1. Name the window in writing
Before colour, before volume, we lock the first trusted hour and the last hour in the pack, with timezone. Fiscal quarters are welcome as a committee habit; they are not allowed to split a named burst across two pictures without a mark on the figure.
2. Lay the pauses on the paper first
Change calendars, bank holidays, and known collector failures become shaded bands. Volume is drawn around those bands, never through them. If the extract cannot explain a quiet stretch, the caption reads “cause not in the extract.”
3. Keep severity and status apart
Colour does one job. If it shows severity bands from your own labels — Priority 1, high, or whatever the detector already says — then open versus closed is a mark or a small table. We print a greyscale proof so a photocopied board pack still separates the bands.
4. Caption what the figure refuses to say
Each chart carries a sentence that states the window, the source file, and the lie it will not tell. A spike is not “an attack” unless the ticket says so. A quiet Tuesday is not “improved posture” if Plant 3 had no endpoint feed.
5. Walk the pack in the order the next meeting needs
Window, pauses, volume, severity, exceptions. Detector folklore stays in an appendix. The ninety minutes exist so the security lead can rehearse the questions finance or legal will actually ask.
What we will not do in the method
We will not merge sites that keep different clocks. We will not take administrator access in order to “pull a cleaner export.” We will not forecast next quarter’s volume from this one. Those refusals are part of the method, not small print.