What is testing the impact of a context item?
When you create a context item, you can optionally run a test before submitting it. The test shows you how that context item would have affected a sample of recent alerts, which verdicts would have changed and why, so you can catch mistakes before they reach production.
Testing is optional and submitting a context item without testing works exactly as before.
How does the test work?
The test runs as a two-phase background job:
Phase 1 - Match scan : Qevlar scans all alerts from the last 5 days and counts how many match the observables in your draft.
Phase 2 - Sample re-run : Qevlar takes up to 10 of the most recent matching alerts and re-runs each one through the full analysis pipeline with your draft context applied. For each alert, you see the original verdict, the new verdict, and the reasoning behind the change.
The test takes approximately 10 minutes. You can navigate away while it runs and come back when it is ready.
Important: The test is a preview only. It does not change any verdicts on past alerts. Context applies to future alerts from the moment it is submitted, which is the same as existing behavior.
How do I run a test?
- Create a new context item from the full-page form, from inside an investigation, or from the feedback flow.
Instead of clicking Apply, select Test.
- A modal explains how the test works. Check the box to skip this modal on future tests.
- The test starts. You can navigate away, Qevlar will notify you when results are ready.
- Return to the context item via the in-app notification or via the Team context tab.
Review the results, then choose to Submit, Edit, or Discard.
How do I know when my test is ready?
You receive an in-app notification when the test completes. The Team context tab and the Context entry in the left sidebar also show a counter badge indicating tests ready for review.
Notifications are in-app only in the current version. Email, Slack, and Teams notifications are not available yet.
What do I do with the results?
From the results view you have three options:
Submit : the context item goes through the standard admin validation flow and becomes active once approved.
Edit : opens the form with your draft pre-filled. Note that editing deletes your test results, you can run another test once you have updated your draft.
Discard : permanently deletes the draft.
What if no alerts match?
If no alerts from the last 5 days matched your draft, the results panel shows an empty state. This is expected for context items targeting rare or emerging patterns and does not block you from submitting.