docs: add alert triage suppression gates

[catcherintheroad-hub]

Summary

Adds de-duplication and suppression safety gates to alert-triage so noisy alerts can be grouped without hiding real attack spread or creating permanent broad suppressions.

Changes

• Added TRIAGE-DEDUP-01 through TRIAGE-DEDUP-04 for duplicate grouping, alert storms, incomplete grouping keys, and stale prior dispositions.
• Added TRIAGE-SUP-01 through TRIAGE-SUP-05 for owner/expiry/rollback, high-value asset suppression risk, BTP evidence, FP follow-up, and kill-chain coverage.
• Added batch triage evidence requirements and decision guidance.
• Extended the output template with de-duplication and suppression review fields.
• Expanded tuning guidance to require owner, expiry, rollback plan, and detection-engineering ticket.
• Added pitfalls for alert storms and permanent suppressions.
• Added edge-case fixtures for duplicate tool notifications, password spray storms, and broad admin-activity suppressions.

Validation

• git diff --check
• Added-line non-ASCII scan
• Added-line prompt-injection marker scan
• Markdown code fence balance check for touched files

Related issue

Created from review issue: #1341

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4b0729932

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve all duplicate alert identifiers

When the same raw event produces multiple tool notifications, this guidance only requires retaining one evidence reference. In that duplicate-notification scenario, the triage record still needs every alert ID so each SIEM/EDR notification can be closed or linked; otherwise an analyst following the template may document the raw event once but lose the secondary alert IDs from the case record.

Useful? React with 👍 / 👎.