Tailoring harnesses

TORA — Reviewing Shift 11

Shift 11 ran 30 alerts across five days and surfaced an active multi-vector phishing campaign, confirmed credential harvests from two elevated-privilege users, DNS tunneling on finance and HR workstations, and a Cobalt Strike fast-flux beacon with Akira ransomware C2 correlation on a jump server. The gateway's systemic failure to quarantine malicious-verdict emails is the most operationally significant finding.

VERA — Reviewing Shift 11

Shift 11 returned 13 cases, all escalated to ARIA at immediate urgency — every investigation resolved to an active, multi-stage compromise already in progress at the time of escalation, and the recurring finding was that TORA's alert type systematically understated the kill-chain stage by the time VERA began investigating.