Skip to main content

Audience

SOC leaders, security administrators, security engineers, and analysts.

What

Learn how investigation levels, weekly limits, accumulated credits, and administrator overrides work.

Why It Matters

Manage usage efficiently without leaving alerts uninvestigated.

​
Overview

AirMDR uses Darryl, its AI investigation engine, to investigate every alert received by the platform. By default, every alert is analyzed at Level 3 – Deep Dive, the most thorough investigation level. When usage exceeds the applicable weekly allowance, Darryl can apply an appropriate investigation depth to each alert type for the remainder of that week. The recommended depth is based on the alert type’s escalation history in your environment during the previous 30 days. Administrators can review the recommendation and configure a different depth from the Usage Limits page.
Every alert is investigated. Usage limits may affect the depth of an investigation, but alerts are never skipped or ignored.

​
Investigation Depth Levels

Darryl evaluates how frequently each alert type resulted in a real escalation during the preceding 30 days.

Level 1 – Triage

Applied to alert types with no history of escalation in your environment.Best suited for: Consistently low-risk alert types.

Level 2 – Investigation

Applied to alert types that have escalated occasionally.Best suited for: Alert types requiring additional contextual analysis.

Level 3 – Deep Dive

Applied to frequently escalated alert types or alert types without sufficient history for reconsideration.Best suited for: High-risk, business-critical, or newly escalated alert types.
AirMDR validation indicates that Triage and Investigation-level analysis show no significant reduction in detection accuracy compared with Deep Dive.
A lighter investigation level is a calibrated investigation based on the observed risk profile of the alert type. It is not an incomplete or lower-quality check.

​
🤔How Darryl Determines Investigation Depth?

1

Review escalation history

Darryl reviews the alert type’s escalation history from the previous 30 days.
2

Calculate the recommended depth

Darryl assigns Level 1, Level 2, or Level 3 based on the frequency of real escalations.
3

Apply Deep Dive by default

AirMDR investigates alerts at Level 3 while usage remains within the applicable weekly allowance.
4

Activate adaptive investigation depth

If the applicable usage threshold is exceeded, AirMDR applies the configured depth for each alert type.
5

Start a new weekly cycle

At the beginning of the next week, the organization returns to full-depth analysis, subject to the confirmed weekly reset rules.

​
Weekly Usage Limit

Each organization has a base weekly usage limit. Under normal usage conditions, every alert receives Level 3 – Deep Dive analysis. The usage limit affects investigation depth only when weekly usage exceeds the organization’s applicable allowance.

Within the Usage Allowance

Every alert continues to receive Level 3 – Deep Dive analysis.

Allowance Exceeded

AirMDR applies the configured investigation depth for each alert type for the remainder of the week.

​
Weekly behavior

​
Usage Threshold

The supplied product information states that adaptive investigation depth begins when weekly usage exceeds 150% of the weekly limit.

​
Example calculation

If the weekly limit is 1,000 usage units:
According to this rule, adaptive investigation depth would begin after usage exceeds 1,500 units.
Product confirmation requiredThe source also states that adaptive investigation depth begins only after usage exceeds the accumulated-credit buffer, which can reach five times the base weekly limit.Confirm how the 150% threshold interacts with accumulated usage credit before publishing this calculation.

​
Accumulated Usage Credit

AirMDR does not penalize an organization for a single unusually busy week. Unused credit from lower-usage weeks carries forward and increases the organization’s available credit. Accumulated credit can grow to a maximum of five times the base weekly limit.

​
Example

If the base weekly limit is 1,000 usage units:
When usage exceeds the expanded allowance:
  1. Darryl applies the configured investigation depth for each alert type.
  2. The configured depth remains active for the rest of that week.
  3. Available credit resets to the base weekly limit for subsequent usage periods.
    This example explains the five-times accumulated-credit rule only. Confirm the interaction between accumulated credit and the separate 150% threshold before publication.

​
Review or Change Investigation Depth

Administrators can review Darryl’s recommendation and configure a different investigation depth for an alert type.
For example, an administrator can retain Level 3 – Deep Dive for a business-critical alert type even when Darryl recommends Level 1 or Level 2.

​
Prerequisites

You can access the organization Usage Limits page.
You have reviewed the alert type’s recent escalation history.
You understand the alert type’s operational and business importance.
You have permission to modify investigation-depth preferences.
The source does not specify the exact AirMDR role or permission required to change investigation depth. Confirm the RBAC requirement before publication.

​
Configure an investigation depth

1

Sign in to AirMDR

  1. Login using your organization credentials.
  2. In the Left Navigation pane, click on the ADMIN drop-down.
  3. Select the Org Config → Usage Limits page.
    AI Usage Limit
2

Locate the alert type

  1. Find the alert type whose investigation depth you want to review.
3

Review the recommendation

  1. Compare Darryl’s recommended depth with the currently configured depth.
  2. Review the following information when available:
    • Alert type
    • Recommended depth
    • Configured depth
    • Escalation history
    • Usage information
4

Select an investigation depth

  1. Select one of the following options:
    - Level 1 – Triage
    • Level 2 – Investigation
    • Level 3 – Deep Dive
  2. Save the configuration.
    Save or confirm the change if explicit confirmation is required.
  3. Verify the updated depth.
    Confirm that the selected depth is displayed for the alert type.

​
Expected result

The selected investigation depth is saved as a standing preference for the alert type. The preference remains saved even when Darryl’s recommendation changes as new escalation data becomes available. Example Darryl may recommend the following depth for an alert type with no recent escalation history:
If the alert type relates to a privileged identity or sensitive system, an administrator can configure:
The configured preference remains saved even when Darryl’s recommendation changes.
Confirm whether the configured depth applies only after the weekly threshold is exceeded or immediately after the administrator selects it.

​
Manual Reinvestigation

When an analyst manually reinvestigates a case, the reinvestigation always runs at Level 3 – Deep Dive.
Initial adaptive investigation depth does not restrict an analyst’s ability to perform a full reinvestigation.

​
Nothing Is Left Under-Investigated

Even when an alert type is analyzed at a lighter level, it still receives a complete automated AI investigation.

Every Alert Is Investigated

Alerts are never ignored, skipped, or excluded because of usage.

Deep Analysis Remains Available

Analysts can manually reinvestigate a case at Level 3 – Deep Dive.
A lighter level does not mean:
  • The alert is ignored.
  • The alert is skipped.
  • Only a superficial check is performed.
  • The alert is excluded from AirMDR investigation.
  • An analyst is prevented from performing a deeper review.

​
Key Behavior Summary

​
Best Practices

Additional recommendations:
  • Review alert-type escalation trends regularly.
  • Coordinate configuration changes with your SOC team.
  • Use manual reinvestigation when closer analysis is required.
  • Maintain an audit trail of configuration changes.
  • Reassess usage after enabling new integrations or alert sources.

​
Frequently Asked Questions

No. Darryl investigates every alert received by AirMDR. Only the depth of the investigation can change for alert types whose escalation history supports a lighter level of analysis.
No significant reduction in detection accuracy was observed in AirMDR’s comparison of Triage and Investigation-level analysis with Deep Dive.A lighter level is a calibrated AI investigation, not a skipped or incomplete check.
No. Unused usage credit can accumulate and absorb occasional usage spikes. Accumulated credit can reach up to five times the organization’s base weekly limit.Weekly full-depth analysis resumes according to the confirmed weekly reset and usage-threshold rules.
Yes. Darryl recalculates its recommendation as new alert and escalation history becomes available.
No. Your configured preference remains saved even when Darryl’s recommendation changes.
Manual reinvestigation always runs at Level 3 – Deep Dive.
No. AirMDR continues to investigate every alert. Only the investigation depth may change for particular alert types.
The configured depth is stored as a standing preference until an authorized user changes it. However, Product or Engineering must confirm whether it is applied only after the usage threshold is exceeded or at all times.
Unused credit can accumulate up to five times the organization’s base weekly limit.
According to the supplied product information, Darryl applies the configured investigation depth for each alert type for the remainder of the week. The available credit then resets to the base weekly limit going forward.
Yes. You can configure Level 3 – Deep Dive for an alert type even if Darryl recommends a lighter investigation depth.
No. The source states that each week starts fresh and the organization returns to full-depth analysis. The exact reset timing and its interaction with saved preferences must be confirmed.