Synthetic intake replay

This public replay loads only built-in synthetic examples. No file upload or model connection. Rule ID and level are retained. Select optional bounded evidence fields below. Free text and original identifiers are omitted. This is a metadata intake workflow, not full alert analysis.

Optional retained evidence (select before loading) Protocol Destination port Event count Per-import host alias

Retained-field preview

Review queue

Records stay in memory and disappear on reload. Exported review notes are your text and may contain sensitive details: check before sharing. Source severity never determines disposition automatically.