CLIENT SYSTEMSNORMAL
97.8%↑ 1.2% above 7-day baseline
MONDAY · AUGUST 24
Good morning, James.
The bridge is quiet. There are three items worth your attention before you start the day.
✦CORA / MORNING READOUTOne campus pattern and two customer follow-ups need a decision.
System posture
Your operation, at a glance
ACTIVE SIGNALSWATCH
14→ 3 require an operator decision
PROTECTED ENDPOINTSON TARGET
3,842↑ 28 devices added this week
OPEN WORKTODAY
8→ 2 due before 12:00 PM
JRWDJE+4
Priority traffic
Decide next
REVIEW2 CLIENTS · 12 MIN AGO
Three account-lockout events share a workstation pattern.
Two customers · all from known internal hosts · no ticket created.
WATCHMONSTERS UNIVERSITY · 38 MIN AGO
Wired Microsoft 365 tests fell below the morning baseline.
Wireless remains clean. Cora has a correlation ready.
FOLLOW-UPJAMES · DUE 11:00 AM
Review the August client-readiness brief.
Draft is assembled; two findings need your wording.
Client pulse
Who needs a look
MU
Monsters University1,842 endpoints · 11 sites
2 signalsWatch · Microsoft 365
DI
Dinoco218 endpoints · 2 sites
StableLast change 3d
RZ
Rust-eze84 endpoints · 1 site
1 signalAction · Identity
PP
Pizza Planet56 endpoints · 1 site
StableLast change 6d
Bridge activity
Since you were last here
08:31 · Cora
Completed the daily backup evidence check
All protected tenants are within policy.
08:18 · Makee
Published the morning operations digest
14 signals evaluated across 21 clients.
FRI 16:42 · James
Closed the Sunnyside network diagram review
Change record #2026-081 attached.
LIVE OPERATING PICTURE
Operations
Signals are grouped by what needs a human judgment—not by which vendor generated them.
MONITORED CLIENTS21 of 21 reporting
EVENTS IN LAST 24H2,486 ↓ 18% from normal
DECISIONS WAITING3 oldest: 42 min
AUTOMATION HEALTH99.6%
Signal board
Operator queue
08:30
12m
12m
REVIEWIDENTITY
Lockout pattern across Dinoco and Rust-eze
6 failed authentication clusters · internal caller-host overlap
2 clients
Entra + AD
Entra + AD
08:04
38m
38m
WATCHEXPERIENCE
Wired Microsoft 365 performance has degraded
MU campus · 3 locations below baseline · no user reports yet
Monsters University
WyeBot + Meraki
WyeBot + Meraki
07:46
56m
56m
FOLLOW-UPBACKUP
Two Microsoft 365 mailbox snapshots need confirmation
Protection completed after a transient API retry.
Monsters, Inc.
Datto SaaS
Datto SaaS
07:21
81m
81m
RESOLVEDNETWORK
AP channel contention remediated overnight
Room 325 utilization returned to expected range.
Monsters University
Meraki
Meraki
Automation timeline
The bridge has been working
Captain brief
Prepared
Makee digest
Published
Backup check
Passed
Performance
Watching
Identity
Review
JR
PERSONAL OPERATOR SPACE
James’s workbench
A focused surface for the decisions, threads, and work only you should carry.
Today
Your work queue
Cora’s note to you
Morning brief
Good morning, Captain. The operation is stable enough to make the account-lockout rail your first deliberate decision today.
- 3 decisions are waiting, none are urgent.
- MU’s wired O365 degradation is real but contained; the evidence points to a firewall path.
- Two customers share a repeat lockout host pattern; I recommend attended ticketing before automation.
Delivery runway
What is moving
AD lockout railDesign complete · pending Captain decisions
28%
Customer security postureClient inventory and read-only sources
62%
Portal refreshInformation architecture and front door
16%
Scratchpad
Captain’s notes
JAMES'S ACTIVE BOOK
Tickets, in context.
Work is organized around the handoff, customer impact, and next decision—not just age or priority.
MY ACTIVE BOOK11 across 7 clients
NEEDS A REPLY4 oldest: 47 min
WAITING ON CUSTOMER3 with a clear next step
RESOLVED THIS WEEK18 median: 1h 42m
11 active ticketsLAST REFRESHED 08:42
Queue intelligence
Four tickets can move with one decision each.
They are not blocked by technical work; they are waiting for a customer, owner, or policy call.
1 needs a captain decision2 need customer replies1 is ready to close
CORA + MAKEE / ANALYST LAYER
Intelligence with receipts.
Every conclusion is traceable to live evidence. Every recommendation stays a recommendation until you decide.
76 tool surfaces onlineLAST ANALYST RUN 08:31 PTDATA WINDOW LAST 24 HOURS
PRIORITY ANALYSIS · 08:04
Wired Microsoft 365 degradation is real—but it is contained.
Three Monsters University locations fell below their normal Microsoft 365 experience baseline. Wireless is clean, which narrows the path to wired egress rather than a campus-wide service issue.
01
What changed WyeBot pass rate dropped from 98.7% to 91.3% across Room 325, Admin, and Facilities.
02
Why it matters Staff on wired connections may experience slow Teams, OneDrive, and Outlook before they report an issue.
03
What I don’t know Whether the firewall policy change at 06:42 is causal; no matching error signature is present yet.
Evidence trail
How the conclusion was reached
WWYEBOT · 07:58Experience test degradationOBSERVED
Wired M365 pass rates dropped at three locations. Wireless comparison remained inside baseline.
91.3%pass rate · baseline 98.7%
MMERAKI · 08:01Network path remains healthyOBSERVED
Switch port error and AP uplink indicators remain normal. No broad transport fault is visible.
0new interface errors
FFIREWALL · 06:42Policy change is a candidateHYPOTHESIS
A new outbound rule touches the same egress class. Correlation is temporal; causality is unproven.
1change awaiting comparison
More from the bridge
Other items worth reading
Watching for you
Persistent patterns
Identity lockouts2 customers · new overlapESCALATED
Wired M365 experienceMU campus · 3 locationsWATCHING
Backup evidenceAll protected tenantsSTABLE
GROUNDED INQUIRY · READ-ONLY
What changed on the wired M365 path?
This inquiry was opened from the Monsters University performance signal. Cora can use the attached evidence and selected read-only tools.
IN CONTEXTMU Monsters University⌁ Wired M365 degradation3 Evidence sources□ 1 library record
C
ANSWERED FROM 3 SOURCESCORA · ANALYST
Grounded answer
JR
JAMES · 08:42
Why did wired Microsoft 365 performance decline at Monsters University, and what should I do next?
C
CORA · 08:43 · HIGH CONFIDENCE
The degradation is real and currently isolated to the wired egress path. WyeBot shows a sustained pass-rate decline at three locations; Meraki shows no corresponding switch or uplink fault. Wireless remains inside its normal range.
The best current explanation is a policy change at 06:42 that touches the affected outbound class. It is a temporal correlation, not proof of causation. I have not found an error signature that confirms the policy is responsible.
WHAT I RECOMMEND
Run a read-only comparison between the 06:42 policy diff and the affected egress path. That should reduce uncertainty without changing production state.
What I still don’t know
Whether a change rollback is necessary, and whether the issue is visible to users outside the three observed wired locations.
⌕
SAFE NEXT STEPS
Choose how to proceed
These are proposals. Nothing has been run or changed.
MANAGED CLIENT PORTFOLIO
See the whole customer picture.
Health, active work, and operational context in one place—so attention follows the customer, not the tool.
MANAGED CLIENTS21 in active scope
OPERATING NORMALLY18 no action needed
WATCHING2 evidence is collecting
NEEDS JUDGMENT1 captain decision
PORTFOLIO HEALTH97.8%
CLIENTOPERATIONAL POSTUREOPEN WORKLAST MATERIAL CHANGE
Portfolio intelligence
Three clients deserve your attention—not because they are unhealthy, but because the next move needs judgment.
DinocoAction · Lockout decisionMonsters UniversityWatch · Read-only investigationMonsters, Inc.Watch · Customer confirmation
MU
CLIENT RECORD · EDUCATION
Monsters University
11 sites · 1,842 endpoints · primary operational contact: IT Services
WATCHING
CLIENT HEALTH98.4%
Within expected posture
ACTIVE SITES11/11
All reporting
OPEN WORK2
One needs a decision
LAST MATERIAL CHANGE08:04
Wired M365 experience
OPERATIONAL OWNERJames
Captain · primary
Client briefing
What deserves attention
WATCHMONSTERS UNIVERSITY · EXPERIENCE
Wired Microsoft 365 performance is below baseline at three locations.
Wireless remains clean. The evidence points toward a wired egress path, not a campus-wide service issue.
PLANNEDMONSTERS UNIVERSITY · CLIENT SUCCESS
August readiness brief is ready for final wording.
Two documented findings need your client-facing language before the brief is sent.
Site posture
Where the operation stands
Current work
Tickets and commitments
MT20260824.0413 · MEDIUMWired Microsoft 365 access is intermittently slow
Attached evidence available · owner Woody
OPENPPROJECT · AUGUSTClient readiness brief and evidence package
Two findings need final wording · owner James
IN REVIEWClient history
The recent operating story
Experience signal opened
Wired M365 pass rate declined at three locations.
Topology review completed
Network-diagram changes captured in client record.
Backup evidence confirmed
Protected tenant evidence is within policy.
Wireless testing plan approved
Testing-day coverage and AP tuning record updated.
VERIFIED OPERATING KNOWLEDGE
The Library
What the operation knows, where it came from, and when it was last confirmed.
CONNECTED TO YOUR WORKThe account-lockout rail plan is referenced by two open tickets and your current workbench focus.
Picked for this morning
Start where the work is
DECISION PLANVERIFIED
AD account lockout → Autotask ticket rail
A multi-tenant, attended proposal for turning a lockout signal into an accountable service ticket.
RUNBOOKCURRENT
Identity and proxy header trust boundary
How portal identity is established, verified, and passed through the access layers.
CASE STUDYEVIDENCE
Wired M365 issue caught before a complaint
How WyeBot and network context isolated a campus-wide experience problem.
Operational collections
Knowledge with a purpose
Run the operation
Runbooks, escalation paths, recovery steps, and safely bounded procedures.
48 documents →Know the customer
Client profiles, operational history, service context, and approved scope.
84 knowledge records →Prove what happened
Bridge reports, evidence packages, audits, and findings tied to a moment in time.
126 evidence records →Remember the decision
Why an operator chose a path, what was approved, and what changed afterward.
31 decision records →Recently confirmed
Trusted, current knowledge
ITEMTYPEOWNERCONFIRMED