Flow_alert-received_enrich-alert Flow_alert-received_enrich-alert Flow_enrich-alert_score-alert Flow_enrich-alert_score-alert Flow_score-alert_real-threat Flow_score-alert_real-threat Flow_real-threat_close-alert Flow_real-threat_contain Flow_real-threat_close-alert Flow_close-alert_alert-closed Flow_close-alert_alert-closed Flow_real-threat_contain Flow_contain_case-merge Flow_contain-start_isolate-host Flow_contain-start_isolate-host Flow_isolate-host_isolation-ok Flow_isolate-host_isolation-ok Flow_isolation-ok_reset-credentials Flow_isolation-ok_containment-failed Flow_isolation-ok_reset-credentials Flow_reset-credentials_contained Flow_reset-credentials_contained Flow_isolation-ok_containment-failed =hostIsolated Flow_on-containment-failed_manual-containment Flow_on-containment-failed_manual-containment Flow_manual-containment_case-merge Flow_manual-containment_case-merge Flow_contain_case-merge Flow_case-merge_open-case Flow_case-merge_open-case Flow_open-case_case-opened Flow_open-case_case-opened =riskScore < 20