Law 3 · Residuals
Teach Casebook something new.
A system that can't tell you why it ignored an event is a filter, not a reasoning engine. Casebook shows you exactly what it couldn't explain — and lets you teach it.
From your investigation, Casebook set aside 3 events it could not yet explain — rather than pretend it understood them. Pick one and teach it what it means.
Fourth recurrence · same customer
The original case resolved the credential abuse, but seven events stayed visible and unexplained. Each one maps to a trigger the recurring alert keeps firing. Casebook detected them — it lacked the knowledge to connect them as one pattern. Select a trigger to trace which preserved events belong to it.
Recurring alert triggers
Seven preserved events
Scheduled task ran 90s after successful login on WIN-DC01
svc-backup authenticated interactively, off-window
New endpoint fingerprint for a known analyst account
Session to 203.0.113.14 — a host never contacted before
Privileged token issued minutes after the credential success
Second unrecognized device joined within the hour
Outbound beacon to the same unknown host, repeating