Alert narrative triage
Judges: SIEM rule name plus event fields. Questions: choice:disposition - true_positive/benign/expected_admin/needs_analyst. Action: Close benign with note.
AA clean typed decision (yes/no, a pick from a list, or a level on a scale) that is concrete, repeats routinely, and has meaningful value.4.61
Key facts
- Vertical
- Cross-industry
- Function
- Agents & dev
- Status
- Idea
- Volume
- routine
- Value
- meaningful
- Risk
- moderate
- Evidence
- —
- Flags
- None
Build this with a classifier
Define a typed decision with a bounded answer, then evaluate it on examples.
{
"decision_type": "choice",
"question": "Does this input match the decision in “Alert narrative triage”?",
"input": "<input to classify>",
"output": "one label from a fixed list"
}Related use cases
Cite this
Copy a link in your preferred format.