Brief security alert evidence from signal source, asset criticality, identity context, blast radius, and confidence