Events 24h6%
2.4M
320 sample stream
Open alerts8
119
of 320
Critical open2
24
28 unowned open
MTT-triage4m
18m
7d median
True-positive3pp
41%
closed alerts
Fatigue p955
52
alerts fatigue ≥60
Security signal volume
Northline · weekly
Events ×kAlerts
Mon Okta connector deployWed EDR policy tightenThu VPN geo block updateSat SEV-1 identity-auth
Alert severity mix
open + recent
8
Critical
22
High
41
Medium
29
Low
Highest risk open
alerts ↑
| Alert | Risk | Sev |
|---|---|---|
| mail bec signal 7. samir.patel | 99 | Low |
| auth deny burst 4. host-wks-442 | 98 | Medium |
| Auth deny burst. svc-auth | 98 | Medium |
| auth deny burst 28. contractor-jlee | 98 | Low |
| process lolbin 13. samir.patel | 96 | Low |
| auth token theft 19. host-edge-07 | 96 | Low |
| Encoded PowerShell. marcus.chen | 95 | High |
Entities needing attention
8 risk ≥ 60
| Entity | Type | Risk | Alerts | 7d |
|---|---|---|---|---|
| host-edge-376 | Host | 92 | 7 | |
| svc-billing | Service | 91 | 12 | |
| host-wks-119 | Host | 88 | 4 | |
| svc-worker-26 | Service | 86 | 6 | |
| host-edge-346 | Host | 86 | 8 | |
| amara.okafor | User | 84 | 5 | |
| svc-gw-39 | Service | 84 | 4 | |
| host-edge-07 | Host | 82 | 6 |
SOC posture
open work + fatigue
78
posture
4vs. prior week
Open alerts119
Critical open24
Unowned open28
Open incidents17
High fatigue52
Root-caused alerts
symptom → cause → fix
Do this next
scored from open risk · fatigue ROI · blast residual
#196
Contain SEV-1 credential storm
Stop lateral to finance
Hours
#294
Suppress brute-force flap cluster
−38 analyst hours/week
Minutes
#390
Rotate svc-billing keys
Close SEV-2 exfil path
Hours
#486
Own 6 unowned critical alerts
Triage SLA recovery
Hours