Glossary

Definition

Operator workflow

The path an alert follows from detection to human response.

What it means

Operator workflow covers where the alert appears, who acknowledges it, what context they receive, and which action they take next.

Why it matters

A correct detection still fails if it reaches the wrong person, arrives in the wrong tool, or lacks the context needed for action.

Evaluation questions

Who owns each event type?

Where does that person work today?

What information must the alert include to change behavior?