18 waiting across 12 of 40 tenants in your scope
Sev
Tenant
What it is
The verdict
To check
State
Age
Medium
Meridian Health
Mass file rename on one host
Rejected by R. Idrissi
4 signals
decidedunrecorded
1h
High
Larkfield Logistics
Token replay from a new ASN
Real, contain identityabove latitude here 9 signals 27m High Norsk Marine Ransomware precursor on FS-02 Real, contain endpoint
above latitude here 14 signals 52m Medium Aubrey Dental Group Sign in from an unseen device Real, contain identity
above latitude here 9 signals 6m Medium Halden Freight Impossible travel, two offices Benign, sanctioned VPN rollout 6 signals 4m Low Halcyon Care Beaconing to a new domain Real, contained 5 signals acted 2h Low Bramber Retail Mass mailbox rule creation Benign, new admin onboarding 3 signals 41m
7 of 18 shown, one selected ↑ ↓ read, the pane follows Enter decides, focus moves into the pane order: unrecorded, waiting on you, severity, age
Reject Clerk’s verdict
C-4417 · Larkfield Logistics · Clerk filed real, contain identity
What Clerk got wrong
Where it goes
Tenant context missingthe tenant baseline, and it is locked
Nothing outside Larkfield Logistics changes. Sending one tenant’s normality to detection engineering is how a rule gets weakened for the thirty nine other tenants who did need it.
The most consequential rule in the taxonomy, and it is enforced by the pairing rather than by a warning nobody reads. Straight from design principle 4: the same signal is a Tuesday at one client and an incident at another.