Walkthrough · 3 August 2026
Briefing the people who do not read logs
How to walk a mixed room through incident charts without turning the hour into a detector tutorial.
The ninety-minute walkthrough that sits with our quarterly pack is not a lesson in detections. It is a rehearsal for the next meeting the security lead already has in the diary. We assume the room holds at least one person who has never opened the SIEM and at least one person who lives in it.
We open on the window and the known pauses, not on the noisiest spike. If you open on the spike, the specialist will jump to rule names and the non-specialist will wait for a translation that never comes. After the window, we show volume, then severity, then the two or three incidents that broke the pattern. Rule names stay in an appendix.
Leave twenty minutes for questions that are not about the charts: who still owes a sentence to the insurer, whether a supplier incident belongs in the same picture, whether next quarter’s window should move. Those questions are why the pack exists. The figures only earn their keep if they make those questions shorter.
If you present without us, steal that order. Window, pauses, volume, severity, exceptions. Keep detector folklore for the corridor.