A confession can end an investigation. When someone says an alert is theirs, the person examining it may stop, and the explanation goes unchecked.
The case
A person had been sending test traffic. An alert fired after that traffic was sent, and the sender took it to be theirs. They told the person already investigating the alert to stop.
Someone asked whether the timestamps had been checked. They had not. When they were, the alert had started fifty-four seconds before the first test traffic was sent.
What the confession did
The sender had “removed the person examining it by confessing to it”. A wrong explanation misleads. A wrong confession ends the search.
Why it is hard to challenge
Challenging a wrong confession feels like refusing an apology.