Start with the question
A signal is a starting point, not a conclusion. An unusual access event needs the asset, authentication context and network observation that help explain it.
Connect the evidence
Fusion brings relevant sources into the investigation. Insight helps analysts examine relationships and changes. Source provenance remains part of the picture.
Make the next step explicit
Action connects a finding to a playbook. In the illustrative scenario, an operator receives a review task. A proposed response is not treated as an executed action.