Oxbow

Before Signal

Oxbow moves freight through 14 depots that run around the clock, which means 1,310 identities in several time zones and no quiet hour that applies to everyone. Security was Hanne Dahlberg, a deputy and an outside provider that sent a weekly report. The report was 60 pages and opened with a pie chart.

A human read about 2,900 alerts a week, roughly double the median for orgs this size. The pager went off at night around 38 times a month, because in a business with warehouses on three continents, every false alarm is somebody’s lunchtime. Nobody could say which of the 38 mattered without reading all of them.

The first week

Cloud, identity, email and MDM were connected on day one. The first thing Signal did was decline to panic about 211 shared kiosk logins on the depot floors, which the old setup had flagged individually every week. It treated them as a baseline and told the team why.

They switched on three playbooks: contain a compromised account, remove a rogue mailbox rule, and isolate a host. The last one stays optional, per action, because a forklift scheduling laptop going offline mid-shift is a cost someone should choose on purpose. Hanne’s deputy took first on-call, and Hanne took second.

05:48 UTC

In August at 05:46:52 UTC, a finance clerk’s account logged in from a new device in Bucharest on a residential ASN. She was at gate 4 of the Rotterdam depot, where the badge reader had logged her at 05:31.

At 05:47:03 an inbox rule appeared, forwarding anything that matched “invoice”, “remittance” or “IBAN” to an outside address, marked as read and moved to a folder nobody opens. Signal pulled 31 related events, put the verdict at 05:47:21 with confidence 0.91, and paged the deputy at 05:47:22. He approved at 05:47:58. Two sessions were revoked, the rule deleted, MFA reset and external forwarding blocked on the mailbox. Contained at 05:48:19, 87 seconds after the first event.

The rule had not matched a single email. A supplier’s bank-details change request arrived at 06:10 and landed, correctly, in her inbox. The clerk called the supplier anyway, out of habit.

What changed

In Q3 Signal read 506,912 alerts and paged at night four times. The human-read queue went from about 2,900 a week to 11. The median time to contain is 5 minutes 2 seconds across everything, and the depot kiosk logins no longer appear in anyone’s week.

The outside provider’s contract ended in September. The last PDF arrived on a Friday, as always, and has been filed under “thorough”.

What’s next

Oxbow is moving to Enterprise this winter, for a single-tenant EU region and the control mappings its NIS2 work needs. It is also connecting EDR across all 14 depot networks, which is the larger project and, at the time of writing, the one with an owner and a date.

Hanne has taken one holiday since the review started and reports having checked her phone about as often as she checks the weather.