How to Automate Alert Triage

Palantir's John Defterios says it is super important to manually go through an alert when you want to automate that triage section of the system. When looking at detections, sometimes there is an assumption in blind spot thing that happens with detections right we talk about that a lot but what isn't talked about a lot is the blind spots or maybe the assumptions that the analyst goes through when looking at an actual alert. This steps are crucial for being able to go test it and iterate on it throw it in a thing like detection lab and look at the artifacts um so i'm a huge proponent of that for surethere's some i kind of want to just circle back to