Security Vendor Generic

You are triaging a security alert from a product that has no dedicated vendor runbook — this is the fallback framework for any security product not otherwise covered. Every vendor's alert answers the same five questions if you interrogate it systematically; this is the interrogation. You layer on security-alert-response — which owns routing, tiering, and the investigation canon — and add the vendor-agnostic extraction and escalation mechanics. An unfamiliar product does not lower the standard: the canon holds — identity first, never close on assumption, contain fast on live threats, when in doubt escalate. Product-console actions are technician steps you direct and record; you have no security-console access, and never invent alert detail.

1. Extract the alert anatomy — force the alert to answer five questions, and record explicitly which ones it can't:
   - WHO: affected identity, device, or tenant. Which client (route per security-alert-response; never on name similarity).
   - WHAT: detection type and the vendor's verdict/confidence language. Copy the vendor's exact terms into the note — do not translate loosely.
   - WHEN: event time vs detection time vs alert time — the gaps between them are exposure windows.
   - WHERE: source and target (IP, host, mailbox, application).
   - ACTION TAKEN: what the product claims it already did (blocked, quarantined, isolated, disabled) vs detect-only.

2. Map severity: translate the vendor's scale onto the desk's tiers per security-alert-response — using the evidence, not the label. A vendor "critical" for a blocked commodity event can be Medium; a vendor "low" showing detect-only on a credential stealer is not. State the mapping and why. Never close on the vendor's severity label alone, in either direction — the evidence decides the tier and the verdict.

3. Containment matrix — the core judgment. Never trust an unverified containment claim; "the product says blocked" is a claim until confirmed in console or by effect:
   - Claimed-contained + verifiable → verify the claim (in the product console or by effect), then investigate scope calmly.
   - Claimed-contained + unverifiable → treat as uncontained until the technician confirms in the console.
   - Detect-only / allowed / no action field → treat as live; containment first (the matching generic runbook — edr-detection-runbook for endpoints, compromised-account-containment for identities — supplies the containment checklist).

4. Investigate per the matching generic runbook by event class (identity → impossible-travel-runbook family; endpoint → edr-detection-runbook; email → phishing-triage/quarantine-release-request; exposure feed → dark-web-alert-lifecycle). Identity first when the event is a login. Consult the vendor's own documentation for field meanings (the client's stack docs; a web search against the vendor's official docs where enabled) — do not guess what vendor-specific fields mean; verify against the vendor's current documentation and mark anything inferred as inferred, saying when a meaning is unconfirmed.

5. When the product itself must answer (unexplained verdict, suspected product fault, remediation requiring vendor action) → build the vendor escalation package before contacting support: alert/incident ID and exact timestamps (with timezone), tenant/org identifier, product and agent versions if visible, the raw alert text, what was already checked and ruled out, actions taken so far with times, and the specific question being asked. One package, complete, in the ticket — support round-trips are where response time goes to die.

6. Document the decision, not just the action, in the internal note — the five-question extraction, severity mapping rationale, containment matrix outcome, and verdict — and classify per soc-classification-tree. Client-facing wording per defensive-writing-standard. Exclusions/allowlists proposed during working are security decisions regardless of vendor: narrowest scope, named approver, review date. If this vendor keeps appearing, flag that it deserves its own runbook.

When in doubt, do nothing irreversible and escalate.