An agent already did something wrong — or something that could have. Before anyone opens a review, someone has to answer two separate questions: how bad was it in fact, and which of a small number of root causes it actually fits. Answer 9 triage factors and a root cause, and get a minor/major/critical classification, the investigation depth it warrants, the 8 hard floors that override a raw score, and a root-cause-specific focus checklist that routes you to the right sibling tool. Free.
Severity and root cause are answered separately on purpose — how bad it was does not tell you why it happened, and why it happened does not tell you how bad it was. Answer both from what actually happened, not from how it was supposed to go.
Unlimited triage is free and stays free. The Incident Response Pack is what the rubric deliberately does not do: it tells you how to actually run the review the triage just sized.
Team licence for a platform or security group? Email for a group rate.
Unlocks the Incident Response Pack on this device and survives reloads. No account, nothing transmitted.