Oversight Records

Measure acknowledgement without mistaking it for resolution

This fictional exercise sets a local rule: an alert must be acknowledged within ten minutes of receipt, including exactly the ten-minute boundary. The review time is 09:30. Alert A arrived at 09:00 and was acknowledged at 09:08. B arrived at 09:10 and was acknowledged at 09:23. C arrived at 09:15 with no acknowledgement recorded. All times use one clock and date for this exercise.

Deadlines at the review time in the SentryASI alert ledgerRule: acknowledge within 10 minutesA: 09:00 → 09:08 · on timeB: 09:10 → 09:23 · 3 minutes lateC: due 09:25 · none recorded at 09:30C: overdue by 5 minutes at review

01

Calculate the deadlines and recorded delays

A has a deadline of 09:10 and a recorded delay of eight minutes, so its acknowledgement meets the exercise rule. B has a deadline of 09:20 and a delay of thirteen minutes, so its recorded acknowledgement is three minutes late. C has a deadline of 09:25. At the 09:30 review, fifteen minutes have elapsed since receipt and the deadline is five minutes past. Because C has no acknowledgement record, describe it as overdue without a recorded acknowledgement, rather than assigning it a completed response time of fifteen minutes.

Different evidence, different counts in the SentryASI alert ledgerOn-time acknowledgements: 1 of 3Any recorded acknowledgement: 2 of 3Resolution events: not suppliedC has no completed response timeAcknowledged does not mean resolved

02

Keep the denominator and outcome separate

One of the three alerts has a recorded acknowledgement within the allowed time. The on-time acknowledgement count is therefore one out of three at this review point. Two alerts have an acknowledgement record of any timing, which is a different count. No resolution events are supplied for A, B or C, so the exercise establishes no resolved-alert count. An acknowledgement may begin an investigation, but it does not establish its outcome. Keep these fields separate instead of turning a favourable response statistic into a broader claim that the underlying conditions were handled.

Preserve the snapshot in the SentryASI alert ledgerID · receipt · rule · deadlineAcknowledgement · review timeResolution evidence stays separateLater event → new snapshotKeep what was known at 09:30

03

Preserve the review snapshot when later events arrive

The reusable ledger records alert ID, receipt time, rule version, deadline, acknowledgement time, review time and separately supported resolution evidence. If C is acknowledged after 09:30, append that event and produce a new review snapshot. Do not silently rewrite what was known at the earlier review. In a real workflow, document clock assumptions and how missing records are investigated before drawing conclusions about people or systems. The exercise supplies a precise timing rule and a transparent snapshot; it does not establish why any acknowledgement was late or absent.

Alert ledger ↗

Explore SentryASI

Held for potential development. Acquisition inquiries may be considered.

Domain inquiry ↗