Alert at escalate incident
Ines Ito
Information Technology · Cybersecurity Operations · IT7A Security Alert Triage
$14k
value
74%
confidence
10
people affected
3h 53m
age
11h 23m
sla
100%
progress
Currently held by
Alert Triage Agent
An agent owns the next move
Raised by
Callum Costa
Requester of record
At station
Escalate incident
Policy layer · station 7 of 7
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. The same actions are held in the append-only evidence spine with their authority grant, version stamps and hash links; open the auditor pack to see them.
Cleared score
-233mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared auto-close false positive
-186mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared contain in-policy
-140mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared analyst review
-93mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Holding at escalate incident
-47mDirector, Security Operations
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
This is the last station. Once it clears, the unit closes and the outcome is booked.
Why the signal is what it is
Plain reading of the current state
Amber. The agent completed the work but the outcome fell into a sampling band, so it posted evidence for review rather than closing silently. Work carries on; a human confirms after the fact.