J
James Carter
When actioning a security alert, the most important information should be at the top so that a service technician can start to remediate the issue without having to read the entire report.
  1. User or device name.
  2. A brief description of the issue.
Example
* Username:
*Host/Device:
*Reason: Example - Unauthorized VPN, Suspicious login activity, or A document containing passwords.