Incidents and Cases

Incidents is one queue of detections across the whole book. A detection is something the plane saw. The case you open from it is the thing you work, and the portal keeps them as two separate objects on purpose.

A detection and a case

A detection is the record of an observation. It reaches no conclusion and it does not close.

A case is the record you work and close. It carries an owner, a verdict, what was done, and every step kept as evidence. Cases open from a detection, from an alert in the queue, or over the API.

Keeping them apart means a detection that turns out to be nothing leaves an honest trail: the observation stands, and the case says what you concluded about it.

Working a case

The owner is a named person, so the record says who held it rather than which firm did.

The verdict is the conclusion you reached. What was done is the actions taken from the case, including any response verb dispatched from it, each landing back on the record with the outcome the layer reported rather than the outcome you intended.

The steps accumulate as the work happens, instead of being written up at the end. That is what makes a closed case usable months later in the document you hand the customer.

Response times

Response times reads the case log and gives two intervals for each customer and severity: time to respond, and time to resolve, measured against the targets you declare.

Both are derived, so they move when the cases move and there is nothing separate to keep up to date. A case still being worked shows a resolve interval that has not arrived, which is a different reading from one that arrived late.

Across the book

Because there is one queue rather than one per customer, a detection in a small estate is not buried under a large one.

Two customers carrying detections that point at the same destination is a finding of its own, and shared infrastructure is where the book is read that way.

One detection through to a closed case

A detection lands on an endpoint. You open a case, assign it to yourself, and note what the graph says about the destination. You isolate the endpoint from the case, the outcome comes back from the network layer, and you close the case with a verdict. Response times picks up both intervals from that record, and nothing else had to be filled in for it to.