Training Modes
Keyboard Shortcuts
Full keyboard reference for fast triage and workstation navigation in Shift Mode.
Keyboard Shortcuts
Speed matters during a shift. Keyboard shortcuts let you triage alerts, navigate between tools, and manage your workstation without reaching for the mouse.
Workstation Navigation
| Shortcut | Action |
|---|---|
Ctrl+1 | Focus SIEM window |
Ctrl+2 | Focus XDR window |
Ctrl+3 | Focus Firewall window |
Ctrl+4 | Focus Ember ThreatInt window |
Ctrl+5 | Focus Case Management window |
Ctrl+6 | Focus Comms window |
Ctrl+Shift+D | Detach focused window into floating panel |
Ctrl+Shift+L | Cycle through layout presets |
Ctrl+K | Open command palette |
Alert Triage
| Shortcut | Action |
|---|---|
R | Resolve selected alert |
F | Mark selected alert as false positive |
I | Mark selected alert as investigating |
E | Escalate selected alert |
Alert triage shortcuts apply to the currently selected alert in whichever tool window has focus. Select an alert first, then use the shortcut.
Tool Navigation
| Shortcut | Action |
|---|---|
1 -- 4 | Switch between toolkit tabs within the focused window |
N | Create new ticket in Case Management |
P | Pin current evidence to active case |
Shift Controls
| Shortcut | Action |
|---|---|
Space | Pause or resume the shift timer |
/ | Focus the search bar in the active window |
Tips
- Learn triage shortcuts first.
R,F,I, andEare the shortcuts you will use most frequently. Building muscle memory for these four keys significantly improves your response time scores. - Use Ctrl+number to switch tools instead of clicking taskbar buttons. During high-volume triage, the time saved on each switch compounds.
- The command palette (
Ctrl+K) provides quick access to any action. If you forget a shortcut, open the palette and type what you want to do.