{"id":"IDR-001","section":"AI Detection & Response","requirement":"Generate actionable alerts","acceptance":"Include tool, account type, detection type, policy, action, timestamp, and user or team context.","tier":"AT0–AT4","whyItMatters":"An alert the SOC cannot act on is noise. The fields decide whether triage takes seconds or a ticket.","verificationMethod":"LT","verificationTest":"Pilot alerts carry every listed field and can be triaged without opening another console.","formerly":"DAT-006","alsoIn":[],"sort":32,"adoptionContext":"Alerts need enough context to identify the originating employee AI workflow across the listed adoption settings, without unnecessarily reproducing sensitive content.","mappings":[{"frameworks":["csf"],"explanation":"Tool, account, policy, action, time and user context provide adverse-event analysis evidence and information suitable for authorized responders. An alert must actually reach the appropriate staff or tools; generation alone does not perform analysis.","kind":"framework","references":{"csf":["DE.AE-02","DE.AE-06"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"The contextual alert supplies an AI event record describing what was detected and what action occurred. Wider logging arrangements, including retention and protection, remain necessary.","kind":"framework","references":{"iso":["A.6.2.8"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Context-rich alerts create an event trail and evidence for anomaly monitoring and incident triage. Determining incident significance, assigning ownership and responding require an operated review process.\nISO/IEC 27001: A.8.15: Keep attributable event records with appropriate retention, protection and analysis; a live view alone is insufficient.","kind":"framework","references":{"soc2":["CC7.2","CC7.3"],"iso27001":["A.8.15","A.5.25"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-001","frameworkRefs":{"ISO27001":["A.8.15","A.5.25"],"ISO42001":["A.6.2.8"],"NIST-CSF":["DE.AE-02","DE.AE-06"],"SOC2":["CC7.2","CC7.3"]}}