Your Alert Backlog Is Aging - Here's How To See It

Your fleet's alert backlog has two failure modes, and most teams only watch one.

The one everyone watches is the breach: a critical alert that has blown its response SLA, a node that regressed and nobody acknowledged it in time. WinSentinel Pro's alerts triage verb is built for exactly that — it ages each open alert against a per-severity SLA and shows you what's overdue right now. And alerts responsiveness looks backward: over the last 30 days, how fast did you acknowledge and resolve? MTTA, MTTR, per severity.

The failure mode nobody watches is quieter and, in the long run, more dangerous: the slow pile. Dozens of low- and medium-severity alerts, none of them breaching anything, all of them open for three, four, six weeks. Every one is technically "within SLA" because low-severity SLAs are generous. Collectively they are a backlog that is rotting — the accumulation of small risks nobody ever closes, and the exact soil that alert fatigue grows in.

Aging is not triage

Triage answers "what's on fire." Aging answers "how old is everything that isn't on fire" — because that's where silent risk hides. A backlog can be 100% green on triage and still be a disaster: forty open alerts, median age 18 days, a tail of a dozen that have sat untouched for over a month. No single alert is overdue, but the backlog as a whole has stopped moving.

That's the gap the new alerts aging verb fills. It takes your open alerts and buckets them by age — under a day, 1–3 days, 3–7 days, 7–30 days, and 30 days and older — then cross-tabulates each band by severity. You get a histogram of your backlog's health in one glance.

What it looks like

$ winsentinel-fleet alerts aging

Alert backlog aging (oldest first)
──────────────────────────────────
  Backlog:    41 open  ·  14 stale (≥7d)  ·  mean 11d  ·  median 6d

  Age distribution:
    < 1d      6  ████████                (high 1  low 5)
    1–3d      9  ████████████            (medium 3  low 6)
    3–7d     12  ████████████████        (high 2  medium 4  low 6)
    7–30d    11  ███████████████         (high 1  medium 5  low 5)
    30d+      3  ████                    (medium 1  low 2)

  Oldest:     [medium] open 47d — LLMNR still enabled on 3 nodes

  Stale tail (≥7d, oldest first):
    [medium] #218 policy_violation  ·  open 47d  LLMNR still enabled on 3 nodes
    [high]   #191 drift             ·  open 19d  Node WEB-03 fell off CIS L1
    ...

The histogram makes the shape of the problem obvious: this fleet isn't drowning in criticals, it's slowly silting up with mediums and lows that never get closed. The stale tail — anything at or past the staleness threshold (7 days by default) — is called out explicitly, oldest first, so the pile nobody is closing has a name and a number.

Tunable, scriptable, exportable

Set your own definition of "stale" with --window. A high-tempo SOC might call three days stale; a small team might allow two weeks:

# treat anything open ≥ 3 days as stale
winsentinel-fleet alerts aging --window 3

# only the mediums, capped to the 5 oldest
winsentinel-fleet alerts aging --severity medium --limit 5

Like every other fleet verb, it speaks --json for automation and --csv for evidence. The CSV emits one row per age band with its per-severity counts — drop it straight into a standup deck, a spreadsheet, or a compliance evidence pack:

$ winsentinel-fleet alerts aging --csv
band,label,count,critical,high,medium,low,stale_seconds
lt1d,< 1d,6,0,1,0,5,604800
d1to3,1–3d,9,0,0,3,6,604800
d3to7,3–7d,12,0,2,4,6,604800
d7to30,7–30d,11,0,1,5,5,604800
gte30d,30d+,3,0,0,1,2,604800

It's pure and side-effect-free under the hood — the CLI fetches your open alerts and the aging is computed locally, so it's fast and deterministic, with no extra load on your control plane.

Three verbs, three questions

Together the alert analytics verbs cover the questions a security lead actually asks:

• alerts triage — What has breached SLA and needs a response now?
• alerts responsiveness — How fast has the team been acknowledging and resolving?
• alerts aging — Is the backlog fresh churn, or an aging pile that's quietly growing?

Watch only the first and you'll pass every audit while your real risk compounds in the tail. Watch all three and you see the whole board.

Getting it

Alert aging is part of WinSentinel Pro — the fleet control plane that turns a room full of standalone WinSentinel agents into a managed fleet with cross-node reporting, drift alerts, and compliance rollups. The single-machine tool stays free and full-power; fleet orchestration is the Pro layer. See how the fleet works or compare plans to get started.