After you retrieve XDR data, you can explore the data on the Alert Triage page.
Note: For instructions on retrieving XDR alert data, see
Retrieve XDR Data on the Alerts Page.
On the left navigation pane, click
Alerts and then click the
Alert Triage
![](images/GUID-05CED435-9703-4C5E-A3D6-799A46DA79B9-low.png)
The Alert Triage diagram displays network nodes (domain or IP) that highlight IDS-specific network connections.
In the bottom pane, select the Observations tab to view the following fields:
- Time that the observation occurred
- Reason for the observation. This is a more detailed view than was previously available with Enriched Events.
- Username who executed the process that triggered the observation
- Asset
- ATT&CK Tactic & Technique
- Available Actions
MITRE ATT&CK tactics and techniques and other netconn data display in the Observations Details pane that opens when you expand the alert.
![Alert Triage Observations pane](images/GUID-B2A3AF0A-602E-44ED-8E75-FC661F81469C-low.png)
Note: For general information about the Alert Triage page, see
Visualizing Alerts.