18 waiting across 12 of 40 tenants in your scope
Sev
Tenant
What it is
The verdict
To check
State
Age
Medium
Meridian Health
Mass file rename on one host
Rejected by R. Idrissi
4 signals
decidedunrecorded
1h
High
Larkfield Logistics
Token replay from a new ASN
Real, contain identityabove latitude here 9 signals 27m High Norsk Marine Ransomware precursor on FS-02 Real, contain endpoint
above latitude here 14 signals 52m Medium Aubrey Dental Group Sign in from an unseen device Real, contain identity
above latitude here 9 signals 6m Medium Halden Freight Impossible travel, two offices Benign, sanctioned VPN rollout 6 signals 4m Low Halcyon Care Beaconing to a new domain Real, contained 5 signals acted 2h Low Bramber Retail Mass mailbox rule creation Benign, new admin onboarding 3 signals 41m
7 of 18 shown, one selected ↑ ↓ read, the pane follows Enter decides, focus moves into the pane order: unrecorded, waiting on you, severity, age
Reject Clerk’s verdict
C-4417 · Larkfield Logistics · Clerk filed real, contain identity
What Clerk got wrong
What changes because of it
Pick a reason above and this fills in.
One keystroke picks what Clerk got wrong. Where it goes is derived from that and only asked when the pairing is genuinely ambiguous, which is five of six. No Next, and no confirmation step: if rejecting costs more than accepting, the analyst accepts.