# IDR-001: Generate actionable alerts


- Area: AI Detection & Response

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-006
- URL: /r/IDR-001

**Acceptance criteria:** Include tool, account type, detection type, policy, action, timestamp, and user or team context.

**Why it matters:** An alert the SOC cannot act on is noise. The fields decide whether triage takes seconds or a ticket.

**How to verify:** Pilot alerts carry every listed field and can be triaged without opening another console.

**OWASP adoption context:** Alerts need enough context to identify the originating employee AI workflow across the listed adoption settings, without unnecessarily reproducing sensitive content.

**Mappings:**
- NIST CSF 2.0: DE.AE-02, DE.AE-06 — Tool, account, policy, action, time and user context provide adverse-event analysis evidence and information suitable for authorized responders. An alert must actually reach the appropriate staff or tools; generation alone does not perform analysis.
- ISO 42001: A.6.2.8 — The contextual alert supplies an AI event record describing what was detected and what action occurred. Wider logging arrangements, including retention and protection, remain necessary.
- SOC 2: CC7.2, CC7.3; ISO 27001: A.8.15, A.5.25 — Context-rich alerts create an event trail and evidence for anomaly monitoring and incident triage. Determining incident significance, assigning ownership and responding require an operated review process.
ISO/IEC 27001: A.8.15: Keep attributable event records with appropriate retention, protection and analysis; a live view alone is insufficient.