A case exists only when independent telemetry, an exposure model or a retained baseline adds a conclusion absent from the originating alert.