Did an IR at a site where the helpdesk had been closing tickets like this for nine months, completely missing a major APT campaign.