> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antigen.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How triage works

Triage starts whenever a vulnerability moves to `open`. This can happen when Antigen creates a new vulnerability or when verification finds that a previous remediation did not resolve the issue.

That status change fires a hook. Antigen has configured its built-in `triage-agent` to run on this hook. You can replace `triage-agent` with a custom agent, a Cursor Cloud agent, Devin, a Slack notification, or another workflow through the SDK.

## What `triage-agent` does

`triage-agent` investigates the vulnerability through your connected integrations. It uses the evidence, your Asset Map, and any available code or infrastructure context to determine whether it has enough information and access to produce a remediation pull request or a proposed infrastructure change.

When it can proceed, `triage-agent` moves the vulnerability to `in progress` and assigns it to Antigen's `remediation-agent`.

## When triage is blocked

If `triage-agent` needs access to a specific integration before it can investigate, it records that it is blocked and asks your team to grant the required access. It can also create an issue in Linear, Jira, or another connected tool so the request reaches your team where it already works.

If `triage-agent` determines that the issue is too complex for `remediation-agent`, it leaves the vulnerability open. Your team can then assign it to a person or to one of your own agents.

The vulnerability remains a single live record throughout triage. Its status, assignment, evidence, and history stay available to every later workflow.