Alerting and Notable Workflows

Assess whether a Splunk alert, scheduled-report action, or Enterprise Security finding/notable or risk workflow is ready and where an observed break belongs. This skill is advisory and non-mutating. It does not write searches, operate a Splunk deployment, change a response record, or treat documentation as proof of runtime behavior.

Prerequisites

Start with the user's requested decision and every supplied fact. Build a small evidence ledger using exactly:

• [supplied] for a requirement or assertion from the user;
• [observed] for a value directly shown by a named UI view, job or scheduler record, action log, message, webhook response, or downstream receipt, with time window and environment;
• [inferred] for a bounded interpretation derived from labeled facts; and
• [unknown] for an absent, stale, contradictory, or inapplicable fact.