Your EDR says clean, the proxy allowed it and identity flags medium risk; your MSSP closed it — how do you decide?

## The failure mode this question is testing When several products return verdicts on one event, the instinctive move is to tally them. Two say benign, one says risky, so it is probably benign — especially when one of the two belongs to a managed provider who has already closed the ticket. That instinct is wrong for a structural reason: **verdicts are not votes, because the voters did not all observe the same thing.** ## Step one: restate every verdict as a bounded claim Before comparing anything, rewrite each console's output as *claim + basis + window + surface*: - **Endpoint product — `clean`.** Claim: no rule or model matched the process, module and file telemetry the agent produced on that host in that window. Surface: host activity. It did not observe the contents of any encrypted request. - **Web gateway — `allowed`.** Claim: the destination's category is permitted by policy. This is a *policy decision about a destination*, not an assessment of maliciousness. A permitted category is not a finding of innocence; the control was never asked the question. - **Identity protection — `medium risk sign-in`.** Claim: a probabilistic judgment about one authentication event. It says a credential was accepted under conditions the platform found somewhat unusual. It says nothing about what the session did afterwards. Written this way, the tally collapses. Only one of the three made any claim that touches the hypothesis, and one of them — the gateway — never expressed an opinion about maliciousness at all. ## Step two: match surfaces to the hypothesis State the hypothesis explicitly: *an adversary is carrying tasking and results inside a legitimate collaboration platform's own API, from a host in our estate.* Then ask, of each control, **could it have observed this if it were true?** - Endpoint: only if the client were unusual, injected into, or spawning children. Under this hypothesis it is not. **Cannot falsify.** - Gateway: only if the destination were disallowed or the payload inspected. It is neither. **Cannot falsify.** - Identity: partially — it sees authentications to your tenant, which is why it produced the one non-benign signal. A verdict from a control that cannot observe the behaviour is **silence**. Silence does not corroborate; it does not raise or lower your confidence. So the majority here is not a majority of evidence, it is two abstentions, and the minority verdict is the only evidence in the room. ## Step three: handle the co-managed disagreement on evidence, not authority When a provider owns one of the consoles and reaches the opposite conclusion, the productive question is never "why did you close it". It is: - **What data did your console hold?** Which log sources, which window, which retention. - **What was the basis of the verdict?** Which rule, which fields, what did the analyst check. - **What could you not see?** Estate coverage gaps are the usual explanation for an honest disagreement — a host class not onboarded to their tooling, a SaaS audit trail not fed to them at all. Often both parties are right about their own data and the disagreement is entirely a visibility difference. The fix is one **joint timeline** across all three consoles plus the platform's own audit trail, with each entry carrying its source, so the two teams argue about the same object. ## Step four: decide, and record why On this event the decision was to escalate on the minority verdict. Investigation of the platform's own audit trail — which account, which authorised application, from which address — confirmed the intrusion. The console that two others contradicted was the one that had looked. Record the reasoning in the case, not just the outcome: *"escalated despite two benign verdicts; both were from controls whose surface cannot observe API-borne tasking, and are recorded as non-observations rather than clearances."* That sentence is what stops the next analyst tallying votes, and it is what you show the provider afterwards. ## When the minority is simply wrong The rule is not "always believe the outlier". It is "weight verdicts by observed surface". If the outlier is a control that also could not observe the hypothesis — a risk score fired by an unrelated condition, say — then it is noise, and the honest verdict is that **no control in the estate observed the relevant surface at all**. That is a different and more uncomfortable conclusion than benign, and it is the one that should be written down, because it names a visibility gap rather than closing a ticket.