Driving to AlertZero: Clearing the queue with automation and intelligent investigation

SOC teams spend their days working repetitive alert queues, driving analysts to burn out, while attackers move faster than the queue does. This session introduces AlertZero, an initiative to clear the alert backlog so analysts can spend their time investigating. We'll cover the expanded Attack Discovery features and the new Alert Analysis Workflows, which automate triage from classification through case creation while keeping analysts in the decision. You'll also see how agentic workflows enrich alert data and how native-language support makes findings readable for the people who have to act on them.