Anatomy of an identity compromise

Why nothing fired When a detection misses, the first instinct is to blame the rule. Wrong threshold, wrong table, wrong logic. Sometimes that is exactly right. But there is a class of intrusion where