Zoom 3 of 3 — line
Major Incident
Transactional line · Information Technology · Cybersecurity Operations
Runs when: Runs transactional. Starts when an upstream system posts an event.
2187
units a week
82%
touchless
8
stations
48m
timetable
1.0h
actual
+25%
vs timetable
Station walk
Every stage, who owns it, and what is sitting there
Each station names the agent that runs it and the layer it belongs to. more
- 01
Declare
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 72msla 96mqueued 7 - 02
Contain
Workflowrun by Threat Intelligence Agent
dwell 97msla 128mqueued 46 - 03
Human commander
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 149msla 326mqueued 4 - 04
Assess exposure
Workflowrun by Forensics Support Agent
dwell 151msla 206mqueued 39 run by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 242msla 476mqueued 8- 06
Restore
Workflowrun by Vulnerability Agent
dwell 179msla 250mqueued 14 - 07
Post-mortem
Workflowrun by Security Policy Agent
dwell 54msla 128mqueued 22 - 08
Board report
Policyrun by Director, Security Operations
Gate: Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
dwell 240msla 420mqueued 0
Live trains on this line
5 units in motion right now
| Ref | Work | Held by | Value | Status | Age / SLA |
|---|---|---|---|---|---|
| IT7C-1004 | Alert at assess exposure Aaron Whitfield | Threat Intelligence Agent agent | $33k | Evidence posted | 5h 32m / 3h 26m |
| IT7C-1008 | Alert at board report Pierre Adeyemi | Alert Triage Agent agent | $14k | Auto-cleared | 4h 50m / 7h 0m |
| IT7C-1016 | Alert at contain Naomi Farouk | Phishing Response Agent agent | $57k | In flight | 1h 45m / 2h 8m |
| IT7C-1026 | Alert at contain Yuki Duarte | Containment Agent agent | $89k | In flight | 45m / 2h 8m |
| IT7C-1033 | Alert at legal notify Naomi Sandoval | Security Policy Agent agent | $61k | Evidence posted | 7h 51m / 7h 56m |