Reasons
- Enforcement was escalated due to repeated activity across nodes.
- Threat activity was observed independently on multiple nodes.
- An existing enforcement decision was retained because it was equal to or higher than the newly evaluated outcome.
No MITRE ATT&CK mappings available for this decision.
Evidence
- Nodes observed: 2
- Severity: LOW
- TTL remaining: 15h 2m