Open this case in the queue
The next case is there. This page stayed on the one you just ruled on because it has no list to move you into.
C-4417 · Larkfield Logistics
Token replay from a new ASN · High · 9 signals · 6 sources, 24h
/case/C-4417 · the address that travels. /queue/case/C-4417 is the same case with the list, and neither redirects to the other
decidedacted
Live · as of 4s ago
Accepted by R. Idrissi, 4s ago. Written to the log against the snapshot as it stood.
This page holds the case and states the outcome. It does not advance, because there is no list here to advance to.
Open the log entry
What was decided
Clerk filed real, contain identity. The action was above this tenant’s latitude, so it waited for a person, and it has now run.
On 4.1 the row changes under your hand and that is the feedback. There is no row here, so the outcome is stated instead and the queue is offered rather than taken.
What Clerk filed
Real, and it proposes to contain the identity. A refresh token issued to this user is in use from an ASN the tenant has never seen, and an inbox rule was created from it.
What happened
04:08Sign in from the corporate range, token issued.
04:12The same token presented from ASN 41xxx, no MFA prompt.
04:13Inbox rule created, forwarding to an external address.
Evidence, 9 signals
A refresh token was presented from ASN 41xxx, first time for this tenantEntra sign in
The same token was used from the corporate range 4 minutes earlierEntra sign in
How this was read
Field correlationId matches across both sign ins, which is what makes it the same token rather than two. Read from the tenant’s own log, 04:08 to 04:12 UTC.An inbox rule was created 90 seconds later, forwarding to an external addressExchange audit
not foundno password change, and no new device enrolmentEntra, EDR
points the other waythis user has travelled to this region twice in 90 daystenant baseline
Show 3 more signals
6 sources queried over 24h: Entra ID, Exchange audit, EDR, proxy, threat intel, tenant baseline.6 sources, 24h
Normal at this tenant
2 token replays at Larkfield Logistics in 90 days, both real
What Clerk may do here, on this tenant
yesInvestigate
yesContain endpoint
noContain identityabove this tenant’s latitude, so it waited for you
noContain networkabove this tenant’s latitude
noRemove contentabove this tenant’s latitude
noChange policyabove this tenant’s latitude
Out of reach actions are shown disabled with the ceiling stated, not hidden. A hidden control teaches nothing.
Filed by Clerk 26m ago · ?as-of=2026-08-22T04:14:05Z · ruled by R. Idrissi 4s ago