// Respond to alerts
Stop reading alerts. Start reading PRs.
Hiro reads every alert from Wiz, GitGuardian, CrowdStrike, and GuardDuty, closes the noise, and opens PRs for the rest.
● hiro.alerts · last 24h47 in · 41 archived · 6 PRs open
REALWiz · W-38812 · prod RDS publicly accessible → PR #2847 openedFPWiz · W-38813 · staging SG · intentional → archivedREALGitGuardian · GG-9988 · stripe key in commit a3f9c2 → rotated · PR #2848FPCrowdStrike · CS-44 · dev laptop · known false signature → archivedFPGuardDuty · GD-201 · internal CI pull · expected traffic → archivedREALOkta · O-77 · login from Tor exit · jane@acme.com → suspend queued · awaits signoff…
Only what needs you reaches you.
Triage
Reasoning, not rules.
Hiro checks every alert against what it knows about your stack, like which security group is staging and intentional. False positives get archived with the reason written down, not silently muted.
Response
PR the moment it matters.
Real findings get a fix PR immediately. Low-risk actions like rotating a leaked key ship with rollback armed; sensitive ones like suspending a user wait for your signoff.
Evidence
Audit trail by default.
Every alert is seen and every decision is logged. That satisfies SOC 2’s alert-response control (CC7.2) without you writing a runbook.
Keep your inbox empty.
Wire in your alert sources. Hiro starts triaging from minute one.