What an incident window actually covers
A report that starts too early buries the reader. A report that starts too late pretends the first alert was the beginning.
Read the noteField notes
Windows, silence, and briefings
Short pieces from report work: how a window is locked, what a quiet export can mean, and when a full chronology is the wrong artifact.
Reading silence in log exports
A quiet export can mean a quiet system, a broken collector, or a filter applied before the file left the building.
Read the note
Briefing people who were not in the channel
The chronology is for people who missed the night shift. It should not require the slang of the channel to be understood.
Read the note
Keeping local tracking files honest
A monthly briefing is only as comparable as the folder it came from. Renaming columns mid-year is a quiet way to break the record.
Read the note
When a full report is the wrong artifact
Not every uncomfortable week needs a twelve-page chronology. Some weeks need a memo that says the alerts are noisy and the collector is late.
Read the note