Alert at analyst review
Wren Nakamura
Information Technology · Cybersecurity Operations · IT7A Security Alert Triage
$79k
value
67%
confidence
194
people affected
10h 45m
age
9h 4m
sla
86%
progress
Currently held by
Director, Security Operations
A person owns the next move
Raised by
Simon Marchetti
Requester of record
At station
Analyst review
Policy layer · station 6 of 7
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. The same actions are held in the append-only evidence spine with their authority grant, version stamps and hash links; open the auditor pack to see them.
Cleared enrich
-645mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared score
-516mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared auto-close false positive
-387mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared contain in-policy
-258mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Holding at analyst review
-129mDirector, Security Operations
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
Escalate incident
run by Director, Security Operations · Policy layer
Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
Why the signal is what it is
Plain reading of the current state
Red. The agent stopped. Either the value crossed a gate threshold, the confidence fell below the floor for this lane, or a policy binding it forbade the action. The clock is running and a named person owns the next move.
Past SLA by 1h 41m · 194 people or records downstream of this decision
Open the escalation lane