Zoom 3 of 3 — line
Major Incident
Transactional line · Information Technology · Cybersecurity Operations
Runs when: Runs transactional. Starts when an upstream system posts an event.
2187
units a week
82%
touchless
8
stations
48m
timetable
1.0h
actual
+25%
vs timetable
Station walk
Every stage, who owns it, and what is sitting there
Each station names the agent that runs it and the layer it belongs to. Gates name the rule and the human approver. Trains parked at a station are live units of work — click one to read its full evidence trail.
- 01
Declare
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 72msla 96mqueued 7 - 02
Contain
Workflowrun by Threat Intelligence Agent
dwell 97msla 128mqueued 46 - 03
Human commander
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 149msla 326mqueued 4 - 04
Assess exposure
Workflowrun by Forensics Support Agent
dwell 151msla 206mqueued 39 run by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 242msla 476mqueued 8- 06
Restore
Workflowrun by Vulnerability Agent
dwell 179msla 250mqueued 14 - 07
Post-mortem
Workflowrun by Security Policy Agent
dwell 54msla 128mqueued 22 - 08
Board report
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 240msla 420mqueued 0
Live trains on this line
5 units in motion right now
| Ref | Work | Held by | Value | Status | Age / SLA |
|---|---|---|---|---|---|
| IT7C-1004 | Alert at assess exposure Aaron Whitfield | Threat Intelligence Agent agent | $33k | Evidence posted | 5h 32m / 3h 26m |
| IT7C-1008 | Alert at board report Pierre Adeyemi | Alert Triage Agent agent | $14k | Auto-cleared | 4h 50m / 7h 0m |
| IT7C-1016 | Alert at contain Naomi Farouk | Phishing Response Agent agent | $57k | In flight | 1h 45m / 2h 8m |
| IT7C-1026 | Alert at contain Yuki Duarte | Containment Agent agent | $89k | In flight | 45m / 2h 8m |
| IT7C-1033 | Alert at legal notify Naomi Sandoval | Security Policy Agent agent | $61k | Evidence posted | 7h 51m / 7h 56m |