NOC/SOC Alert Triage with Jev: Rules First, One Typed Question, a Policy Gate

An alert arrives and someone has to choose: gather more evidence, attach it to a known incident, or call an analyst. unoblox’s walkthrough turns that choice into a small, auditable decision step for network and security operations. The discipline matters more than the model: snapshot the evidence first (event ID, asset, observation time, severity, what was actually collected), apply deterministic rules before paying for any model call (high severity or conflicting evidence goes straight to an analyst), then ask Jev one Choice question — route: gather_more_evidence, attach_known_incident, or analyst — through the System One endpoint with incident strings explicitly treated as data, not instructions. A recorded example routes a missing path probe to collect_more_evidence at 0.93 confidence. The policy gate then re-checks everything: confidence below 0.85, expired evidence, or an association without a verified open incident all stay with an analyst. Results are reported with unusual honesty: in a 40-case synthetic development replay, rules alone matched 32 expected labels and rules+Jev matched 35, with two rate-limit errors retained as analyst reviews — small repeated scenario templates, not a held-out benchmark, and no claims about MTTR or staffing. The rollout advice: start in shadow mode, compare against analyst judgment, and expand only where the evidence supports it.