VIP watchlist

When to use VIP

• You want any detection alert that fires on a specific identity (CEO, CFO, security admins, finance team) to surface at higher severity automatically.
• You want a visible badge in the alerts view so SOC analysts can recognize and route VIP incidents within seconds.
• You want VIP identities pinned to the top of the identities list so they are the first place a fresh shift looks.

How it works

1. Tenant admins, partner admins, and super admins can mark any identity as VIP from the /identities page with the "Star VIP" button.
2. When a detection rule fires an alert that is linked to a VIP identity, a single post-pass after detection bumps the severity by one tier (low → medium → high → critical, saturates at critical) and adds a `vip` marker to the alert metadata.
3. The UI keys on that marker to render a "★ VIP" badge inline with the existing category/blast/MITRE chips on /alerts.
4. The bump is idempotent — running detection again on the same alert does not double-bump.
5. Built-in and analyst-authored custom rules both benefit from the post-pass without any per-rule wiring.

How to tag and untag an identity

1. Open /identities.
2. Find the identity you want to escalate. The list is searchable and sorts by risk score by default.
3. Click "Star VIP" in the Actions column. The row immediately shows a gold star and a VIP badge.
4. To remove an identity from the watchlist, click "Unstar" on the same row.
5. Both actions write an `identity.vip_toggled` event to the audit log with the previous and current state, so you have a compliance trail.

Who can modify the watchlist

• Tenant admin, partner admin, and super admin roles can star and unstar identities.
• Read-only roles can see the VIP markers but cannot change them.
• The Star and Unstar buttons are hidden in the UI for users who lack permission.

How VIP interacts with other features

• Severity-driven notification channels: VIPs raise their alerts into your high/critical notification routes automatically. Pair with a dedicated channel for VIP-only routing.
• Incident grouping: when a VIP alert joins an incident, the incident inherits the bumped severity through the existing alert-severity-driven incident severity rule.
• Custom detection rules: alerts created by analyst-authored rules go through the same VIP post-pass, so a custom rule that fires LOW on a VIP identity will land as MEDIUM in the alerts queue.

Operational considerations

• Severity bumps can shift alert volume into higher severity buckets quickly if many of your detection rules target VIPs (admins, etc.). Review alert volume after enabling VIPs for the first time.
• VIP markers are stored on identities (per-ITDR-tenant), not duplicated onto alerts. A VIP toggle takes effect on the next detection cycle (typically within 60 seconds).
• The bump is one tier total, not cumulative — a LOW alert on a VIP becomes MEDIUM, not HIGH. The intent is to raise visibility, not to override severity entirely.