# Device Process Scope Drift Report

**Generated:** 2026-02-10 16:45 UTC<br>
**Generated by:** GitHub Copilot in Agent mode with Claude Opus 4.6<br>
**Workspace:** la-contoso (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`)<br>
**Baseline Period:** 2025-11-06 → 2026-02-03 (90 days)<br>
**Recent Period:** 2026-02-03 → 2026-02-10 (7 days)<br>
**Drift Threshold:** 150%<br>
**Drift Score Formula:** `0.30×Volume + 0.25×Processes + 0.15×Accounts + 0.20×Chains + 0.10×Companies`<br>
**Data Sources:** DeviceProcessEvents, SecurityAlert, SecurityIncident, Heartbeat<br>
**Mode:** Fleet-Wide<br>
**Devices Analyzed:** 9<br>
**Total Events:** ~1,081,000

---

## Executive Summary

Fleet-wide device process scope drift analysis across **9 devices** over a 97-day window (90-day baseline + 7-day recent) found **no genuine behavioral drift**. Two devices initially scored above or near the 150% threshold — contoso-admin (raw 153.0) and contoso-2012r2 (raw 141.5) — but both scores are entirely explained by **intermittent uptime inflating the volume dimension**. After normalizing for actual days online, both devices drop to STABLE (84.8 and 69.4 respectively). One device (contoso-vm) is SILENT with no activity since January 25 and should be reviewed for decommissioning. All first-seen processes are version-stamped update artifacts, all ~20 security incidents are classified BenignPositive, and no suspicious command-line patterns were detected on any device.

---

## Fleet Daily Trend

The fleet daily trend (81 days of data from Nov 11, 2025 to Feb 10, 2026) shows a consistent and predictable pattern:

- **Weekdays (Mon–Fri):** ~15,000–17,000 events/day fleet-wide
- **Weekends (Sat–Sun):** ~4,000–5,000 events/day (only always-on servers generate events)
- **Dominant contributor:** contoso-linux accounts for ~65% of fleet volume (~7,300 events/day)
- **No anomalous spikes or drops** outside expected seasonal variation
- **Data completeness verified:** Feb 10 (partial day at query time) shows proportional counts; no ingestion boundary issues detected

**Fleet composition by uptime pattern:**

| Pattern | Devices | Description |
|---------|---------|-------------|
| Always-on (24/7) | contoso-dc1, contoso-dc2, contoso-sccm, contoso-util, contoso-vd-0, contoso-linux | Domain controllers, management servers, Linux host |
| Weekday-only (Mon–Fri) | contoso-2012r2 | Legacy server, boots Mon afternoon, shuts down Sat ~05:00 |
| Intermittent (~monthly) | contoso-admin | Admin workstation, powered on ~5 times in 97 days |
| Silent (offline) | contoso-vm | Last activity Jan 25, no heartbeat |

---

## Per-Device Drift Score Ranking

| Rank | Device | DriftScore | Volume% | Process% | Account% | Chain% | Company% | Adj. Score | Status |
|------|--------|-----------|---------|----------|----------|--------|----------|-----------|--------|
| 1 | contoso-admin | 153.0 | 312.4% | 79.5% | 100.0% | 76.4% | 90.9% | **84.8** | ⚠️ Uptime-adjusted → STABLE |
| 2 | contoso-2012r2.contoso.com | 141.5 | 315.5% | 63.9% | 50.0% | 66.9% | 100.0% | **69.4** | ⚠️ Uptime-adjusted → STABLE |
| 3 | contoso-linux | 83.1 | 108.4% | 62.8% | 90.9% | 56.3% | 100.0% | — | ✅ STABLE |
| 4 | contoso-sccm.contoso.com | 69.1 | 106.3% | 37.3% | 60.0% | 44.6% | 100.0% | — | ✅ STABLE |
| 5 | contoso-dc2.contoso.com | 68.9 | 110.3% | 37.9% | 50.0% | 44.1% | 100.0% | — | ✅ STABLE |
| 6 | contoso-dc1.contoso.com | 68.8 | 107.6% | 37.3% | 55.6% | 44.2% | 100.0% | — | ✅ STABLE |
| 7 | contoso-util.contoso.com | 68.1 | 106.3% | 36.5% | 58.3% | 41.5% | 100.0% | — | ✅ STABLE |
| 8 | contoso-vd-0.contoso.com | 65.5 | 110.2% | 31.0% | 50.0% | 35.7% | 100.0% | — | ✅ STABLE |
| 9 | contoso-vm | N/A | — | — | — | — | — | — | 🔵 SILENT (baseline only) |

**Scoring notes:**
- Devices ranked 3–8 are **always-on** servers with DriftScores well below 100% — all dimensions contracting or stable
- Devices ranked 1–2 have **inflated raw scores** driven solely by the Volume dimension; all diversity dimensions (Processes, Accounts, Chains, Companies) are ≤100%, confirming no behavioral expansion
- contoso-vm has baseline data only (last seen Jan 25) — no recent-window activity → scored as SILENT

---

## Flagged Device Deep Dives

### contoso-admin — Raw Drift Score 153.0 → Adjusted 84.8

```
┌──────────────────────────────────────────────────────────┐
│              DEVICE DRIFT SCORE: 84.8 (adj)              │
│                 STABLE (Uptime-Adjusted)                 │
├──────────────────────────────────────────────────────────┤
│                                                          │
│  Volume   (30%)  █████████████████───   85.1%  v         │
│  Processes(25%)  ████████████████────   79.5%  v         │
│  Accounts (15%)  ████████████████████  100.0%  =         │
│  Chains   (20%)  ███████████████─────   76.4%  v         │
│  Companies(10%)  ██████████████████──   90.9%  v         │
│                                                          │
│  ──────────────────────── 100% baseline ────┤            │
│                  150% drift threshold ▲                  │
└──────────────────────────────────────────────────────────┘
```

**Volume adjustment:** Raw Volume% was 312.4% (147.3 events/day ÷ 47.1 events/day). However, the device was only online **7 of 90 baseline days** (7.8% uptime). Normalizing by active days: 515.5 events/active-day (recent) ÷ 606 events/active-day (baseline) = **85.1%** — actually *contracting*.

| Dimension | Weight | Baseline (raw) | Recent (raw) | Raw Ratio | Adj. Ratio | Weighted | Direction |
|-----------|--------|---------------|-------------|-----------|-----------|----------|-----------|
| Volume | 0.30 | 4,243 events / 90d (47.1/day) | 1,031 events / 7d (147.3/day) | 312.4% | **85.1%** | 25.5 | v (adjusted) |
| Processes | 0.25 | baseline unique set | recent unique set | 79.5% | 79.5% | 19.9 | v |
| Accounts | 0.15 | 4 unique | 4 unique | 100.0% | 100.0% | 15.0 | = |
| Chains | 0.20 | baseline chain set | recent chain set | 76.4% | 76.4% | 15.3 | v |
| Companies | 0.10 | 11 unique | 10 unique | 90.9% | 90.9% | 9.1 | v |
| **Total** | | | | **153.0** | **84.8** | | |

**First-seen processes (4):** All Microsoft Corporation signed update artifacts:
- MicrosoftEdge_X64_*.exe (Edge browser update)
- AM_Delta_Patch_*.exe ×2 (Defender signature updates)
- mpam-d.exe (Defender platform update)

**Account context:** Consistent 4 accounts across all sessions (system-level accounts). No unexpected user activity.

#### Uptime Context — Intermittent Device

contoso-admin is an **admin workstation** powered on only for short maintenance sessions. Heartbeat confirms **5 distinct sessions** across the entire 97-day window:

| Session | Day | Active Hours | Duration | Events | Unique Processes | Accounts |
|---------|-----|-------------|----------|--------|-----------------|----------|
| 1 | Dec 8 (baseline) | 16:19–23:59 | 7h 40m | 941 | 93 | 4 |
| 1 cont. | Dec 9 (baseline) | 00:00–02:56 | 2h 56m | 574 | 74 | 4 |
| 2 | Dec 11 (baseline) | 13:56–23:58 | 10h 02m | 968 | 89 | 4 |
| 2 cont. | Dec 12 (baseline) | 00:00–02:59 | 2h 59m | 268 | 50 | 4 |
| 3 | Jan 8 (baseline) | 21:45–23:56 | 2h 11m | 647 | 93 | 4 |
| 3 cont. | Jan 9 (baseline) | 00:00–02:53 | 2h 53m | 210 | 34 | 4 |
| 4 | Jan 26 (baseline) | 16:01–20:21 | 4h 20m | 635 | 72 | 4 |
| **5** | **Feb 7 (recent)** | **20:27–23:59** | **3h 33m** | **726** | **91** | **4** |
| **5 cont.** | **Feb 8 (recent)** | **00:00–02:40** | **2h 40m** | **305** | **62** | **4** |

**Per-session comparison:** The recent session (Feb 7–8: 1,031 events, ~6h 13m) is consistent with baseline sessions (avg ~857 events per session). Process diversity (91 unique processes on Feb 7) matches baseline peaks (93 on Dec 8 and Jan 8). Account count stable at 4 throughout.

> ⚠️ **Intermittent device** — online 7 of 90 baseline days (7.8% uptime). Volume ratio of 312.4% reflects calendar-based averaging, not behavioral expansion. Per-session behavior is **identical** to baseline sessions. All diversity dimensions are contracting (≤100%).

---

### contoso-2012r2.contoso.com — Raw Drift Score 141.5 → Adjusted 69.4

```
┌──────────────────────────────────────────────────────────┐
│              DEVICE DRIFT SCORE: 69.4 (adj)              │
│                 STABLE (Uptime-Adjusted)                 │
├──────────────────────────────────────────────────────────┤
│                                                          │
│  Volume   (30%)  ███████████████─────   75.2%  v         │
│  Processes(25%)  █████████████───────   63.9%  v         │
│  Accounts (15%)  ██████████──────────   50.0%  v         │
│  Chains   (20%)  █████████████───────   66.9%  v         │
│  Companies(10%)  ████████████████████  100.0%  =         │
│                                                          │
│  ──────────────────────── 100% baseline ────┤            │
│                  150% drift threshold ▲                  │
└──────────────────────────────────────────────────────────┘
```

**Volume adjustment:** Raw Volume% was 315.5% (784.1 events/day ÷ 248.5 events/day). However, this device has **MDE telemetry only from Jan 12 onwards** (~19 active baseline days out of 90). Normalizing by active days: 863 events/active-day (recent) ÷ 1,148 events/active-day (baseline) = **75.2%** — *contracting*.

| Dimension | Weight | Baseline (raw) | Recent (raw) | Raw Ratio | Adj. Ratio | Weighted | Direction |
|-----------|--------|---------------|-------------|-----------|-----------|----------|-----------|
| Volume | 0.30 | 22,365 events / 90d (248.5/day) | 5,489 events / 7d (784.1/day) | 315.5% | **75.2%** | 22.6 | v (adjusted) |
| Processes | 0.25 | baseline unique set | recent unique set | 63.9% | 63.9% | 16.0 | v |
| Accounts | 0.15 | ~6 unique | ~3 unique | 50.0% | 50.0% | 7.5 | v |
| Chains | 0.20 | baseline chain set | recent chain set | 66.9% | 66.9% | 13.4 | v |
| Companies | 0.10 | signing companies | signing companies | 100.0% | 100.0% | 10.0 | = |
| **Total** | | | | **141.5** | **69.4** | | |

**First-seen processes (18):** All AM_Delta_Patch_*.exe variants — Microsoft Corporation signed Defender signature updates. No other new processes.

**Account context:** Baseline peaked at 6 accounts on high-activity days (Jan 13, Jan 26), recent consistently 3 accounts. The 50.0% Account ratio reflects fewer concurrent user sessions, not a security concern.

#### Uptime Context — Weekday-Only Server

contoso-2012r2 follows a strict **Mon–Fri operational schedule**. MDE telemetry begins Jan 12 (device recently onboarded or re-enrolled).

**Weekly pattern (confirmed via Heartbeat):**
- **Monday:** Boots ~14:25 UTC, runs through end of day
- **Tuesday–Thursday:** Full 24-hour operation (~870–890 heartbeats/day)
- **Friday:** Runs through ~05:00 Saturday (~300 heartbeats)
- **Saturday–Sunday:** Offline (no heartbeat)

**Per-day process volume — Recent window (Feb 3–10):**

| Day | Weekday | Events | Unique Processes | Accounts | Session Duration |
|-----|---------|--------|-----------------|----------|-----------------|
| Feb 3 | Tue | 1,038 | 76 | 3 | ~24h |
| Feb 4 | Wed | 1,075 | 72 | 3 | ~24h |
| Feb 5 | Thu | 1,165 | 82 | 3 | ~24h |
| Feb 6 | Fri | 975 | 75 | 3 | ~24h |
| Feb 7 | Sat (overflow) | 344 | 45 | 3 | ~5h |
| Feb 9 | Mon | 862 | 67 | 3 | ~10h |
| Feb 10 | Tue (partial) | 584 | 71 | 3 | ~16h (query cutoff) |

**Comparison to baseline weekdays:** Baseline weekday average is ~1,000–1,200 events/day with 70–82 unique processes. Recent weekdays (Feb 3–6) are within this range (975–1,165 events, 72–82 processes). One baseline spike on Jan 13 (5,798 events, 106 processes, 6 accounts) appears to be a post-enrollment burst and is not representative.

> ⚠️ **Weekday-only server** — MDE telemetry begins Jan 12, providing ~19 active baseline days out of 90 in the analysis window. Raw Volume% of 315.5% is a **calendar-effect artifact** (dividing by 90 total days when the device was only active 19). Adjusted per-active-day Volume is 75.2% (contracting). All diversity dimensions are well below 100%.

---

### contoso-vm — SILENT Device

| Property | Value |
|----------|-------|
| Last DeviceProcessEvents | 2026-01-25 |
| Last Heartbeat | No heartbeat data found |
| Baseline Events | 5,731 across 6 session-days |
| Recent Events | 0 |
| DriftScore | N/A (no recent data) |
| Status | 🔵 SILENT — Offline/Decommissioned |

**Historical session activity:**

| Day | Active Hours | Duration | Events | Unique Processes | Accounts |
|-----|-------------|----------|--------|-----------------|----------|
| Nov 12 | 00:12–15:27 | 15h 15m | 512 | 70 | 3 |
| Nov 20 | 00:22–16:02 | 15h 40m | 1,881 | 198 | 6 |
| Nov 26 | 18:02–20:21 | 2h 19m | 946 | 166 | 6 |
| Jan 6 | 17:16–23:59 | 6h 42m | 905 | 114 | 3 |
| Jan 7 | 00:15–15:15 | 15h 00m | 578 | 75 | 3 |
| Jan 25 | 20:18–21:38 | 1h 20m | 909 | 166 | 8 |

**Assessment:** This device was used sporadically (6 sessions across 97 days) and has been completely offline since Jan 25. The absence of Heartbeat data suggests MDE agent may have been uninstalled or the VM was deleted/deallocated. No security concern from drift perspective, but the device should be reviewed in asset inventory.

> ⚠️ **Action recommended:** Verify whether contoso-vm has been intentionally decommissioned. If still in inventory, investigate why MDE telemetry stopped on Jan 25.

---

## First-Seen Processes

All first-seen processes (appearing only in the 7-day recent window, not in the 90-day baseline) are **version-stamped update artifacts** from known publishers. No suspicious, unexpected, or unsigned Windows binaries were detected.

### 📦 Expected Update Artifacts

| Device | New Processes | Type | Publisher |
|--------|--------------|------|-----------|
| contoso-vd-0 | 33 | AM_Delta_Patch_*.exe, MicrosoftEdge_X64_*.exe, odt*.tmp.exe, SecurityHealthSetup.exe | Microsoft Corporation |
| contoso-util | 19 | AM_Delta_Patch_*.exe, MicrosoftEdge_X64_*.exe | Microsoft Corporation |
| contoso-2012r2 | 18 | AM_Delta_Patch_*.exe | Microsoft Corporation |
| contoso-sccm | 17 | AM_Delta_Patch_*.exe, MicrosoftEdge_X64_*.exe | Microsoft Corporation |
| contoso-dc2 | 16 | AM_Delta_Patch_*.exe | Microsoft Corporation |
| contoso-dc1 | 13 | AM_Delta_Patch_*.exe | Microsoft Corporation |
| contoso-admin | 4 | MicrosoftEdge_X64_*.exe, AM_Delta_Patch_*.exe, mpam-d.exe | Microsoft Corporation |
| contoso-linux | 1 | lvm2-activation | Unsigned (Linux LVM utility — expected) |

**Total:** 121 first-seen process name variants across 8 devices. All are expected software update binaries:

- **AM_Delta_Patch_*.exe** — Microsoft Defender antimalware signature delta updates (new version-stamped filename per release)
- **MicrosoftEdge_X64_*.exe** — Microsoft Edge browser update installer
- **odt*.tmp.exe** — Microsoft Office Click-to-Run deployment tool (temporary installer)
- **SecurityHealthSetup.exe** — Windows Security Health agent setup
- **mpam-d.exe** — Microsoft Defender antimalware platform update
- **lvm2-activation** — Linux Logical Volume Manager activation (expected system utility)

✅ No suspicious first-seen processes. All new binaries are routine update artifacts with version numbers embedded in filenames (expected per-release variation).

---

## Correlated Security Alerts

SecurityAlert joined with SecurityIncident (real Status/Classification) for all 9 analyzed devices across the 97-day analysis window.

**Summary:** ~20 unique incidents found involving fleet devices. **ALL classified BenignPositive** (1 Undetermined). **Zero TruePositive incidents.**

### Incident Summary

| Incident | Date | Severity | Classification | Devices Involved | Description |
|----------|------|----------|---------------|-----------------|-------------|
| Inc 4475 | Feb 7–8 | High | BenignPositive | Multiple | Multi-stage Credential access & C2 — TI Map IP match + IIS failed logins |
| Inc 4468 | Jan 27 | Medium | BenignPositive | — | New UserAgent detection |
| Inc 4467 | Jan 27 | Medium | BenignPositive | — | Rare RDP connection |
| Inc 4466 | Jan 27 | Medium | BenignPositive | contoso-util | Defense evasion — Firewall rule modification |
| Inc 4461 | Jan 26 | High | BenignPositive | Multiple | Multi-stage Credential access & C2 |
| Inc 4462 | Jan 26 | Medium | BenignPositive | — | RDP nesting detection |
| Inc 4459 | Jan 25 | Medium | BenignPositive | — | DLP policy match |
| Inc 4456 | Jan 14–15 | Medium | BenignPositive | contoso-util | Bitsadmin execution + RDP lateral movement |
| Inc 4452 | Jan 9 | Medium | BenignPositive | — | Failed logon attempts |
| Inc 4440 | Jan 8–9 | High | BenignPositive | contoso-admin | Multi-stage Initial access & C2 — RDP + failed logons + custom indicator |
| Inc 4437 | Jan 7 | Medium | BenignPositive | contoso-util | Privilege escalation & Defense evasion — Bitsadmin |
| Inc 4435 | Jan 6 | Medium | BenignPositive | — | Rare RDP connection |
| Inc 4426 | Dec 12 | Medium | Undetermined | — | Excessive logon failures |
| Inc 4422 | Dec 11–12 | High | BenignPositive | Multiple | Multi-stage Initial access & C2 |
| Inc 4420 | Dec 10 | Medium | BenignPositive | — | Anomalous UserAgent |
| Inc 4419 | Dec 9 | Medium | BenignPositive | — | New UserAgent detection |
| Inc 4416 | Dec 9 | Medium | BenignPositive | contoso-util | Defense evasion — Firewall rule modification |
| Inc 4414–4418 | Dec 8–9 | High | BenignPositive | Multiple | Multi-stage C2, TI Map IP |
| Inc 4411–4412 | Dec 8 | High | BenignPositive | Multiple | Multi-stage Credential access & C2 |
| Inc 4410 | Dec 8 | Medium | BenignPositive | — | RDP nesting detection |
| Inc 4398 | Nov 29 | Medium | BenignPositive | — | RDP nesting |
| Inc 4394 | Nov 29 | Medium | BenignPositive | contoso-util | Defense evasion — Firewall modification |
| Inc 4370–4371 | Nov 20 | Medium | BenignPositive | contoso-util | Bitsadmin execution |
| Inc 4369 | Nov 19 | Medium | BenignPositive | — | Rare RDP + Lateral movement |
| Inc 4365–4366 | Nov 12 | Medium | BenignPositive | contoso-util | Bitsadmin execution |

**Product name mapping (legacy → current branding):**
- "Microsoft Defender Advanced Threat Protection" → Microsoft Defender for Endpoint (MDE)
- "Azure Sentinel" → Microsoft Sentinel
- "Azure Security Center" → Microsoft Defender for Cloud
- "ASI Scheduled Alerts" → Microsoft Sentinel Scheduled Analytics

**Assessment:**
- 🟢 **All incidents are false alarm / expected activity** — recurring TI Map IP matches (honeypot inbound traffic), IIS failed logins, RDP nesting in lab environment, and Bitsadmin usage on management server
- 🟢 contoso-util accounts for the majority of Defense evasion alerts (firewall rule modifications, Bitsadmin) — all classified BenignPositive, consistent with management server operations
- 🟢 contoso-admin's Inc 4440 (Jan 8–9) correlates with its Session 3 power-on — RDP and failed logon alerts are expected for an admin workstation being accessed remotely
- 🟡 Inc 4426 (Dec 12, Excessive logon failures) classified Undetermined — not escalated but not fully resolved

---

## Notable Command-Line Patterns

Scanned for reconnaissance (`whoami`, `net user`, `nltest`, `ipconfig`), lateral movement (`psexec`, `wmic`, `winrm`), persistence (`schtasks`, `reg add`, `sc create`), and exfiltration (`curl`, `wget`, `certutil`, `bitsadmin`) patterns across all devices.

**Results:** 50 matches found — **ALL from contoso-linux** (root account):

| Pattern | Count | Context | Assessment |
|---------|-------|---------|------------|
| `curl` → mcr.microsoft.com | ~40 | Microsoft Container Registry health check probes | ✅ Expected operational monitoring |
| `wget` → motd.ubuntu.com | ~10 | Ubuntu Message of the Day updates | ✅ Expected OS maintenance |

**Windows devices:** ✅ Zero suspicious command-line patterns detected across all 8 Windows devices (contoso-admin, contoso-2012r2, contoso-dc1, contoso-dc2, contoso-sccm, contoso-util, contoso-vd-0, contoso-vm).

---

## Account Landscape

| Device | Typical Accounts | Notes |
|--------|-----------------|-------|
| contoso-admin | 4 (consistent across all sessions) | System-level accounts. No unexpected user activity |
| contoso-2012r2 | 3 (typical), up to 6 on high-activity days | Additional accounts appeared on Jan 13 (post-enrollment), Jan 26 |
| contoso-dc1 | 3–4 | Domain controller service accounts |
| contoso-dc2 | 3–4 | Domain controller service accounts |
| contoso-sccm | 3–4 | SCCM management service accounts |
| contoso-util | 3–4 | Management server service accounts |
| contoso-vd-0 | 3–4 | Virtual desktop service accounts |
| contoso-linux | 1 (root) | Linux host — all processes under root |
| contoso-vm | 3–8 (variable) | Higher account counts on Nov 20, Nov 26, Jan 25 — likely multiple user sessions during active use |

**Assessment:**
- ✅ All process execution is by **system/service accounts** (SYSTEM, LOCAL SERVICE, NETWORK SERVICE, root)
- ✅ No evidence of unexpected user accounts executing processes
- ✅ Account diversity is **contracting or stable** across all devices in the recent window
- 🔵 contoso-vm's peak of 8 accounts on Jan 25 (its last active day) may reflect multiple concurrent user connections during its final session

---

## Security Assessment

| Factor | Finding |
|--------|---------|
| ✅ **First-Seen Processes** | 121 new process names across 8 devices — ALL are version-stamped update artifacts (AM_Delta_Patch, Edge, Office CTR) from Microsoft Corporation. No suspicious binaries. |
| ✅ **Security Alerts** | ~20 incidents in 97-day window — ALL classified BenignPositive (1 Undetermined). Zero TruePositive. Alert patterns consistent with lab/honeypot environment. |
| ✅ **Command-Line Patterns** | Zero suspicious patterns on Windows. Linux-only matches are expected MCR health checks and Ubuntu MOTD. |
| ✅ **Process Diversity** | All devices show contracting or stable process ratios (31–80% of baseline). No behavioral expansion detected. |
| ✅ **Account Context** | System/service accounts only. No unexpected user account execution across entire fleet. |
| ✅ **Signing Companies** | 100% of first-seen Windows processes signed by Microsoft Corporation. No unknown or suspicious publishers. |
| ✅ **Process Chains** | All 30 rare chains are update-related: wuauclt→AM_Delta_Patch, microsoftedgeupdate→MicrosoftEdge_X64→setup, odt*.tmp→OfficeClickToRun, microsoft.tri.sensor.updater→ipconfig /flushdns (MDI). All executed by system account. |
| ⚠️ **contoso-admin Volume** | Raw 312.4% → **85.1% after uptime adjustment** (online 7/90 baseline days). Per-session behavior identical to baseline. Mathematical artifact, not drift. |
| ⚠️ **contoso-2012r2 Volume** | Raw 315.5% → **75.2% after uptime adjustment** (MDE telemetry from Jan 12 only, 19 active baseline days). Calendar-effect inflation. |
| ⚠️ **contoso-vm Silent** | No activity since Jan 25, no heartbeat. Recommend asset inventory review to confirm decommission status. |
| 🟡 **Inc 4426 Undetermined** | Excessive logon failures (Dec 12) — not classified as BenignPositive. Low concern in lab environment but flagged for completeness. |

---

## Verdict

```
┌──────────────────────────────────────────────────────────────────┐
│  OVERALL FLEET RISK: LOW -- All drift is uptime-driven           │
│  Flagged Devices: 0 of 9 effective  (Threshold: 150%)            │
│  Root Cause: Intermittent uptime inflating volume ratios         │
└──────────────────────────────────────────────────────────────────┘
```

### Per-Device Verdicts

| Device | Raw Score | Adjusted Score | Verdict |
|--------|----------|---------------|---------|
| contoso-admin | 153.0 | 84.8 | ✅ STABLE — Intermittent admin workstation, per-session behavior unchanged |
| contoso-2012r2 | 141.5 | 69.4 | ✅ STABLE — Weekday-only server with short MDE history, calendar-effect inflation |
| contoso-linux | 83.1 | — | ✅ STABLE — Highest volume device, all dimensions contracting |
| contoso-sccm | 69.1 | — | ✅ STABLE — Management server, consistent behavior |
| contoso-dc2 | 68.9 | — | ✅ STABLE — Domain controller, consistent behavior |
| contoso-dc1 | 68.8 | — | ✅ STABLE — Domain controller, consistent behavior |
| contoso-util | 68.1 | — | ✅ STABLE — Management server, BenignPositive alerts explained |
| contoso-vd-0 | 65.5 | — | ✅ STABLE — Virtual desktop, highest first-seen count (33) but all are updates |
| contoso-vm | N/A | — | 🔵 SILENT — Offline since Jan 25, requires asset review |

### Root Cause Analysis

The two initially flagged devices (contoso-admin at 153.0 and contoso-2012r2 at 141.5) both exhibit the **Intermittent-Use Device Volume Inflation** pattern documented in the drift detection methodology. The Volume dimension — weighted at 30% — was inflated by dividing recent-window events by a baseline daily average that was diluted across 90 calendar days, even though the devices were only online for a fraction of that period. All four diversity dimensions (Processes, Accounts, Chains, Companies) are at or below 100% for both devices, confirming no actual behavioral expansion occurred.

Heartbeat analysis confirmed:
- **contoso-admin:** 5 power-on sessions totaling ~34 hours across 97 days (7.8% uptime)
- **contoso-2012r2:** ~19 active days of MDE telemetry (device enrolled ~Jan 12), weekday-only schedule

After normalizing Volume for active uptime days, both devices fall well within the STABLE range (84.8 and 69.4 respectively).

### Key Findings

1. **Zero genuine behavioral drift** across the entire 9-device fleet
2. **All 121 first-seen processes** are version-stamped update artifacts from Microsoft Corporation
3. **All ~20 security incidents** (97-day window) classified BenignPositive — consistent with lab/honeypot environment
4. **No suspicious command-line activity** on any Windows device
5. **No unexpected accounts** executing processes anywhere in the fleet
6. **contoso-vm** has been offline since Jan 25 with no heartbeat — likely decommissioned

### Recommendations

- ⚠️ **contoso-vm:** Verify decommission status in asset inventory. If still expected to be active, investigate why MDE telemetry stopped on Jan 25.
- 🟢 **No immediate action required** for any other device — fleet is operationally stable
- 🔵 **contoso-2012r2:** Monitor over the next 30 days to build a longer MDE baseline (currently only ~22 days of telemetry)
- 🔵 **Inc 4426 (Undetermined):** Consider closing the Dec 12 "Excessive logon failures" incident if consistent with expected lab activity
- 🔵 **contoso-admin:** Consider establishing a documented power-on schedule or tagging as "intermittent" in device inventory to prevent future false drift flags

---

## Appendix: Query Details

| Query | Table(s) | Records Scanned | Results | Tool |
|-------|----------|----------------:|--------:|------|
| Q14 — Fleet Daily Process Trend | DeviceProcessEvents | ~1,081,000 | 81 daily rows | Sentinel Data Lake |
| Q15 — Per-Device Baseline vs. Recent | DeviceProcessEvents | ~1,081,000 | 9 devices | Sentinel Data Lake |
| Q16 — First-Seen Processes (7d) | DeviceProcessEvents | ~1,081,000 | 121 new processes | Sentinel Data Lake |
| Q17 — Rare Process Chains (7d) | DeviceProcessEvents | ~1,081,000 | 30 new chains | Sentinel Data Lake |
| Q18 — Correlated Security Alerts | SecurityAlert, SecurityIncident | ~100 alert rows | ~20 incidents | Sentinel Data Lake |
| Q20 — Notable Command-Line Patterns | DeviceProcessEvents | ~1,081,000 | 50 matches (all Linux) | Sentinel Data Lake |
| Q21 — Heartbeat Uptime (flagged devices) | Heartbeat | ~19,000 | 34 daily rows | Sentinel Data Lake |
| Q22 — Per-Session Process Volume | DeviceProcessEvents | ~36,000 | 41 daily rows | Sentinel Data Lake |

*Query definitions: see `.github/skills/scope-drift-detection/device/SKILL.md` — Queries Q14–Q22.*

**Workspace:** la-contoso (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`)
**Query engine:** Sentinel Data Lake (`mcp_sentinel-data_query_lake`) — required for 97-day lookback exceeding Advanced Hunting's 30-day limit.
