Operational Decision
An operational decision is a recurring security judgment—prioritize, defer, escalate, or coordinate—made under uncertainty using Security Intelligence, not a one-time incident command or tool default.
Operational Decision
Definition
An operational decision is a recurring security judgment—such as prioritizing a queue item, deferring work, escalating for investigation, or coordinating across functions—made during daily operations under uncertainty, using Security Intelligence and entity context as decision support.
Operational decisions differ from incident command decisions: they happen continuously across shifts, apply intelligence to routine queues, and must remain explainable when conditions change. They are not tool defaults, severity sorts, or playbook steps executed without reasoning.
SentriScope Usage
SentriScope surfaces operational decision context—exposure, correlation, entity linkage, and intelligence overlays—so analysts can document why a queue rank or deferral changed. This entry defines the term only.
Related terms
- Decision Support —
KID-GLS-0023 - Security Intelligence —
KID-GLS-0028 - Operational Context —
KID-GLS-0027 - Operational Feedback —
KID-GLS-0041
Related Knowledge
- Understanding Security Operations —
KID-CON-0130 - Operational Decision Cycles —
KID-CON-0131 - FAQ: What is Security Operations? —
KID-FAQ-0066 - SER-013 Security Operations