User Guide

Vertex-Triage User Guide

Vertex-Triage adds new Storm commands and Workflows to manage queues and tasks.

Getting Started

Check with your Admin to enable permissions.

Tasks Workflow

The Tasks Workflow displays at most 1000 tasks. When more tasks match, a warning is displayed; use the queue, status, priority, assignee, and search filters to narrow the results. With the queue set to <all>, the table fills from queues in name order, so refine the filters or choose a queue to see other tasks.

Examples

Create a new queue

Queues can also be created via the dedicated workflow.

> vertex.triage.queue.add alerts --desc "A queue for work items relating to alerts"
proj:project=c5ff12781ba598d399a5483044681235
        .created = 2026/10/23 13:29:44.512
        :created = 2026/10/23 13:29:44.512
        :creator = root
        :desc = A queue for work items relating to alerts
        :name = alerts

Create a new task within the “alerts” queue that references a risk:alert node

Tasks can also be created from a Node Action in the Research Tool.

> risk:alert#newalerts | vertex.triage.task.add alerts "alert investigation" --assignee visi --yield
proj:ticket=5190d0803a058a0ae3428e68e844b3f9
        .created = 2026/10/23 13:29:44.545
        :assignee = visi
        :created = 2026/10/23 13:29:44.545
        :creator = root
        :name = alert investigation
        :priority = medium
        :project = c5ff12781ba598d399a5483044681235
        :status = new
        :type = task
        :updated = 2026/10/23 13:29:44.545

Create a trigger to add a task when `media:news:title` is set and contains a keyword

This example creates a new task when :title contains the keyword malware, and adds it to the malware queue. The title is used to populate the task name.

> trigger.add prop:set --prop media:news:title
--query { +:title~=malware | vertex.triage.task.add malware `triage "{:title}"` }
Added trigger: b5de197113bc71859458f9ab322192b3

> [ media:news=* :title="an article about malware" ]
media:news=3cbe200c6e385736264b68a6b82a8370
        .created = 2026/10/23 13:29:44.580
        :title = an article about malware

> proj:project:name=malware -> proj:ticket
proj:ticket=0a958b777578efc260e16ad40eeb5679
        .created = 2026/10/23 13:29:44.595
        :created = 2026/10/23 13:29:44.595
        :creator = root
        :name = triage "an article about malware"
        :priority = medium
        :project = 13448999234d9a89e9147d4a88f4e1a2
        :status = new
        :type = task
        :updated = 2026/10/23 13:29:44.595

The task will also have a reference to the inbound node.

> proj:project:name=malware -> proj:ticket -(refs)> *
media:news=3cbe200c6e385736264b68a6b82a8370
        .created = 2026/10/23 13:29:44.580
        :title = an article about malware

Create a cron to check an external system and create a task based on the results

This example calls a placeholder module, and creates tasks in the extsys queue. A similar ingest routine could be written for calling an HTTP API.

> cron.add --hour +8 {
    $mod = $lib.import(somemodule)
    $data = $mod.getData()
    for $item in $data {
      vertex.triage.task.add extsys $item.name --desc $item.details
    }
  }
WARNING: "--hour" is deprecated and will be removed in v3.0.0.
Created cron job: 06d6685f9232ebe7de0ec52c9ad7920d

Use of `meta:source` nodes

Vertex-Triage uses a meta:source node and -(seen)> light weight edges to track created nodes.

> meta:source=62cbf38be08a5fc8933790a68c41d103
meta:source=62cbf38be08a5fc8933790a68c41d103
        .created = 2026/10/23 13:29:44.510
        :name = vertex-triage