If two analysts would differ, the rule is unfinished
A rule that fires without a documented next step leaves every analyst to invent one. Two people closing it differently is the symptom, not the problem.
A rule fires. Now what?
In most places that answer lives in somebody’s head, and which head decides what happens. One analyst checks the parent process and closes it. Another opens a case and calls the asset owner. Both are being sensible. Only one of them is repeatable.
That is not a training problem. There is nothing to train against.
The person best placed to write the answer is whoever wrote the rule, at the moment they wrote it. They already know what made the technique worth catching, what the benign version looks like, and what would convince them it was real. None of that survives the week unless it ships with the rule.
Three lines is enough. What it means if this is genuine. What to check first. What closes it.
That is not a runbook and it does not need a project. It is the difference between a detection somebody built and a detection somebody can operate, and it costs about five minutes while the reasoning is still fresh.
There is a test for whether you have it. Hand the alert to your newest analyst and watch whether they have to ask someone. If they do, the rule is not finished, and the gap is being paid for on every firing.
Take your five most frequent alerts and write those three lines. It is an afternoon, and it will outlast the rules themselves.
CHECK YOURSELF
Two analysts close the same alert type in different ways, and both believe they handled it correctly. What does that tell you?
SHOW THE ANSWER
The rule shipped without a documented response, so each analyst invented one
Why. Two people acting reasonably and differently is the signature of a missing artifact rather than a missing skill. Retraining does not help when there is nothing written to train against. Enrichment changes how much work an alert costs, not what the work is. Severity decides which queue it reaches, not what happens once somebody opens it. The gap is the sentence nobody wrote: what this means if it is real, what to check first, and what closes it.