Blog
The trigger said Sev 1. The room said Sev 2.
At 02:14 the EDR flags encryption on prod-payments-01. The plan says that is Sev 1 even while authorizations are still succeeding. Priya calls it Sev 2. The packet has to keep both grades.
At 02:14 on 18 October 2026, the EDR on prod-payments-01 flags that pay-auth has been encrypting files in the settlement directory, about 400 MB since 02:11. The host is still taking authorizations. Priya S (on-call, platform) is the only person on the bridge. The severity table is open in front of her. It says encryption of cardholder data, or of a directory that holds it, is Sev 1, whether or not the service is still up. Sev 1 means declare, page Dana K (legal), and start the customer-notice draft. Sev 2 does not. Priya types Sev 2 at 02:14. Her line in the channel: authorizations are succeeding, one directory, not an outage. She isolates prod-payments-01 at 02:19. She does not page Dana. Marcus T (incident commander) joins at 02:31, reads the same sentence aloud, and declares Sev 1. Dana is paged at 02:33. Nobody opens a notice draft.
A weak record of that sitting reads:
Severity aligned to Sev 1 at detection. Legal paged per the plan. Customer notice started within the hour.
A strong one reads:
18 October 2026, 02:14. EDR on prod-payments-01: pay-auth encrypting the settlement directory, about 400 MB since 02:11, host still taking authorizations. Plan trigger: encryption of cardholder data, or of a directory that holds it, is Sev 1, whether or not the service is still up. Sev 1 pages legal and starts the customer-notice draft. Priya S graded it Sev 2 at 02:14 because authorizations were succeeding. She isolated prod-payments-01 at 02:19 and did not page Dana K. Marcus T joined at 02:31, read the trigger, and declared Sev 1. Dana paged at 02:33. No customer-notice draft in this sitting. Follow-up: Marcus walks Priya through this alert against the written trigger before her next on-call week, by 1 November 2026. If Wei L, grading the same alert with the table in front of him and without talking to Priya, still says Sev 2, Marcus rewrites the line.
Both rooms isolated the host. Only the second shows that legal was unpaged until 02:33, nineteen minutes after the trigger was already true, and that nobody opened a notice draft. The first costs you the sample. A reader in March thinks Dana was on the clock when the alert fired, and that a draft from that hour is in the file. The Sev 1 steps started when Marcus reread a sentence Priya had already graded the other way.
A countable line can still be misread
The free plan self-check asks whether severity levels are defined with triggers two people would apply the same way. The failure it names is an adjective. A line that cannot fail this sitting:
Sev 1 means critical business impact. The incident commander confirms the grade.
A line the room can miss:
Encryption of cardholder data, or of a directory that holds it, is Sev 1, whether or not the service is still taking authorizations. Sev 1 pages legal and starts the customer-notice draft. Sev 2 does not.
Under the first line, Priya and Marcus can both claim they followed the plan. "Impact" is doing all the work, and an outage is the only impact Priya counted. The second line is specific enough to be wrong at 02:14, which is why it is worth sitting down for. This room already had that second line. Priya still treated a live authorization path as a downgrade. A countable trigger does not apply itself. If your table still says critical business impact, answer the self-check before you book the hour. The thresholds in this post are an example, not a scale to copy.
Do not smooth the Sev 2 out of the note
Marcus's correction at 02:31 will feel like the exercise getting back on track. The easy rescue is to write that the room agreed Sev 1, and to drop Priya's line because the commander fixed it. The file then reads as if the trigger was applied when the alert fired. It was applied when a second person arrived and reread it.
Leave the Sev 2 in the record, next to the isolate. Isolating prod-payments-01 at 02:19 did not page Dana, and it did not start the draft. Those two start on the number. The injects post already has a T+0 choice: declare Sev 1 now, or wait for a second host. That is a scope question. This sitting is the grade after the directory is already named. Write the grade as its own inject, before anyone drafts a letter:
T+0. The settlement directory on prod-payments-01 is encrypting. Authorizations are still succeeding. Read the severity table and say the number. Do not isolate the host from this inject, and do not draft the notice.
The notice draft, once the number is Sev 1, is a later sitting, covered in the customer-notice post. Do not let that draft fill the minutes this grade needs.
What the packet records
Write both grades in the free evidence template: the trigger text, Priya's Sev 2 at 02:14, the isolate at 02:19, Marcus's Sev 1 at 02:31, the page to Dana at 02:33, and Marcus's follow-up with a date. Hang the alert on the ransomware family in the scenario library. That family already walks encryption and the question of whether data left. The grade is the line before either of those, and it is the line that decides whether legal is in the room for them. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the disagreement instead of a sentence that says severity was aligned.
Two grades in one file show which reading these named people used, and from which minute the Sev 1 steps started. The file does not show that the EDR rule fires on prod-payments-01, and it does not send a customer notice. A detection-rule check, and a notice sent outside an exercise, are different records.
Bottom line: write both numbers, and the minute the trigger was already true. Aligned to Sev 1 is the smoothed version. The packet has to show the grade the room acted on.