Incident → Learning → Better detection → Better response
Post-closure lessons learned
Each drills to the incident behind it
Proposed detection improvements
Derived from coverage gaps — proposals only, the agent cannot deploy detections
SOC KPI trend
Alert volume and incident count per week