first, formal writeup to a customer where i have to cite another vendor they are using sending them ai slop in honeypot and edr alerts.

one thought a portscan was "an attacker conducting lateral movement"

then another thought dropping rubeus.exe onto a laptop, and having it immediately caught and deleted qualified as "a ransomware event"

this is just bananas.
its borderline fraud