Blue-team training

Now look at which sources produced lines. One source is a single point of failure; two independent sources mean the story survives one of them being off, filtered or rotated away.

Read the messages, not the count. A line that records the attempt but not the payload, the account or the destination cannot be pivoted from, no matter how many of them there are.

A rule is a threshold plus a scope. Most partial rows are a rule that is right in shape and wrong in threshold: it fires above a rate the operator simply stayed under.

Compare the minutes-to-alert against how long the move took. An alert that lands after the next stage has already run is a record of the breach, not a chance to stop it.

Only now call it. Detected means an analyst gets something usable in time. Partial means the telemetry exists and the detection does not work. Blind means nothing was written down at all — there is nothing to tune.