LensReading which lens this session carries.
IT7A-1017Evidence postedlow materiality

Alert at escalate incident

Ines Ito

Information Technology · Cybersecurity Operations · IT7A Security Alert Triage

$14k

value

74%

confidence

10

people affected

3h 53m

age

11h 23m

sla

100%

progress

Currently held by

Alert Triage Agent

An agent owns the next move

Raised by

Callum Costa

Requester of record

At station

Escalate incident

Policy layer · station 7 of 7

Where this train is on the line

IT7ASecurity Alert TriageTransactional · 7 stations

Ingest

37 q

Enrich

28 q

Score

22 q

Auto-close false positive

0 q

Contain in-policy

36 q

Analyst review

3 q

Escalate incident

1 live

Evidence trail

Every station this unit has passed, who acted, and what they left behind

This is the readable trail.

  1. Cleared score

    -233m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  2. Cleared auto-close false positive

    -186m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  3. Cleared contain in-policy

    -140m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  4. Cleared analyst review

    -93m

    Director, Security Operations

    Approval recorded with rationale and policy clause cited

  5. Holding at escalate incident

    -47m

    Director, Security Operations

    Inputs, rule version and output hash written to the evidence log

What happens next

The next station and its rule

This is the last station.

Why the signal is what it is

Derived from time against commitment, not from the state

Green. This item is still inside the time it was committed to, and it is not close enough to that line for its materiality to pull it forward. Green says nothing about who holds it: an item can be green and sitting with a person.

clock 3h 53m against a commitment of 11h 23m · 34% of the time used
materiality low · blast radius 10 records or people downstream
state evidence-posted — held separately, and deliberately not part of this reading