WEBVTT 00:00:00.030 --> 00:00:04.380 position:50% align:center size:88% Let's review a saved incident record and its linked later occurrence. 00:00:04.430 --> 00:00:07.987 position:50% align:center size:88% We'll compare the recorded checks with the evidence kept in that record. 00:00:08.467 --> 00:00:12.242 position:50% align:center size:88% Start with the original checkout incident from October first. 00:00:12.317 --> 00:00:16.842 position:50% align:center size:88% Its status is Resolved, and its record is marked Human reported. 00:00:16.917 --> 00:00:20.492 position:50% align:center size:88% That grade describes the evidence behind the recorded fix. 00:00:20.567 --> 00:00:23.592 position:50% align:center size:88% It does not say the platform verified recovery. 00:00:23.642 --> 00:00:27.710 position:50% align:center size:88% We'll follow the checks and the saved record before its later occurrence. 00:00:29.560 --> 00:00:31.435 position:50% align:center size:88% Scroll to Probable cause. 00:00:31.485 --> 00:00:35.135 position:50% align:center size:88% The error start comes from the time sent by the alert source. 00:00:35.210 --> 00:00:37.735 position:50% align:center size:88% The window looks back seventy-two hours. 00:00:37.810 --> 00:00:41.935 position:50% align:center size:88% It says no earlier error was found, with health still unproven. 00:00:42.035 --> 00:00:44.960 position:50% align:center size:88% No verified good-state anchor is recorded here. 00:00:45.035 --> 00:00:48.205 position:50% align:center size:88% Keep that boundary in view as we compare the changes. 00:00:50.280 --> 00:00:52.330 position:50% align:center size:88% Scroll to the other ranked changes. 00:00:52.380 --> 00:00:56.230 position:50% align:center size:88% Compare the five candidates by their recorded timing and relevance. 00:00:56.280 --> 00:01:00.555 position:50% align:center size:88% The analysis selects rank one with confidence zero point seven eight. 00:01:00.605 --> 00:01:04.605 position:50% align:center size:88% That score expresses a hypothesis, not measured accuracy. 00:01:04.680 --> 00:01:08.080 position:50% align:center size:88% Open What this list cannot show to read the capture limits. 00:01:08.155 --> 00:01:10.680 position:50% align:center size:88% The recommendation still needs evidence. 00:01:10.780 --> 00:01:15.112 position:50% align:center size:88% One resource lacks before-state; a usable restore is not established. 00:01:20.200 --> 00:01:23.825 position:50% align:center size:88% Open Validation and compare the stored recheck rows. 00:01:23.900 --> 00:01:26.550 position:50% align:center size:88% All four recorded results are Uncertain. 00:01:26.625 --> 00:01:30.150 position:50% align:center size:88% Each says the correlated alert had not cleared at its source. 00:01:30.225 --> 00:01:33.825 position:50% align:center size:88% Each row keeps a time and summary for that observation. 00:01:33.875 --> 00:01:37.100 position:50% align:center size:88% The incident has no recorded condition-cleared time. 00:01:37.175 --> 00:01:40.168 position:50% align:center size:88% These checks do not establish verified recovery. 00:01:46.720 --> 00:01:49.945 position:50% align:center size:88% Open the saved record from this incident's own link. 00:01:50.045 --> 00:01:54.120 position:50% align:center size:88% Read the original Human reported grade beside the saved evidence. 00:01:54.195 --> 00:01:56.620 position:50% align:center size:88% Its current status is Did not hold. 00:01:56.720 --> 00:02:00.145 position:50% align:center size:88% These fields describe different points in the record's history. 00:02:00.270 --> 00:02:04.220 position:50% align:center size:88% Scroll through its recorded checks, then return to the status. 00:02:04.295 --> 00:02:07.456 position:50% align:center size:88% The record does not contain a verified healthy state. 00:02:09.960 --> 00:02:13.435 position:50% align:center size:88% Choose The same alert to open the linked later incident. 00:02:13.510 --> 00:02:16.285 position:50% align:center size:88% This is a separate occurrence from later that morning. 00:02:16.360 --> 00:02:20.510 position:50% align:center size:88% It needs attention and has its own completed investigation. 00:02:20.585 --> 00:02:23.485 position:50% align:center size:88% Its link returns to the original incident. 00:02:23.560 --> 00:02:27.485 position:50% align:center size:88% The saved relationship does not confirm the same root cause. 00:02:27.560 --> 00:02:30.419 position:50% align:center size:88% Compare both dates before reading the later result.