Skip to content

Manage your Elevate runs

Elevate operates on a monthly run pack. Each investigation the agent runs, whether automatic or manually triggered, consumes one run. This article explains how to monitor your runs and how to optimize consumption so you do not exhaust your run pack before the end of the month.

Prerequisites

Admin role required.

Monitor your runs

Track your run consumption from the Usage page. Navigate to Settings > Usage > AI to view consumed runs against your monthly run pack, your daily burn, and, for MSSPs, the consumption of each community.

When the run pack is exhausted, the agent stops analyzing new alerts and displays the AI monthly quota limit reached state on any alert it cannot process.

Runs reset monthly

Runs reset at the start of each month and do not roll over. Unused runs from one month are not added to the next.

Optimize run consumption

You can reduce consumption without disabling Elevate entirely by restricting which alerts the agent analyzes.

Filter by detection rule to focus the agent on alert types where AI investigation adds the most value and skip categories already handled by playbooks. See Limit auto-analysis to specific rules.

Disable auto-analysis for specific communities when certain sub-tenants generate high alert volumes that do not require AI investigation. See Override Elevate settings for a community.

Use manual analysis selectively to trigger investigations only on alerts that warrant deeper review. See Trigger a manual Elevate analysis.

Run management for MSSPs

If you manage multiple communities, your sub-tenants draw from a shared workspace run pack. From the Usage page you can review each community's consumption against the pack. To keep a single noisy sub-tenant from consuming a disproportionate share, disable or limit auto-analysis for that community. See Override Elevate settings for a community and Limit auto-analysis to specific rules.

What happens when the run pack is exhausted

When your monthly run pack is reached:

  • The agent stops analyzing new alerts automatically.
  • Alerts that cannot be analyzed display the AI monthly quota limit reached state in the Verdict column.
  • Manual analysis via Roy is also blocked until your runs reset.

Runs reset automatically at the start of next month.