An on-call page is not containment

The page is a notification

The on-call record shows a person or a rotation, a time, and the ticket you attached. That is who was asked to look. It does not show that a session was revoked, a host was isolated, or a message was removed.

If the paging tool has no name, write “recipient not recorded.” Do not guess the rotation from last month.

Containment is a separate line

An isolation, a disable, or a block has its own time and the person or system that did it. Until that line exists, write “containment not recorded.” A fast page is still only a page.

This note does not tell you how to isolate a machine. It only stops the page from being described as the isolation.

What to write down

File the page time, the recipient, and the ticket id. File containment only from the action record, with its own time. Do not use one timestamp for both.

Lab: a page at 14:05 and no isolation record

IR-2026-014 shows a page to the lab on-call at 14:05 UTC. The host actions list for LAB-02 is empty. A draft says LAB-02 was isolated at 14:05 because that is when on-call was reached.

The note quotes the page time and the recipient. Containment: not recorded. 14:05 is not an isolation time. LAB-02 stays uncontained in the write-up until an action line exists.

Snippet

ticket: IR-2026-014
page: 2026-11-02T14:05:00Z to lab on-call
host: LAB-02
host actions: none
write: notified, not contained
not: isolated at 14:05

Diagram

Keep the notification apart from the action

Page
Who was notified, and when.
Notice
```
14:05, lab on-call
```
Ticket
Which case the page names.
Case
```
IR-2026-014
```
Action
Isolation or disable, if it happened.
Gap
```
none recorded
```
The note
Do not reuse the page time as the action time.
Note
```
two lines
```

Check yourself

1. On-call was paged at 14:05 and no host action is recorded. What happened at 14:05?

2. Where does an isolation time have to come from?

3. The paging tool did not store a recipient. What do you write?