Alert triage is the first review of an alert: dismissed with a reason, or opened as a case. A case management system holds alerts and cases with their states, owners, evidence, decisions and ages, so that every alert has an outcome and a record of how it was reached — an audit trail (Book 12, chapter 25) of the surveillance itself.
fig_survpipe.py.fig_survpipe.py.