Choose the triage decision supported by the case record and response boundary.
Lessons
- Security alert prompts: preserve event provenance and time
- Security alert prompts: group repeated signals without erasing events
- Security alert prompts: test benign explanations before escalation
- Security alert prompts: apply scoped severity and escalation rules
- Security alert prompts: quarantine instructions embedded in logs
- Security alert prompts: gate containment and verify receipts