Exercise 3: Why Ticket 2 Was Investigated Despite Not Seeming Urgent — Possible Solution ==================================================================== HOW THE TICKET WAS ORIGINALLY PRESENTED ------------------------------ Per this chapter, the user described the notifications as "nothing that seemed urgent enough to report on its own" - from the user's own perspective, this wasn't even really a ticket, just an offhand mention. Nothing about how it was raised signaled that it deserved active investigation. THE QUESTION THAT PROMPTED A CLOSER LOOK ANYWAY ------------------------------ Per this chapter, the technician applied "the chapter's own question - could this also be an early sign of compromise?" - directly referencing Chapter 6's core recognition principle. That question is deliberately independent of how urgently or seriously a symptom is presented; it's asked of the symptom itself, not of the tone or framing the user happened to use. WHY URGENCY OF PRESENTATION ISN'T THE RIGHT SIGNAL TO GO ON ------------------------------ Chapter 4 already established that risk should be judged by what's being asked for, not by tone (the "Dana from Accounting" example). This ticket applies the same underlying lesson to symptom recognition: an occasional strange sign-in notification, mentioned casually, can still be an early sign of exactly the kind of quiet, ongoing compromise Chapter 6 warned about - the OAuth grant found here had apparently been in place for weeks, generating alerts that individually seemed minor enough to ignore. WHY THIS TICKET IS A GOOD ILLUSTRATION OF CHAPTER 6's OWN "BOTH FAILURE MODES" WARNING ------------------------------ Chapter 6 warned against both over-flagging everything and reflexively dismissing everything as routine. A truly indifferent read of this ticket ("nothing urgent, no action needed") would have left a real, ongoing unauthorized access grant undiscovered. Asking the recognition question instead - regardless of how the report was framed - is what actually caught it. WHY THIS WORKS AS AN ANSWER ------------------------------ It states how casually the ticket was originally presented, identifies the specific Chapter 6 question that prompted a closer look anyway, and explains why judging by the symptom itself rather than its presentation is consistent with lessons already established in Chapters 4 and 6.