Alert at assess exposure
Aaron Whitfield
Information Technology · Cybersecurity Operations · IT7C Major Incident
$33k
value
77%
confidence
20
people affected
5h 32m
age
3h 26m
sla
50%
progress
Currently held by
Threat Intelligence Agent
An agent owns the next move
Raised by
Zara Kowalski
Requester of record
At station
Assess exposure
Workflow layer · station 4 of 8
Where this train is on the line
Evidence trail
Every station this unit has passed, who acted, and what they left behind
This is the readable trail. more
Cleared declare
-332mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Cleared contain
-249mThreat Intelligence Agent
Inputs, rule version and output hash written to the evidence log
Cleared human commander
-166mDirector, Security Operations
Approval recorded with rationale and policy clause cited
Holding at assess exposure
-83mForensics Support Agent
Inputs, rule version and output hash written to the evidence log
What happens next
The next station and its rule
Legal notify
run by Director, Security Operations · Policy layer
Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged.
approver Director, Security Operations
Why the signal is what it is
Derived from time against commitment, not from the state
Amber. Either this item is at or past the time it was committed to and is not material enough to escalate, or it is inside the time but has burned three quarters of it while carrying high or critical materiality. Amber says nothing about who holds it: an item can be amber and moving normally through an agent.
Past SLA by 2h 6m · 20 people or records downstream of this decision