Alerts that triage themselves
Twelve alerts stream in. The queue re-ranks by severity times the chance the alert is real, and the ones to contain jump to their own lane.
Try this: Let the alerts pile up for a few seconds, then look at which ones climbed to the top and why.
Nothing yet. Alerts land here the moment the model says contain with a high chance of being real.
This lane is a rule over two answers, not a fifth model output. Move the threshold and the lane changes; the distributions underneath do not.
Waiting for the model to load. The stream starts on its own.
Alerts arrive every 700 ms, faster than they can be read, so a backlog forms and drains in front of you: that is real throughput, in a browser tab. The alerts are synthetic; the shape of the data, the rule names and the four questions mirror a real security triage workflow.