Alert, action and interruption ledger

Method, inputs and limits

Describe dated alerts, audited misses, process latencies and explicitly disjoint service interruption counts. Method version 0.2.0. Infer warning efficacy, prevented harm, attack attribution or causal health outcomes from timing alone.

Visible mathematics / decision rules

warning lead hours = (event time − issue time) / 3,600,000; negative means late warning

process latency hours = (later verified timestamp − earlier timestamp) / 3,600,000

group customer-hours = customers × outage hours; sum only for explicitly disjoint groups

known-outcome precision = confirmed-event alerts / (confirmed-event alerts + false alerts)

documented distinct-event recall = detected distinct event IDs / (detected distinct event IDs + audited missed-event IDs); unknown outcomes and unaudited misses remain separate

What this result cannot establish

• Unknown outcomes and unaudited miss candidates are not classified as success or failure.
• Interruption totals require explicit disjoint scope; timing alone does not show that an action caused an outcome.

What would falsify the assumptions?

• Compare this ledger to independently audited event and action records.
• Identify an overlapping customer group, undocumented event or incorrectly ordered timestamp.
• Faster shared reporting with more false alerts or misses may add risk.
• Assumptions fail if the supplied definitions, units, period, scope or source records are wrong or incomplete.
• An independent source audit or replication may contradict an input or the recorded dependency.
• This method creates no resources. Physical conservation is checked in the inventory and transfer ledgers; descriptive graphs and checklists are not resource-flow models.
• The same equations and review checklist can be reproduced with a spreadsheet or structured human-only process.
• This is deterministic arithmetic, a descriptive comparison or a structured governance check, not a fitted causal effect or forecast. Fictional inputs remain an exercise.
• Equal or worse measured errors, net review effort, disclosure burden or fallback under MAR would show no added benefit or added risk; no improvement is assumed.

{
  "observations": {
    "unit": "events",
    "origin": "synthetic",
    "sources": [
      {
        "id": "SYN-001",
        "kind": "synthetic",
        "label": "Fictional alert and interruption audit",
        "url": null
      }
    ],
    "alerts": [
      {
        "id": "A1",
        "issuedAt": "2025-01-01T00:00:00Z",
        "outcome": "confirmed-event",
        "eventAt": "2025-01-01T03:00:00Z",
        "authorizedActionAt": "2025-01-01T00:30:00Z",
        "acknowledgedAt": "2025-01-01T01:00:00Z",
        "receivedAt": "2025-01-01T02:00:00Z",
        "eventId": "E1"
      },
      {
        "id": "A2",
        "issuedAt": "2025-01-01T00:00:00Z",
        "outcome": "false-alert",
        "eventAt": null
      },
      {
        "id": "A3",
        "issuedAt": "2025-01-01T00:00:00Z",
        "outcome": "unknown",
        "eventAt": null
      }
    ],
    "misses": [
      {
        "id": "M1",
        "eventAt": "2025-01-02T00:00:00Z",
        "audited": true
      }
    ],
    "interruptions": [
      {
        "id": "G1",
        "customers": 100,
        "hours": 2
      },
      {
        "id": "G2",
        "customers": 50,
        "hours": 3
      }
    ]
  },
  "parameters": {
    "interruptionGroupsDisjoint": true
  }
}

{
  "falseAlerts": 1,
  "auditedMisses": 1,
  "unknownOutcomes": 1,
  "customerHours": 350,
  "precision": 0.5,
  "recall": 0.5
}

Authoritative background references

• NIST: Cybersecurity Framework 2.0 — Outcome taxonomy, not a calculated national risk score. Reviewed 2026-11-09. Reference, not endorsement or validation.

These sources inform definitions or review practices. They do not validate this implementation or endorse MAR.