An analyst notices a detection that has been automatically flagged with the ' New Activity...

A brand new detection has been triggered on a host that was recently added to the network.

A detection that was previously moved to a resolved status has generated new telemetry and activity.

A user has logged into a machine for the first time since the sensor was installed.

The Falcon Overwatch team has manually verified that the detection is an active threat.