Cato Auto-Triage Configuration

Cato is Guard's automated triage agent. It evaluates incoming risks and applies triage decisions without requiring manual intervention. This article explains how to configure which risks Cato processes for your tenant and how automated triage spend is tracked in your AI budget.

Overview

By default, Cato auto-triage is available per tenant but must be explicitly configured before it will run. Tenant administrators can control:

• Whether automated triage is enabled or disabled
• Which sources trigger automated triage (for example, nuclei)
• Which severities trigger automated triage (for example, Critical Triage)

All automated Cato runs are attributed to a dedicated cato budget category, keeping AI spend from automated triage distinct from interactive (Marcus) and Hunt spend.

---

Configuring Cato Auto-Triage

Cato triage settings are managed through the Guard API using two endpoints:

Retrieve current settings

GET /settings/cato

Returns the current auto-triage configuration for your tenant, including:

Example response:

{
  "enabled": true,
  "sources": ["nuclei"],
  "severities": ["Critical Triage"]
}

Update settings

PUT /settings/cato

Send a JSON body with any combination of enabled, sources, and severities to update your configuration.

Example request body:

{
  "enabled": true,
  "sources": ["nuclei", "burp"],
  "severities": ["Critical Triage", "High Triage"]
}

Changes take effect for new risks as they arrive. Risks already in queue are not retroactively re-evaluated.

Disabling auto-triage

To pause all automated triage without changing your source or severity configuration, set enabled to false:

{
  "enabled": false
}

---

AI Budget Attribution

Guard tracks AI spend across three distinct budget categories. Automated triage runs are separated from interactive and hunt usage so costs can be monitored and managed independently.

Separating cato and h1-triage from the marcus category ensures that integration-driven and automated activity does not inflate your interactive AI usage figures and that each category can be budgeted independently.

For more information on setting AI budget limits and viewing spend by category, see AI Budget.

---

HackerOne Integration Triage

When the HackerOne integration is active, triage requests originating from the h1-triage agent are routed to the h1-triage budget category rather than marcus. No additional configuration is required for this separation — it applies automatically when the integration is enabled.

---

Considerations

• Only sources and severities explicitly listed in your configuration will trigger automated triage. Risks from unlisted sources or with unlisted severities are not processed by Cato and remain for manual review.
• Disabling Cato does not affect manual triage workflows or the HackerOne integration.
• Budget categories are read-only labels used for attribution; spend limits are set at the budget level, not per category.