AI alert narration — what an alert actually means

When a SIEM detection rule fires, you get the raw event data — IPs, file hashes, command lines, timestamps. AI Alert Narration turns that into a paragraph that explains what happened in plain English, so you can triage faster.

How it works:
• Every triggered alert is automatically narrated by Wally within seconds of firing
• Narration is stored on the alert; admin sees it when opening the alert detail
• Narration explains:
◦ What event(s) triggered the rule
◦ Why this is suspicious in plain language
◦ What an attacker would gain if this is real
◦ What additional context to look for in your environment
◦ Suggested next investigative steps

Example:
Raw alert: "Detection 'Suspicious PowerShell' fired. Event: ProcessCreate. Image=powershell.exe. CommandLine='powershell.exe -enc JABwACAAPQA...'"

Narration: "An encoded PowerShell command was executed on host PROD-WEB-01 by user 'jdoe'. The Base64-encoded payload decodes to a script that downloads and executes a remote file. Encoded PowerShell is a common tactic to bypass logging and string-based detections — legitimate admin scripts rarely use this technique. Recommended next steps: 1) Investigate the parent process to determine how PowerShell was launched, 2) Check 'jdoe's recent login history for anomalies, 3) Review network connections from PROD-WEB-01 to identify the downloaded payload's source."

What the narrator considers:
• The detection rule's MITRE ATT&CK mapping (technique, tactic)
• Other recent events on the same host or by the same user
• Known IOCs from threat-intel feeds
• Your org's normal baseline (e.g. if you regularly run PowerShell encoded commands as part of legitimate ops, the narrator notes that rather than flagging as suspicious)

Cost:
• Each narration is a small Claude Haiku call
• Charged at the +15% chargeback to your org
• Visible on Account → Pay-as-you-go → SIEM line
• Disable per-rule (Detection Rules → Settings → "Auto-narrate" toggle) if a rule fires too frequently

What it isn't:
• A replacement for human investigation — narration is a starting point, not a verdict
• A guarantee of accuracy — if the narrator misreads context, override it; feedback loops train the next-gen narrator