Verify an Alert's Claim Before Replying

Overview

An alert message is a claim, not a fact. It reflects one query's result at one moment, possibly minutes-to-hours ago, possibly from a rule with a known artifact. Answering from the alert text alone propagates whatever it got wrong. The loop: re-derive the claim from live data, classify it, then draft a reply.

The loop