A definition of done for triage
Teams ship faster when “done” is crisp. Triage needs the same discipline: what cleared, case-ready, and gated mean before automation claims the queue is finished.
Product teams learn quickly that “almost done” is not a state you can plan around. Projects need a definition of done: what finished means for beta, for launch, for the next milestone.
SOC triage rarely gets the same discipline. Queues show closed, open, escalated. Automation shows “handled.” Nobody agrees whether handled meant enriched, investigated, suppressed, or authorized. Under volume, that ambiguity becomes debt. The Monday pile looks processed and still feels unsafe.
Lean SecOps and MSSP leads can fix a surprising amount of tool chaos by writing three definitions of done and forcing every vendor story (and every internal playbook) to map to them.
Done means different things on purpose
Borrow the product habit of staged done. A feature can be done for closed beta and not done for public release. Triage needs the same honesty:
- Cleared: a typed verdict that this row is noise (or otherwise complete for triage), with evidence a later reader can inspect.
- Case-ready: the ambiguous or serious remainder is written as a case: verdict shape, evidence spine, plain-language narrative, recommended next steps.
- Gated: a human has authorized a consequential move, or explicitly deferred it. Preparation by a model is not this state.
Those are not severity labels. They are completion states. Mixing them is how “automation closed it” and “a person owned the risk” become the same checkbox.
Cleared is not the same as hidden
If cleared only means the row left a view, you have suppression. For Caliptra, cleared should mean Sentry-TRM (or a human) landed a typed verdict on evidence already in hand. The first pass is allowed to move early because its job is narrow. It is not allowed to leap into isolate-and-forget.
A useful checklist for cleared:
- Verdict is structured, not only a chat sentence.
- Evidence objects are durable on the same spine Cases will use.
- A second analyst can understand the why without reconstructing raw fields.
- An override path exists when the next shift disagrees.
If any of those fail, call it something else. Language discipline prevents false calm.
Case-ready is how the next shift inherits work
Alerts arrive as events. Humans reason in cases. Case-ready means Sentry-1 (or an analyst) has turned the remainder into something a person can take responsibility for: what we think is going on, what we looked at, what we recommend, what we are unsure about.
This is the handoff surface between overnight and Monday, between L1 and a senior, between MSSP shifts, between model suggestion and human judgment. Without it, every new person redoes archaeology. With it, attention lands on the decision.
Refuse “case-ready” that is only a ticket stub with an enrichment dump. If the next human still has to rebuild the story, the definition of done was theater.
Gated is the only done for consequential action
Isolate, disable, block, mass reset, anything hard to undo: done means a person accepted the cost of being wrong. The product must make that line hard to miss.
Deterministic automation can still execute after the gate. Agentic investigation can still prepare the recommendation. Neither should silently become the approver. For multi-tenant MSSP work, gated also means tenant context was visible when the person said yes.
Human-in-the-loop without this state is a demo button.
How to use the three states in a design-partner week
Pick one alert class. For each row in a sample, label the outcome: cleared, case-ready, gated, or incomplete. Incomplete is allowed. It is a signal.
Then ask:
- Which rows claimed cleared without evidence?
- Which cases a second person could read cold?
- Which actions almost ran without a visible gate?
- Where did corrections go after a human override?
Score pass / fail / unclear. Do not invent a composite KPI. The goal is shared language between buyer, operator, and vendor.
Why this matches how calm teams ship
Clear definitions of done reduce status theater. They also make automation safer: you can speed first-pass clearing and deep investigation without collapsing preparation into authority. Spectrum thinking helps here. Deterministic workflows for known, reversible steps. Reasoning for ambiguous investigation. Humans for risk.
Caliptra is building the path to match those states: Sentry-TRM for cleared-capable first pass, Sentry-1 for case-ready investigation, HITL for gated action. Attention stays scarce. Done stays crisp. The queue stops claiming it is finished when it has only gotten quieter.