Incident triage

When several consoles notice the same thing, the response splits into a handful of half-worked alerts and nobody can say how long the organization actually took to act. This workflow opens one case at the first alert, pulls the related alerts onto the same timeline, and attaches the relevant telemetry before the retention window closes, so the early evidence is the evidence that gets read. It scores severity from the affected asset and the account involved rather than from the wording of the alert, names one responder, and starts the response clock at detection instead of at acknowledgement. Low-confidence alerts that meet a written threshold close automatically with the reason recorded, which is what stops the queue filling with noise. Everything else routes to the on-call schedule with escalation timers already running, and any step that touches an endpoint, an identity or a customer account is put to a responder for approval. A human still decides whether an incident is genuinely finished, whether containment should go further, and when an incident is serious enough to bring in a wider audience.