Architecture

How an alert moves through the framework and the lifecycle on top of it: the alert flow, Upon Trigger, entry points, Auto Triage, the universal command with Shadow Mode, and the value metrics every action feeds.

These pages predate the capability reference and describe the mechanisms end to end; for the switch, the steps and the verify block of one capability, use Reference.

• Alert flow: ingest to lifecycle, step by step.
• Upon Trigger: the Foundation chain that runs on every alert.
• Entry points: how a lifecycle is started.
• Auto Triage: the scheduled close of low-signal cases.
• NIST IR lifecycle: the phases and what each reads and writes.
• Universal Command and Shadow Mode: one interface for every vendor action.
• Value metrics: what the execution dataset measures.
• Cross-lifecycle surfaces: what the framework and a lifecycle share, tiered by blast radius.