The Unified Alerts Experience: Bringing a neglected, but crucial feature improvement to fruition
Reducing Alert Fatigue and Improving SOC Team Collaboration
10-2021 to 08-2022, Vmware Carbon Black
Project Context | My Role | Decision-Support and Collaboration Highlights
Project Context
Alerts are the core of the Carbon Black Cloud, informing organizations of potential intrusions, malware, policy violations, and malicious behavior. For Security Operations Center (SOC) teams, alerts are not simply notifications—they are the primary input into high-stakes investigative and response workflows.
Despite their importance, the alerts experience had accumulated significant technical and design debt over time. Prior improvement efforts had stalled, research and design artifacts were fragmented, and the lack of visible progress was eroding user trust. Meaningful improvement required coordinated changes across UI, backend services, and machine-learning workflows, not surface-level interface updates..
My Role
I served as the primary design lead for a sustained effort to stabilize, modernize, and advance the alerts experience.
My work began by consolidating and making sense of what already existed—reviewing, coding, and organizing prior research, design concepts, user requests, and known technical debt to establish a coherent path forward. From there, I worked closely with product management, customer-facing SMEs, engineers, and SOC practitioners to validate needs, define priorities, and translate insight into actionable design direction.
My contributions included:
- Synthesizing historical research, designs, and technical constraints into a unified strategy
- Partnering with SOC analysts and internal SMEs to validate real-world workflows and pain points
- Designing and iterating on wireframes and prototypes to improve alert triage, navigation, and collaboration
- Collaborating with user research to validate concepts and refine interaction models
- Presenting design direction to leadership and cross-functional stakeholders to build alignment and momentum
- Working with engineering teams to support implementation and resolve tradeoffs
- Designing and facilitating a rollout strategy workshop to improve adoption and create a repeatable approach for future alerts-related changes
Decision-Support and Collaboration Highlights
This work treated alerts as a decision-support system, not a static UI.
Key improvements focused on reducing cognitive load, improving context, and supporting collaboration under pressure:
- Unified alert views that increased information density while reducing excessive navigation and tab management
- Full-screen alert detail to support deep investigation without constant scrolling
- Improved keyboard navigation and accessibility, enabling faster triage and reduced physical strain
- Persistent threat notes that carried analyst insight across related alerts and supported team handoffs
- Richer annotation and communication tools to improve clarity and collaboration within SOC teams
- Workflow controls that supported collaborative triage rather than isolated investigation
- Auto-closure controls that gave analysts greater visibility and authority over automation behavior
Human–AI Interaction
I also worked closely with the machine learning team to integrate alert classification based on anomalous behavior, paired with optional user feedback mechanisms. This allowed analysts to correct misclassifications and gradually refine alert quality—aligning automated detection with human judgment rather than replacing it.
Why This Work Matters
Alert fatigue is not a UI problem—it is a cognitive systems problem. Poorly designed alert workflows shift interpretive burden onto analysts, increase error risk, and contribute to burnout and attrition.
This work focused on restoring trust in the alerts experience by making reasoning visible, supporting collaboration, and aligning automation with real investigative practice. The result was a more coherent, usable, and extensible foundation for alert-driven decision-making within the platform.
Human-Centered Design 