Alert at contain in-policy
Amara Novak
Information Technology · Cybersecurity Operations · IT7A Security Alert Triage
$81k
value
93%
confidence
23
people affected
50m
age
37m
sla
71%
progress
Currently held by
AI-OPS spine
Running in the shared AI GBS spine
Raised by
Bruno Muller
Requester of record
At station
Contain in-policy
AI GBS layer · station 5 of 7
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. more
Cleared ingest
-50mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared enrich
-40mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared score
-30mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared auto-close false positive
-20mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Holding at contain in-policy
-10mAlert Triage Agent
Spine control pack posted, three-way evidence attached
What happens next
The next station and its rule
Analyst review
run by Director, Security Operations · Policy layer
Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
Why the signal is what it is
Derived from time against commitment, not from the state
Amber. Either this item is at or past the time it was committed to and is not material enough to escalate, or it is inside the time but has burned three quarters of it while carrying high or critical materiality. Amber says nothing about who holds it: an item can be amber and moving normally through an agent.
Past SLA by 13m · 23 people or records downstream of this decision