The tweet's tokens can draw from 1 of 3 topics, which is good but a bit constraining.
similar to the symptom stage, this stage contributes to false positives because it also occurs with normal routine network problems, not just malicious acts.