Triage model

Alerts start in a state the system owns. Agents get a ticket only when a human can act. Chronic stores go to an engineer.

A hard-down store goes to an agent after15minutes down

Skip rule for flaps: a second separate outage within 24 hours goes to an agent regardless of length Do not apply this threshold to hard-down stores. Backup-WAN-down and device-down-with-WAN-up alerts never go to an agent on the timer; they wait for a flap or a call from the store 24 hr hold for WAN2 events: a backup-WAN-down alert goes to an agent only if the backup is still down after 24 hours. Overrides the timer and the flap rule for those alerts The system handles holds, status updates and closing codes. Agents only write diagnosis

Chronic stores to an engineer

–reach an agent

–closed by the system

–to an engineer

–less agent writing

–fix rate at agents · today 16%

–of fix tickets reach a human

A fix ticket that stays in Watching counts as missed. Agent writing excludes phone-system call logs, and overstates time saved: macros are fast, diagnosis is slow.

Needed first: store hours per site, a resolution code on every close, one definition of offline versus degraded.