The flow at a glance
An event goes through five steps. Each one produces something verifiable: a state, a reasoned verdict, a text, a receipt, a registry row. The path is always the same, whether the event comes from an outside researcher or from your own detection.
The five steps
- Intake — anything from outside (public form, connectors, API, OSV) becomes an inbound signal (INCOMING); a person promotes it to a case (state new) or disposes of it. A manual entry is born straight as a new case. See Cases: from signal to case.
- Triage — three questions qualify the event and fix the moment of awareness. The clock starts there. See Guided triage.
- Verdict — the engine applies the decision table and states the legal basis, or suspends. See Verdict and legal basis.
- Notification — the draft: the engine-determined fields are already filled, you add the facts. See Notification: the draft.
- Filing — you transmit on the ENISA single reporting platform and upload the receipt into CRAnotify. See Filing.
After the first filing the case is not closed: the 72-hour update and the final report remain, each with its own draft and its own receipt. See Phases and deadlines.
The whole picture
report received
├─ portal/connectors/API/OSV → SIGNAL (INCOMING) → promoted → «new»
└─ manual entry → «new»
│
TRIAGE (3 steps)
│
┌───────────────┬─────────────┴────────┬────────────────┐
no obligation suspended obligation obligation
→ archived → re-check Art. 14(2)(a) Art. 14(4)(a)
└─────────┬─────────┘
NOTIFICATION (draft)
│
FILING · early warning (24 h)
│ ENISA receipt
state «in progress»
│
FILING · update (72 h)
│
FILING · final report
│
state «fulfilled»What remains as evidence
Every step writes a row into the activity registry, chained to the previous one. At the end of the path you hold, per case:
- the complete chronology, with the author and moment of every act;
- the verdicts recorded in sequence with their justification — including those later superseded;
- the receipts issued by the platform for each phase, with any protocol number;
- the report's attachments, distinguishing verified from unverified;
- the printable defence dossier that gathers them.
Who does what
| Step | Minimum role | Note |
|---|---|---|
| Promote a signal to a case | Assessor | An unpromoted signal does not enter the flow and starts no clock. |
| Run the triage | Assessor | The author stays on the record. |
| File and upload the receipt | Assessor | The platform credentials are the company's, not CRAnotify's. |
| Change the escalation recipients | Administrator | An administrative action, recorded. |
How long it really takes
The triage takes minutes; what consumes the 24 hours is everything around it: reaching whoever can answer the exploitation question, gathering technical elements, obtaining internal approval of the text. That is why configuring the escalation and rehearsing in exercise mode are worth more than any feature of the product.
Good practice. Open the case as soon as the report arrives, before you know whether an obligation exists. Triage can be suspended; the time lost before opening the case cannot be recovered.