Signal Flow

Overview

Signal Flow is a full-width row on the Dashboard, located directly beneath the top row. It shows the volume of data collected on your behalf, how many alerts that data produced, how many cases were opened, and how those cases were closed - by Sapphire AI, by the SOC team, or escalated to you. An Escalation Outcomes block to the right of the flow accounts for what happened to the escalated cases.

Every figure in the row follows the Dashboard's existing time selector and client selector. Every count except Logs Ingested is a link that opens the Alerts or Cases page showing exactly the items behind that number.

Viewing the Signal Flow Row

1. Log in to the AgileBlue Portal.
2. Navigate to the Dashboard.
3. Locate the Signal Flow row, directly beneath the top row of the Dashboard.
4. Review the funnel on the left side of the row to see the three stages, left to right:
   1. Logs Ingested
   2. Alerts Generated
   3. Cases Created
5. Review the three-way split to the right of Cases Created to see how cases were closed.
6. Review the Escalation Outcomes block on the right side of the row to see what happened to the escalated cases.

Understanding the Funnel Stages

1. Logs Ingested - The volume of log data collected on your behalf for the selected time range.
2. Alerts Generated - The number of alerts produced from that log data.
3. Cases Created - The number of cases opened from those alerts.

The bands drawn between the stages narrow as volume falls, so the shape of the funnel from logs to cases is visible without reading the numbers.

Understanding the Case Outcome Split

After Cases Created, the flow splits three ways. Each branch shows a count and its share of cases, and each branch is weighted by volume - the branch with the largest share is drawn thickest.

1. Auto-Resolved (green) - Cases resolved by Sapphire AI with no analyst touch.
2. Resolved by SOC (cyan) - Cases resolved by the SOC team.
3. Escalated (amber) - Cases escalated to you.

The three branches add up to the Cases Created count.

Understanding the Escalation Outcomes

The Escalation Outcomes block shows the number of escalated cases for the selected time range, a single bar split into segments sized by count, and one row per outcome. Each row shows a color chip, a count, that outcome's percentage of escalations, and the outcome label.

The outcomes appear in this order:

1. Resolved · Malicious Breach - The case was closed as a malicious breach.
2. Resolved · Malicious Attempt - The case was closed as a malicious attempt.
3. Resolved · Benign - The case was closed as benign.
4. Client Action Required - The case is under investigation and waiting on you.
5. In Progress · Waiting on SOC - The case is under investigation and waiting on the SOC.

The outcome counts add up to the Escalated count, and their percentages total 100%.

Opening the Alerts or Cases Behind a Number

Every count in the Signal Flow row except Logs Ingested is a link. Linked counts are underlined and show a pointer cursor, in the same color as the count. Logs Ingested carries no underline or pointer and is not a link.

1. Select Alerts Generated to open the Alerts page in its default state for the current client and time range.
2. Select Cases Created to open the Cases page with no filters applied.
3. Select Auto-Resolved, Resolved by SOC, or Escalated to open the Cases page filtered to exactly that set of cases.
4. Select any of the five Escalation Outcomes counts to open the Cases page filtered to exactly that outcome.
5. Select the browser's back control to return to the Dashboard with the same client and time range still selected.

Selecting the label or percentage beside a count opens the same page as the count itself. Each link clears any filters already applied on the destination page before applying its own, so the page shows only the set you selected.

Changing the Time Range

1. Navigate to the Dashboard.
2. Change the time range using the Dashboard's existing time selector.
3. Confirm that the Signal Flow counts and percentages and the Escalation Outcomes refresh together to the new range.

The Signal Flow row has no time control of its own and always shows the same range as the Detection & Response panel above it.

Changing the Client Scope

1. Navigate to the Dashboard.
2. Change the client scope using the Dashboard's existing client selector.
3. Confirm the figures update as follows:
   1. With a single client selected, every count and percentage in the row reflects that client alone.
   2. With All selected, every count and percentage is the total across every client in view.

The Signal Flow row has no client control of its own.

Need Help?

If you have any questions about this feature, please don't hesitate to reach out. AgileBlue Support is also here to assist with any setup questions and can be reached at support@agileblue.com or by submitting a ticket.