> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/management/results.md). # MDR results Review the security alerts detected on your endpoints and identities in `MDR` > `Results`, and open each one to see how it was handled. ## Results table Each alert in the table displays: * **Name**: the alert rule that was triggered * **Criticality**: Low, Medium, High, or Critical * **Target**: the affected host or user * **Detection date**: when the threat was first detected * **Status**: Open or Closed * **Type**: Endpoint or Identity ## Alert details Click any alert to open a side panel with full details: * **Information**: detection date, affected host or user, alert type and a description of the alert when available. * **Status**: whether the alert is Open or Closed, and its resolution (True Positive or False Positive) once closed. * **History**: a timeline tracking the alert through its lifecycle. See [Alert history](#alert-history). * **Linked alerts**: other alerts grouped in the same collection, if any. ## Alert history The History section shows the key milestones of how the alert was handled: | Step | Meaning | | ------------------ | --------------------------------------------------------------------------------- | | Alert creation | The moment the threat was first detected by the EDR (CrowdStrike or SentinelOne). | | Alert confirmation | When the alert was ingested and confirmed in the Stoïk system. | | Alert processing | When a SOC analyst started investigating the alert. | | Alert closure | When the alert was resolved and closed. | "Alert creation" and "Alert confirmation" are always shown. "Alert processing" and "Alert closure" appear as the alert progresses through its lifecycle. Each step displays the exact date and time, with the most recent event at the top. ## Analyst notes Some alerts include notes written by Stoïk SOC analysts, with additional context on how the alert was investigated and resolved. The SOC team adds them only when this context helps you understand the alert resolution. Each note displays: * **Author**: shown as "Stoïk SOC Analyst" (individual analyst names are not disclosed) * **Timestamp**: when the note was written * **Content**: the analyst's observations, findings, or recommendations ## Email exchange When emails related to the alert handling exist, they are displayed in the alert side panel, giving you the full context of how the alert was communicated and resolved. If there are none, the Email exchanges section is not displayed. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/mdr/management/results.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.