Open this case in the queue
Puts this case back in the pane with the list beside it. All four verdict controls work here, and they are offered second rather than blocked: filing on this page leaves you on a case you have already ruled on, because there is no list for the row to change in.
C-4417 · Larkfield Logistics
Token replay from a new ASN · High · 9 signals · 6 sources, 24h
/case/C-4417 · the address that travels. /queue/case/C-4417 is the same case with the list, and neither redirects to the other
Live · as of 4s ago
What Clerk filed
Real, and it proposes to contain the identity. A refresh token issued to this user is in use from an ASN the tenant has never seen, and an inbox rule was created from it.
What happened
04:08Sign in from the corporate range, token issued.
04:12The same token presented from ASN 41xxx, no MFA prompt.
04:13Inbox rule created, forwarding to an external address.
Evidence, 9 signals
A refresh token was presented from ASN 41xxx, first time for this tenantEntra sign in
The same token was used from the corporate range 4 minutes earlierEntra sign in
How this was read
Field correlationId matches across both sign ins, which is what makes it the same token rather than two. Read from the tenant’s own log, 04:08 to 04:12 UTC.An inbox rule was created 90 seconds later, forwarding to an external addressExchange audit
not foundno password change, and no new device enrolmentEntra, EDR
points the other waythis user has travelled to this region twice in 90 daystenant baseline
Show 3 more signals
6 sources queried over 24h: Entra ID, Exchange audit, EDR, proxy, threat intel, tenant baseline.6 sources, 24h
Normal at this tenant
2 token replays at Larkfield Logistics in 90 days, both real
What Clerk may do here, on this tenant
yesInvestigate
yesContain endpoint
noContain identityabove this tenant’s latitude, so it waited for you
noContain networkabove this tenant’s latitude
noRemove contentabove this tenant’s latitude
noChange policyabove this tenant’s latitude
Out of reach actions are shown disabled with the ceiling stated, not hidden. A hidden control teaches nothing.
Filed by Clerk 26m ago · ?as-of=2026-08-22T04:14:05Z
Escalate is the only exit from a phone. Accept, amend and reject need the evidence and the reasons in view at once, so they are desk actions. A case you read at 03:00 and know to be benign cannot be closed from here: it keeps its place in the queue until you are at a desk.