Munin, Keeper of LoreToday's incident: SIEM detects suspicious user-agent.
Tracing through the events, it looks like the cause is a user using a chinese browser to read chinese books.
As far as incidents go, this one's not so bad. And it provided a useful framework to talk about how the detection works.