Triage a host alert where the main act is weakening defenses or erasing evidence — disabling or excluding a security agent, stopping security logging, clearing event logs or command history, weakening a protective setting, or tampering with the scripting and tracing layers that feed detection. Reads who made the change and what fired alongside it to tell change-managed security maintenance apart from an attacker blinding the host, and decides escalate or dismiss.
