[REVIEW] alert-triage: suppression storms and stale-context confidence

[stmr]

Skill Being Reviewed

skills/secops/alert-triage

Review Focus

The skill gives a clear triage flow: collect facts, correlate entities, classify severity, escalate, and document evidence. The main gap I found is in alert suppression, deduplication, stale context, and queue saturation. A real incident can be missed when the first alert is closed as noise, later alerts are suppressed, or triage relies on asset/user context that is stale.

False Positive Analysis

Deduplication and suppression are not automatically bad. Benign evidence includes:

• A suppression rule with owner, scope, expiry, and linked root-cause ticket.
• Deduplication that preserves event count, unique entities, first seen, last seen, and severity escalation.
• Alert grouping that still pages when volume, affected assets, or privilege level crosses a threshold.

The skill should separate controlled noise reduction from dangerous blind spots.

Coverage Gaps

Please add a triage check for "suppression and stale-context confidence":

• When an alert is suppressed or deduplicated, require review of the raw count, affected entities, first/last seen, and escalation threshold.
• If the alert depends on asset criticality, owner, identity role, or business unit, require freshness evidence for that context.
• Add a queue saturation check: whether high alert volume is hiding high-severity outliers or delaying SLA-based escalation.
• Ask reviewers to inspect any active suppression that matches the alert's detection rule, entity, or source.
• Require explicit uncertainty handling when enrichment fails or context is older than the triage window.

Edge Cases

• A low-severity alert on a domain controller, production secret store, or privileged user may need escalation even if the rule normally groups as low.
• Burst attacks can look like duplicate noise until the affected-entity count is reviewed.
• Asset inventory sync failures can cause critical assets to appear unowned or low value.
• Suppression may be scoped to a test host but accidentally match production naming patterns.

Remediation Quality

Good remediation should include:

• Suppression owner, expiry, match criteria, and linked approval.
• A test showing the suppression does not hide unrelated production alerts.
• Alert grouping output with event count and unique entities preserved.
• Freshness timestamp for asset and identity enrichment.
• A fallback escalation path when enrichment is missing or stale.

Comparison To Existing Tools

SIEMs and SOAR platforms can group alerts and apply suppression, but they usually do not guarantee that the analyst reviewed stale context, affected-entity spread, or suppressed event counts. This skill can add value by turning those operational blind spots into explicit triage evidence.

Overall Assessment

The current triage workflow is solid, but it should treat suppression, deduplication, stale enrichment, and queue saturation as first-class risk checks. That would reduce missed incidents without rejecting legitimate noise reduction.

Suggested Acceptance Criteria

• Add a suppression/deduplication review step.
• Require raw count, unique entity, and first/last-seen evidence.
• Add context freshness checks for asset and identity enrichment.
• Add queue saturation and uncertainty escalation guidance.

Bounty Info

This is submitted as a skill review bounty claim. Preferred payout: PayPal samik4184@gmail.com.

[Errordog2]

/claim #2547

Implemented in #2592.

Summary:

• Added a suppression/deduplication and stale-context confidence gate for alert triage.
• Requires raw event count, unique affected entities, first/last-seen windows, suppression owner/expiry/approval, context freshness, queue saturation, and uncertainty escalation evidence.
• Updated the triage report output with a suppression/context confidence section.

Validation:

• git diff --check
• Markdown fence balance check
• Targeted marker check for v1.0.1, suppression/deduplication evidence, context freshness, queue saturation, and output fields

Payment details can be provided privately after maintainer acceptance.