How do you handle alert triage with a distributed team? ES workflow tips?

Hey everyone! I've been deep in our Splunk ES deployment for about 18 months now, primarily using it to monitor our marketing tech stack for anomalous behavior (think: massive, unexpected data exports from Marketo, suspicious CRM login patterns, that kind of thing). We've got a solid set of correlation searches and notable events firing.

Our challenge now is workflow. Our "SOC" is actually a distributed team—myself (marketing ops), a couple of sysadmins, and a security analyst—all in different time zones and with different primary responsibilities. We've hit a point where alert fatigue is real, and important notifications can get lost in Slack or email because everyone assumes "someone else" is handling it.

I'm curious how others structure their triage process in ES when the team isn't centralized. Specifically:

* **Ownership & Assignment:** Do you use the built-in ES "Owner" field and round-robin, or have you built a custom workflow in a separate ticketing system (like Jira or ServiceNow)? How do you handle hand-offs between time zones?
* **Priority & Context:** We've tweaked our risk-based alerting, but I'd love examples of how you enrich notable events *before* they hit the team's queue. Do you add context from other sources (like a CMDB or our HubSpot instance) automatically?
* **Communication Silos:** We currently have a chaotic mix of Slack, email, and the ES console. Is there a way to unify comms *within* the ES workflow itself, or is a dedicated channel with webhook posts the best path?
* **False Positive Reduction:** I'm a big fan of iterative tuning. How do you document and track adjustments to correlation searches post-triage? Do you have a formal process, or is it more ad-hoc?

Here's a bit of what we've tried and where it's falling short:
- We set up a simple "triage" status in the ES notable event, but without clear rules, events often stall there.
- Email alerts get ignored if they arrive during someone's off-hours.
- We lack a shared "playbook" for common alert types relevant to our martech/CRM environment.

Any insights, war stories, or even screenshots of your workflow views would be massively appreciated! I'm sure there are elegant solutions out there we haven't considered.

— Emma