- Case identity, authority, and restricted classification
- Records the controlled case reference, request authority, operational purpose, incident type, need-to-know classification, personal-data restrictions, legal or regulatory relevance, and authorized management audience.
- Occurrence, intake, severity, and triage timing
- Captures incident time, report time, intake acceptance, severity rationale, immediate risk, guest or control impact, required response window, triage owner, and any delay between event and review.
- Evidence hold, retention, and source availability
- Shows video, access, transaction, table, machine, communication, and witness sources; preservation status; clock alignment; retention deadline; export reference; custody; quality limits; and missing evidence.
- Review stage, scope, and outstanding dependency
- Classifies the case as Intake, Active review, Awaiting source, Escalated, Management decision, Closure review, or Closed and records explicit scope, exclusions, competing accounts, external dependencies, and next analytical step.