Another alert the team has seen before.

The alert looked familiar. Similar activity had already been reviewed and closed several times.

Brute Force Alert

Employee account: alice

critical

Detected

19:02

Failures

Sources

Recurrence

4th

Fourth similar alert this month · previously closed

bob@corp — 2026-06-14Closed as expected activity

198.51.100.22 sweep — 2026-05-30Closed as expected activity

alice — 2026-06-28Closed as expected activity

Casebook begins with the current evidence and the organization's previous decisions.

Alert · 1 of 6

What happened

A brute-force alert on an employee account — the fourth this month. Similar alerts were closed as expected activity.

Why it matters

Casebook starts from the current evidence and the organization’s previous decisions, not from scratch.