An alert has fired. What should be done?
The workflow
Three questions about the alert and the records joined to it: was the activity unauthorized, does a record explain it, and how strong is the evidence?
The code combines the three answers with how important the machine is and where it runs. Borderline identity alerts also notify the user.
Acting opens eleven more questions: credentials, live sessions, mail, anything left behind to run later, processes, network traffic, and how far the activity spread.
The playbook takes the first group whose conditions are met, then the strongest step in it that still applies. When no group applies, the alert is escalated.
A handful of cases: for each model, one where it alone differs from the other two; one where all three miss the reference; one where all three agree. Each model's path is drawn on the chart in its own colour and line style. Where paths share a stretch, the lines run side by side. What no model reached is faded. Underlined questions open below with every model's answer and the state it read.