Work Item Types
ShiftZero offers more than just SOC alerts. There are five types of work items, each with its own decision, notes, and review tone.
Depending on the ticket type, the title of your decision, the wording on the confirmation button, the questions that guide your notes, and the evaluation criteria will change. This helps you train for real-world situations that go beyond just monitoring alerts.
Alert Ticket
Triage DecisionPick the classification the evidence supports, not a guess.Instant review — tactical
Incident Case
Response DecisionChoose the right action for this response stage while preserving evidence and limiting impact.Instant review — process
Risk Review
Risk DecisionWeigh likelihood and impact, then decide how the risk should be treated.Instant review — reasoning
Finding Review
Finding VerdictConfirm whether the finding is real and how severe it is in this environment.Instant review — calibration
Report Task
Report OutcomeStructure what happened, its impact and the next steps for your audience.Instant review — structural
Don't be surprised if you find a ticket that doesn't ask for "alert triage" — it might be a risk review, a results analysis, or even a report writing task. Read the decision title first.