Concepts
Alerts and cases
An alert is a signal. A case is the investigation of a subject. The workspace exists so an analyst never re-keys context that the system already holds.
Written from docs/case-workspace.md, docs/adr/0017 — this page is written for an external reader rather than extracted verbatim
Alerts arrive from monitoring rules and from screening. They are assigned, triaged and dispositioned. Where several alerts concern the same subject, they are investigated together in a case rather than separately — which is the difference between an analyst seeing a pattern and an analyst closing five tickets.
The workspacePermalink to this section
A case assembles the subject's customer record and ownership, the alerts and screening hits that concern them, the transactions in scope, the notes and the attached evidence. The assembly is the product's central claim: an investigation whose context has to be gathered by hand from five screens is an investigation whose reasoning cannot be reconstructed afterwards.
DispositionPermalink to this section
- 1
Assign
A case has an owner. Ownership changes are recorded, not overwritten.
- 2
Investigate
Notes, evidence and linked records accumulate against the case. Nothing is edited away.
- 3
Decide
A disposition is recorded with its rationale and its author.
- 4
Escalate or close
Escalation may produce a regulatory report. Closure retains everything the decision rested on.