Armed suspect with brandished firearm detected outside
Active threat is verified by a human and initiates action from the incident management system
Confirmed threat triggers Orchestrate Workflow to lock doors and send alert via mass notification
