The leaver who never left: tuning a Sentinel detection from 103 rows to one alert

Most account compromise detections look for something odd. A new country, an impossible journey, a sign-in at 3am. I wanted to catch a case where nothing looks odd at all. Someone leaves the organisat