When we resolve an escalation as “Resolved – Unauthorized,” Huntress converts it to an incident (good) but also fires the call-everyone notification (problem). By that point a human is already on it — the classification itself is the acknowledgment.

The result is alert fatigue: the team learns that a call probably means “someone’s already handling it,” so when a genuinely unknown, auto-detected compromise fires a call, no one reacts with the urgency it’s meant to carry. The notification loses its signal value.

Proposed change: When a human manually classifies an escalation as Unauthorized, still create the incident/ticket, but suppress the mass call — a person is demonstrably already engaged. Reserve call-everyone notifications for auto-detected incidents no one has acknowledged yet. Ideally, a toggle so partners can keep the current behavior if they prefer.