Alert at analyst review
Wren Nakamura
Information Technology · Cybersecurity Operations · IT7A Security Alert Triage
$79k
value
67%
confidence
194
people affected
10h 45m
age
9h 4m
sla
86%
progress
Currently held by
Director, Security Operations
A person owns the next move
Raised by
Simon Marchetti
Requester of record
At station
Analyst review
Policy layer · station 6 of 7
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. more
Cleared enrich
-645mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared score
-516mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared auto-close false positive
-387mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Cleared contain in-policy
-258mAlert Triage Agent
Spine control pack posted, three-way evidence attached
Holding at analyst review
-129mDirector, Security Operations
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
Escalate incident
run by Director, Security Operations · Policy layer
Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
Why the signal is what it is
Derived from time against commitment, not from the state
Red. This item is past the time it was committed to and it is either high or critical materiality or wide enough downstream to matter. Red says nothing about who holds it: an item can be red and still be moving through an agent that has not stopped.
Past SLA by 1h 41m · 194 people or records downstream of this decision
Open the escalation lane