Escalation Decision Tree
IT IT Ops
The prompt
Build decision framework for escalating to IR, threat intel, or law enforcement based on alert characteristics.
Why this works
Explicit trees eliminate ambiguity and reduce mean-time-to-escalation (MTTE).
Risks & review
Trees become outdated; update quarterly. Managers may over-rely on rules without context.