THE FIELD GUIDE / SECURITY & RESPONSE
Incident cases, ownership & exceptions
Coordinate investigation and follow-up around immutable detections and revisioned decisions.
Assign and document a case
Group related evidence without losing source detections, target identity or permission boundaries. Assign an owner, severity and deadline. Link structured investigation notes to recovery work and external tickets.
Track distinct decisions
Reading a notification, acknowledging a finding, assigning work, patching, verifying recovery and resolving a case are separate actions. Each state change records its actor, reason and expected revision. A deferred manual plan checks the current review context before it becomes actionable.
Review scoped exceptions
Bind an exception to exact evidence, rule and target scope with an owner and expiration. Materially changed evidence returns to attention. The underlying evidence and earlier case decisions remain available.
Open the application reference for capability scope and technical details.
Open View scope in issue #343 ↗