LensReading which lens this session carries.
IT7B-1000Evidence postedlow materiality

Alert at report

Anika Lindqvist

Information Technology · Cybersecurity Operations · IT7B Phishing Campaign Response

$22k

value

75%

confidence

25

people affected

1h 4m

age

1h 2m

sla

100%

progress

Currently held by

AI-OPS spine

Running in the shared AI GBS spine

Raised by

Callum Muller

Requester of record

At station

Report

AI GBS layer · station 6 of 6

Where this train is on the line

IT7BPhishing Campaign ResponseTransactional · 6 stations

Detect

28 q

Quarantine

7 q

Purge mailboxes

9 q

Notify users

21 q

Block indicators

44 q

Report

1 live

Evidence trail

Every station this unit has passed, who acted, and what they left behind

This is the readable trail. The same actions are held in the append-only evidence spine with their authority grant, version stamps and hash links; open the auditor pack to see them.

  1. Cleared quarantine

    -64m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  2. Cleared purge mailboxes

    -51m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  3. Cleared notify users

    -38m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  4. Cleared block indicators

    -26m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

  5. Holding at report

    -13m

    Alert Triage Agent

    Spine control pack posted, three-way evidence attached

What happens next

The next station and its rule

This is the last station. Once it clears, the unit closes and the outcome is booked.

Why the signal is what it is

Plain reading of the current state

Amber. The agent completed the work but the outcome fell into a sampling band, so it posted evidence for review rather than closing silently. Work carries on; a human confirms after the fact.

Past SLA by 2m · 25 people or records downstream of this decision