18 waiting across 12 of 40 tenants in your scope
Sev
Tenant
What it is
The verdict
To check
State
Age
Medium
Meridian Health
Mass file rename on one host
Rejected by R. Idrissi
4 signals
decidedunrecorded
1h
High
Larkfield Logistics
Token replay from a new ASN
Real, contain identityabove latitude here 9 signals 27m High Norsk Marine Ransomware precursor on FS-02 Real, contain endpoint
above latitude here 14 signals 52m Medium Aubrey Dental Group Sign in from an unseen device Real, contain identity
above latitude here 9 signals 6m Medium Halden Freight Impossible travel, two offices Benign, sanctioned VPN rollout 6 signals 4m Low Halcyon Care Beaconing to a new domain Real, contained 5 signals acted 2h Low Bramber Retail Mass mailbox rule creation Benign, new admin onboarding 3 signals 41m
7 of 18 shown, one selected ↑ ↓ read, the pane follows Enter decides, focus moves into the pane order: unrecorded, waiting on you, severity, age
Reject Clerk’s verdict
C-4417 · Larkfield Logistics · Clerk filed real, contain identity
What Clerk got wrong
Where it goes
Held, not routednowhere yet, and counted
Nothing is sent to detection or to tuning. A reason the taxonomy cannot name is a reason nobody downstream can act on, so it is recorded, counted, and read by a person.
Required here, and only here.
This is the idle control on the taxonomy. Five per cent of rejections landing here means the six values are working; thirty per cent means they describe the wrong product, and the only way to know is to count. That is why other is a recorded value rather than a blank box, and why it is the one place free text is required instead of optional.