Here is one hour of events from a fictional company, Harbor Mutual. Most are ordinary noise. Hidden among them is a single real intrusion — a chain of events that, read together, tell the story of an attack. Tap the events you believe are part of the attack, then submit. This is the "4,000 alerts a day" problem in miniature: detection is easy, finding the signal is hard.