Reading a Report

What’s in an alert

When Hal escalates something, you don’t get a raw log line — you get an analyst’s write-up. Every alert carries the same parts:

• Severity — how much attention it needs, from informational up to critical.
• Affected scope — which client, which identity, which device.
• What happened — the analysis in plain language, with the events that triggered it.
• Remediation — the specific steps to fix it, not just a warning.

Each escalation is also written up as a signed PDF you can hand to a client or a carrier — see Report Verification. To see how an event earns an escalation in the first place, read How Triage Works.