren't enriched.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TRAlertActions.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=6c6e9b7e4b541571c06715ec3505be60)

**5. Enable the Triage Rule and Set its Priority**

Enable the rule, then click and drag it to the desired position in the list to set its priority.

**5.1. Rule Priority**

Rules are evaluated in order of priority, and **only the first matching rule is applied**. If several rules match the same alert or case, only the highest-priority one takes effect, and the rules below it are ignored.

Place more specific rules above more general ones. For example, a rule that sets the severity to critical for alerts involving privileged accounts should be placed above a rule that lowers the severity of alerts from approved internal scanners. Otherwise, the more general rule could match first and the specific rule would never be applied.

![](https://mintcdn.com/blinkops-2/b1wvdD7Z-zaOFFcu/img/CaseManagement/TriageRulePriority.png?fit=max\&auto=format\&n=b1wvdD7Z-zaOFFcu\&q=85\&s=11526f62ffca1f5639313cfbe8d5d6c6)

***

## Managing Triage Rules

In the Triage Rules table, users can manage triage rules as organizational requirements evolve or to suit their organizational needs:

* **Create:** Define the rule's conditions, actions, and priority.
* **Edit:** Update its conditions, actions, or priority.
* **Enable:** Activate the triage rule for alert processing.
* **Disable:** Prevent the triage rule from affecting alert processing.
* **Duplicate:** Duplicate an existing rule to create a copy with the same conditions and outcome.
* **Delete:** Remove a rule that is no longer needed.

![](https://mintcdn.com/blinkops-2/AuIuZMI5Qquk1ZYX/img/CaseManagement/ManagingTriageRules.png?fit=max\&auto=format\&n=AuIuZMI5Qquk1ZYX\&q=85\&s=6d3d54b6791f440f9c43044935b1facc)

***

## Apply Triage Rule Action

The 'Apply Triage Rule' action is located in the [alert processing workflow](https://docs.blinkops.com/docs/case-management/blinks-automated-case-management/alert-processing/alert-processing.md), after [observable enrichment](https://docs.blinkops.com/docs/case-management/blinks-automated-case-management/alert-processing/enrich-observables-main.md).

At this stage, the action evaluates the configured Case rules against the case and its associated data. When a rule matches, its actions are applied to the case, using the **case ID** to identify the target case.

> [!NOTE]
>
> The action's output includes a `log` that shows which rule matched and which actions were applied.

> **'Apply Triage Rule' Action Output Example**
>
> ![](https://mintcdn.com/blinkops-2/ToedBYsqeIcuYSa-/img/CaseManagement/ApplyTriageRulesOutput.png?fit=max\&auto=format\&n=ToedBYsqeIcuYSa-\&q=85\&s=f04ea2018a5591435cd0483e580bd7f3)
>
> ```json theme={"dark"}
> {
>   "matched_rule": true,
>   "rule": "Lower Severity for Approved Internal Scanners",
>   "rule_id": "02f2bd65-484a-4ff4-b78a-81e75f8c91de",
>   "skip_investigation": false,
>   "applied_actions": {
>     "severity": 1
>   },
>   "case": {
>     "ai_verdict": null,
>     "alert_ids": [
>       "7e348cb0-9655-49ab-918e-247384e2857e"
>     ],
>     "attachment_ids": null,
>     "auto_id": 933,
>     "case_id": "INC-00933",
>     "case_ids": null,
>     "case_manager": [
>       "agent_blink@blinkops.com"
>     ],
>     "case_tags": null,
>     "close_reason": null,
>     "closed_at": null,
>     "closed_by": null,
>     "closed_by_automation": false,
>     "closing_details": null,
>     "collaborators": [],
>     "created_at": 1782328566221,
>     "created_by": "fecfa89e-eef6-48a2-ae63-a22bec3b2f77",
>     "escalation_reason": null,
>     "file": null,
>     "historical_case_check": null,
>     "id": "127e5b57-6d0d-4e44-9d4c-aa230522ef24",
>     "investigation_status": "Investigation Completed",
>     "mitre_attack": [],
>     "name": "scanner.exe detected as Malware",
>     "observable_ids": [
>       "6fa4006a-3a95-4bd6-b90d-bcd7b452b145",
>       "0b520bc0-e4f6-44e8-8b02-19a09d5cdfc9",
>       "7a3d9ff3-f1c5-4d83-ac96-04e9475a658b",
>       "25ecba5c-b24e-4e59-812c-4d5fdeb15733",
>       "194c6512-7c85-4bf1-812e-251263153e1a",
>       "8ff3c732-c6d6-4da4-aa10-d6a87471e716",
>       "7f035684-b736-4868-bde2-2056a79d55ae"
>     ],
>     "risk": 1,
>     "severity": 1,
>     "sla": null,
>     "sla_expiry": null,
>     "status": "ESCALATED",
>     "summary": null,
>     "task_ids": null,
>     "type": "Malware",
>     "updated_at": 1791807508948,
>     "updated_by": "b36f526e-47eb-46e3-878a-4e1c12d10aa7",
>     "vendors": [
>       "SentinelOne"
>     ]
>   },
>   "log": [
>     "Rule 'Lower Severity for Approved Internal Scanners' matched.",
>     "Applied severity."
>   ]
> }
> ```

![](https://mintcdn.com/blinkops-2/ToedBYsqeIcuYSa-/img/CaseManagement/ApplyTriageRuleAction.png?fit=max\&auto=format\&n=ToedBYsqeIcuYSa-\&q=85\&s=b0771aa5bfaa169c14df805be8e6a19c)

***

## Triage Rules Best Practices

* **Prioritize critical assets and identities.** Define explicit handling requirements for privileged accounts, production systems, and compliance-sensitive resources.
* **Order rules from specific to general.** Only the first matching rule is applied, so place specific rules above broader ones.
* **Use specific conditions.** Avoid overly broad rules that could affect unrelated alerts or cases.
* **Review exceptions regularly.** Keep policies aligned with changes to assets, approved tools, and organizational requirements.
* **Check rule outcomes.** Review the `log` in the Apply Triage Rule action's output to confirm which rule matched and which actions were applied, and refine rules as needed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.