{
  "input_alerts": 8,
  "incident_briefs": 4,
  "window_minutes": 15,
  "incidents": [
    {
      "service": "file-server",
      "fingerprint": "disk-capacity",
      "priority": 1,
      "first_seen": "2026-10-08T09:00:00+00:00",
      "last_seen": "2026-10-08T09:05:00+00:00",
      "alert_count": 3,
      "messages": [
        "Data volume disk utilization is above 85%.",
        "Data volume disk utilization is above 95%."
      ],
      "category": "capacity",
      "suggested_checks": [
        "Check disk and volume utilization.",
        "Identify growth and retention policy.",
        "Review capacity or cleanup changes with the service owner."
      ],
      "status": "human review required"
    },
    {
      "service": "vpn-gateway",
      "fingerprint": "connection-timeout",
      "priority": 2,
      "first_seen": "2026-10-08T09:01:00+00:00",
      "last_seen": "2026-10-08T09:06:00+00:00",
      "alert_count": 2,
      "messages": [
        "VPN connection timeout from the branch office."
      ],
      "category": "connectivity",
      "suggested_checks": [
        "Check service health and recent changes.",
        "Inspect DNS, routing, VPN, and firewall paths.",
        "Record the failing hop before proposing a change."
      ],
      "status": "human review required"
    },
    {
      "service": "identity-service",
      "fingerprint": "auth-denied",
      "priority": 2,
      "first_seen": "2026-10-08T09:02:00+00:00",
      "last_seen": "2026-10-08T09:02:00+00:00",
      "alert_count": 1,
      "messages": [
        "Repeated authentication denied events need identity review."
      ],
      "category": "access",
      "suggested_checks": [
        "Confirm the affected identity and scope.",
        "Review authentication logs and recent policy changes.",
        "Escalate unexpected access patterns for review."
      ],
      "status": "human review required"
    },
    {
      "service": "backup-worker",
      "fingerprint": "job-complete",
      "priority": 4,
      "first_seen": "2026-10-08T09:04:00+00:00",
      "last_seen": "2026-10-08T09:07:00+00:00",
      "alert_count": 2,
      "messages": [
        "Scheduled backup job completed."
      ],
      "category": "general",
      "suggested_checks": [
        "Confirm user impact and affected service.",
        "Compare the alert timeline with recent changes.",
        "Collect evidence and assign an incident owner."
      ],
      "status": "human review required"
    }
  ]
}