Synthetic data & simulated integrations. Every incident, host, identity, indicator and detection source on this page is fabricated for portfolio demonstration. There is no live ServiceNow instance, SIEM, EDR or identity provider connected, and this project is not affiliated with or endorsed by ServiceNow.

SLA & Escalation

Response time model

Budgets are fixed per severity. Consumption above 75% marks an SLA at risk; past 100% it is breached. Escalation is derived from SLA pressure, priority and business-service criticality.

SLA policy

Minutes allowed per stage, by severity.

SeverityAcknowledgeContainResolve
CRITICAL15m1h4h
HIGH30m2h8h
MEDIUM2h8h24h
LOW8h24h72h

Escalation ladder

Highest triggered level wins; every trigger is listed on the incident.

  • none — no trigger met.
  • tier2 — containment SLA at risk.
  • incident commander — containment SLA breached, or P1 priority.
  • executive — critical incident on a mission-critical (C1) business service.

Anomalous privileged token reuse against payments API

SIR-2041 · escalation: executive

CRITICAL
Acknowledge3h 10m over
205m / 15m budgetBreached
Contain2h 25m over
205m / 60m budgetBreached
Resolve35m left
205m / 240m budgetAt risk
  • · Containment SLA breached (342% consumed).
  • · P1 priority requires an incident commander.
  • · Critical incident affecting mission-critical service "Payments Processing".
  • · Critical incident with a breached containment SLA.
Open incident detail →

Large outbound transfer from analytics warehouse node

SIR-2045 · escalation: incident commander

CRITICAL
Acknowledge15m over
30m / 15m budgetBreached
Contain30m left
30m / 60m budgetOn track
Resolve3h 30m left
30m / 240m budgetOn track
  • · P1 priority requires an incident commander.
Open incident detail →

Departing employee bulk-downloading document repository

SIR-2047 · escalation: incident commander

HIGH
Acknowledge10h 35m over
665m / 30m budgetBreached
Contain9h 5m over
665m / 120m budgetBreached
Resolve3h 5m over
665m / 480m budgetBreached
  • · Containment SLA breached (554% consumed).
Open incident detail →

Public object storage bucket exposing analytics extracts

SIR-2044 · escalation: incident commander

MEDIUM
Acknowledge6h 47m over
527m / 120m budgetBreached
Contain47m over
527m / 480m budgetBreached
Resolve15h 13m left
527m / 1440m budgetOn track
  • · Containment SLA breached (110% consumed).
Open incident detail →

Commodity loader detected on finance workstation

SIR-2043 · escalation: none

HIGH
Acknowledge10m over
40m / 30m budgetBreached
Contain1h 20m left
40m / 120m budgetOn track
Resolve7h 20m left
40m / 480m budgetOn track
  • · No escalation trigger matched.
Open incident detail →

Internet-facing staging host missing critical patch

SIR-2046 · escalation: none

MEDIUM
Acknowledge3h 15m over
315m / 120m budgetBreached
Contain2h 45m left
315m / 480m budgetOn track
Resolve18h 45m left
315m / 1440m budgetOn track
  • · No escalation trigger matched.
Open incident detail →

Credential-harvesting phishing wave targeting support staff

SIR-2042 · escalation: tier2

HIGH
Acknowledge1h 25m over
115m / 30m budgetBreached
Contain5m left
115m / 120m budgetAt risk
Resolve6h 5m left
115m / 480m budgetOn track
  • · Containment SLA at risk (96% consumed).
Open incident detail →

Sustained request flood against customer portal edge

SIR-2048 · escalation: none

LOW
Acknowledge3h 40m left
260m / 480m budgetOn track
Contain19h 40m left
260m / 1440m budgetOn track
Resolve67h 40m left
260m / 4320m budgetOn track
  • · No escalation trigger matched.
Open incident detail →