When an AI anomaly score crosses a threshold, a no-code playbook automatically opens a security ticket for the housing-authority SOC. What automation pattern is this?

No-code automation that creates incidents from AI detection thresholds binds an anomaly score crossing a limit to an operational action—opening a security ticket for the housing-authority SOC—without requiring a full custom application. The pattern converts model output into IR workflow while humans still triage priority, false positives, and response actions for resident-serving systems. No-code automation that closes incidents from AI detection thresholds is not the pattern here, since the playbook opens the ticket automatically once the anomaly score crosses the threshold rather than closing existing incidents. No-code automation that retrains models from AI detection thresholds is a model-maintenance trigger, not the threshold-to-ticket automation that turns an anomaly score into a security incident. No-code automation that enriches incidents from AI detection thresholds is a different action; it adds context to an existing ticket instead of automatically creating the SOC ticket when the threshold is crossed. Exam caveat: threshold-to-ticket no-code playbooks are the automation pattern; closing incidents, retraining models, and enriching incidents from AI detection thresholds are wrong answers. Operational check: tune thresholds with housing-authority false-positive review, ensure tickets land in the correct queue with enough context for analysts, keep anomaly telemetry retained for tuning, and confirm the playbook creates tickets directly from the threshold rather than enriching incidents from AI detection thresholds.