Faster alert routing competes with preserving the evidence behind every severity call.
The route must reduce context reconstruction without turning a suggested severity into an unreviewed decision.
Who you’d be doing this for
“I got the domain in time, but I still had to ask where the severity came from.”
Beatriz Pinto · Threat Intelligence Analyst
Uses threat events and indicators to investigate suspicious infrastructure and inform security controls.
What is at stake
Suspicious-domain alerts are spending too long in context gathering before an engineer can set severity. You must weigh a faster route against the evidence engineers need to trust each suggestion.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- faster routing vs. defensible severity
- automation assistance vs. engineer judgment
- detection signal protection vs. useful context
- pilot learning vs. on-call stability
Why Cloudflare
Threat Events and IOC integrations need traceable severity decisions before customer analysts use indicators in security controls.
Written with these in mind
Not your kind of problem? 51 more at Cloudflare, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.