## Chapter 15 — A travel list does not delete the abroad signal ### Lesson map Lesson 15. Map, example, EX061. ```mermaid flowchart TD T["Staff tell Leo before travel"] --> L["BrightPath keeps a trip list"] L --> C["The abroad alert is checked faster"] F["Forwarding alerts"] --> U["Unchanged"] M["MFA alerts"] --> U C --> Q{"Does the list delete the signal?"} Q -->|No| K["The four signals stay"] ``` The list shortens a check. It does not remove a detector. ### Logical drawing ```text signal kept: unusual-country or night sign-ins aid added: a trip list in prose signals left unchanged: forwarding rules, MFA changes not a filter inside lab_signins.py ``` ### Learning outcomes After this chapter, you should be able to: 1. Say what the travel list changes about the check. 2. Name the alerts that stay as they are. 3. Refuse a deleted signal or a rewritten script. ### 15.1 The list is a lookup for humans. The four signals stay four. Staff tell Leo before they travel. BrightPath adds the trip to a list so an abroad sign-in can be checked against a known journey. In the first month, a Spain sign-in during a colleague's known holiday could be checked in a minute. The check is shorter. The alert still exists. The list does not delete the unusual-country signal, and it does not change the night cut inside the script. `lab_signins.py` has no trip list, no Spain row, and no holiday field. Forwarding-rule alerts stay unchanged because they are rare and each one needs a look. MFA-change alerts stay unchanged for the same reason. Two new phones were innocent, and the next MFA change might not be. The staff reports of odd emails, the fourth signal from chapter 1, are not replaced by the trip list either. Hassan and colleagues (2019) describe automated triage of alert fatigue with provenance. Leo's question is still the human one from chapter 4: is there an innocent explanation we can confirm? The trip list feeds that question. It is not a provenance graph, and this book does not deploy one. Kokulu and colleagues (2019) studied how security operations centres match or miss their tasks. A trip list is not a maturity score for BrightPath. | Item | Effect of the travel list | |---|---| | Abroad sign-in alert | Still raised, checked faster | | Night test in the script | Unchanged | | Forwarding alert | Unchanged | | MFA alert | Unchanged | | `signins` list | Unchanged | ### 15.2 Worked example | Offered change | What it would do | Decision | |---|---|---| | A trip list beside the weekly summary | Shorter human check | Keep, as prose | | Forwarding and MFA alerts left on | They stay rare and necessary | Keep | | "Remove abroad alerts during holidays." | Deletes the signal | Refuse | | "Add Spain to the lab list." | A different script | Refuse | > **Synthetic case.** The holiday and the roaming phone stay unnamed people. ### Errors and limits Do not edit the sign-in script so a trip becomes a column. ### Apply - **EX061 — What the list changes.** What does the travel list shorten, and which alerts stay unchanged? *Rubric:* 3 = it shortens the check of an abroad sign-in; it does not delete that signal; forwarding and MFA alerts stay; the script is not edited;; 2 = the check is shorter and the other alerts stay;; 1 = one alert;; 0 = none. ### Continue studying — lesson 15 (chapter 15 of 20) [← Chapter 14](#ch-14) · [Course chapter index](../SUBJECTS.md) · [Chapter 16 →](#ch-16) Continue to the next authored lesson. ## Worked answers **EX061.** The travel list shortens the check of an abroad sign-in. It does not delete that signal. Forwarding alerts and MFA alerts stay unchanged, and the script is not edited.