Triage security alerts like a SOC analyst — gather context, classify the threat, open a case and acknowledge it
