Accessing Organization#

Click your organization name at the bottom left of the sidebar. A popover appears showing all organizations you belong to, with the currently active one marked with a checkmark. Three options appear at the bottom of the popover:

• Open organization -- Opens the Organization Overview page.
• Organization settings -- Takes you directly to the Organization Settings page.
• View all -- Shows all organizations you are a member of.

If you belong to multiple organizations, click any organization in the list to switch to it.

Overview#

The Overview page shows a summary of your organization workspace. The header displays your organization name, slug, website, and an Active status badge. Three buttons sit in the top right:

• Settings -- Takes you directly to the Organization Settings page.
• Manage team -- Takes you directly to the Team page.
• Leave -- Removes you from this organization.

Summary cards

• Members -- Total number of teammates in the organization.
• Owners -- Number of users with full control over the organization.
• Admins -- Number of users with elevated access.
• Your role -- Your current role in this organization and the date it was assigned.

About

Displays the organization description, creation date, status, website, and Org ID. The Org ID is the unique identifier for this organization used in API calls and support references.

People here

Lists the members currently in the organization with their email address and role. Click View all to see the full team list.

Settings#

The Settings page configures how your organization looks, integrates, and notifies your team.

General information

The basics that teammates and integrations see across the platform. Click Save changes to apply any updates.

• Organization name -- The display name of your organization as it appears across the platform.
• Slug -- A short, URL-safe identifier for your organization. It is automatically generated from your organization name and is prefixed with @. It appears in your organization's URL and is used by the platform to reference your organization internally.
• Website -- Your organization's website URL.
• Description -- A plain-text description of your organization.

Branding

Logo and cover images for your organization profile.

• Logo -- A square avatar image displayed in dashboards, invitations, and handoffs. Recommended size: 512x512px.
• Cover image -- A banner image displayed on your organization profile. Recommended size: 1600x400px.

Click the upload area for either image to select a file from your device.

Team -- Members & Access#

The Team page manages members, roles, and pending invitations for your organization. The header shows four counters: Members, Owners, Admins, and Pending.

Invite teammates

Enter a teammate's email address in the input field, select their role from the dropdown, and click Send Invite. They receive a magic-link invitation and join with the role you selected.

Members

Displays all current members as cards. Each card shows the member's name, email address, role badge, and active status. Your own card is labeled YOU.

For other members, two controls appear on their card:

• Role dropdown -- Change the member's role directly from the card. Takes effect immediately.
• Delete icon -- Removes the member from the organization.

Pending join requests

Shows any users who have applied to join the organization. Approve or decline each request from here.

Pending invitations

Shows invitations you have sent that have not been accepted yet. If a teammate did not receive their invitation or needs it resent, it will appear here.

The role dropdown on each member card shows three options:

• Admin -- Administrative access. Can manage members, configure integrations, and adjust platform settings.
• Analyst -- Security analyst access. Can review alerts, work cases, and investigate incidents.
• Member -- Standard access. Can view the platform and work within their assigned organization.

Model Selector#

The Model Selector page lets administrators configure which AI model powers each role in the platform pipeline. There are 7 slots in total -- one for each AI function. Values apply across the entire organization and workers read the same catalog and encrypted overrides at runtime.

Header

• 7 slots -- The total number of configurable AI roles in the platform.
• 0 on default / 7 customized -- Shows how many slots are using default settings and how many have been customized.
• Last change -- The date and time the configuration was last updated.
• Search -- Filters slots by slot name, ID, or reference.
• Set all slots -- Applies one provider and model selection to all seven slots at once.
• Refresh -- Reloads the current configuration from the server.
• Save all -- Saves and applies all pending changes across every slot.

Each slot card

Each slot is displayed as a card with the following:

• Slot name and icon -- The name of the AI role, for example Platform Copilot.
• Internal ID -- The identifier used by the platform to reference this slot.
• Description -- A plain-language explanation of what this AI role does in the pipeline.
• Custom badge -- Appears when the slot has been changed from its default configuration.
• Reset -- Reverts that slot back to its default setting.
• Provider dropdown -- The AI provider for this slot, for example OpenAI or Anthropic.
• Key -- The API key environment variable used to authenticate with the selected provider.
• Model dropdown -- The specific model from the selected provider. Each option shows the model name and its token pricing in the format input cost / output cost per 1M tokens. The currently selected model is marked with a checkmark.
• Use custom model id toggle -- When enabled, allows entering a custom model identifier manually instead of selecting from the dropdown list.

The seven slots

• Platform Copilot (copilot) -- Powers analyst chat and assisted reasoning in the platform -- answers, explanations, and drafting grounded in your data.
• Triage (triage) -- Classifies each alert in the events-triage pipeline -- verdict, priority, and confidence -- before correlation and automated response.
• Enrichment (enrichment) -- Adds AI context to alerts -- entities, phishing hints, and supporting analysis -- so triage and investigation start with richer signal.
• Incident correlation (incident_correlation) -- Groups related alerts into incidents, breaks ties when models disagree, and drafts incident titles and attack narratives.
• Response (response) -- Chooses the best-matching SOAR playbook or response path when automation needs an AI model to decide how to act.
• Incident report generator (incident_report) -- Produces structured incident write-ups including executive summary, timeline, and analytic narrative.
• Org reporting (reporting) -- Generates scheduled organization reports with metrics and plain-language commentary for leadership and compliance readers.

Available models

The following OpenAI models are currently available:

• GPT-5.2 -- $7.5 in / $22.5 out per 1M tokens.
• GPT-5.4 mini -- $0.3 in / $2.4 out per 1M tokens.
• GPT-5 -- $5 in / $15 out per 1M tokens.
• GPT-5 mini -- $0.25 in / $2 out per 1M tokens.

Each model option displays its price per 1 million tokens so you can balance cost against capability when configuring each slot.