Shared Infrastructure

Overlap is shared fate. It lists the infrastructure that two or more of your customers reached, with the graph's verdict on each destination. A firm holding the whole book can see that a destination is common; a single customer cannot.

Reading the list

Each row is a destination and the customers that reached it, with the graph's verdict beside it.

Unknown is reported as unknown. It is not folded into clean, because a destination nobody has scored is a destination nobody has scored, and reading that as safe is the mistake the column exists to prevent. Coverage explains what the graph means when it says it has not looked.

Why the overlap matters

Shared infrastructure is how one compromise becomes several. A destination that appears in two estates and scores badly deserves more than the same destination in one, because the second appearance says something about reach rather than about one machine.

The reverse is just as useful. A destination that appears across most of the book is usually something ordinary, and seeing that on the same screen stops an afternoon being spent on it.

Turning one answer into a rule

Block, which the portal also calls inoculate, takes one customer's verdict and pushes it to the rest of the book as a resolver rule. The name stops resolving for every customer you apply it to.

It acts in the resolver rather than on a machine, so it reaches every endpoint that resolves names through Whisper, including the ones carrying no sensor. That makes it the fastest thing available when the destination matters more than the host. Policy across customers covers where those rules live afterwards and how a customer's own lists read them, and the response verbs cover the rest of the ladder, up to cutting an identity.

One destination, three estates

A hunt finds a name in one customer's records. Overlap shows two more customers reached the same name, and the graph scores it badly for all of them. You block it once for the three, and open a case in each estate so each customer's own record says what was done and why. The block stays as a rule you can read back on each customer's policy, rather than as something that happened once.