Triage an alert where a mailbox rule was created or changed in a way that hides mail — auto-forwarding to an external address, or moving and marking read anything matching finance, security, or password keywords. Reads the audit trail and the rule definition to tell an organizing user or a helpdesk fix apart from a rule planted to intercept replies or bury alerts after a mailbox takeover, and decides escalate or dismiss.
