Triage a host alert where the environment is being mapped or the actor is moving between hosts — system, account, and network discovery commands run on the host, and remote execution or remote-session pivots to other machines. Reads the actor and host role against the breadth of discovery or the destination of a pivot to tell sanctioned scanning and admin paths apart from an attacker fanning out, and decides escalate or dismiss.
