Hi there!

EDIT: This is for SR3 of course - I made a typo in the topic header O_O

Anyone has a clue, if the security sheet of the decker increases after a successful logoff , when the destroyed IC is no longer surpressed?

Example:
A decker took down a number of IC and surpressed them with his hacking pool (or DF): Killer-8, Tracer-5 = 13 points total which would be added to his security tally of 5 points.
Afterwards the decker decides to jump ship and performs
a) a graceful logoff: the security sheet stays at 5 because the 13 points can no longer traced back to the user.
b) jack-out: the security sheet is increased after logout (13+5 = 18)

I suppose those 13 points could be used by the host in general to decide if it should trigger alarms.

Last sentence of the rules for suppressing IC: "Deckers cannot suppress IC in a system they have left."

While it does not outright say "therefore, the security tally increases when leaving", IMO that is the only reasonable interpretation of that remark.

Yep, I agree. Though to my understanding the action "graceful logoff" deletes all traces of the decker's actions on the host. So the host would know, only that some untraceable source surpressed the IC at some unknown time, after the IC was activated for an "unknown user"...

Therefore I would assume that those points can not be traced back to the hacker, on the other hand - I would still use them to increase the overall security tally to check if apassive or active alert would be triggered.

...or even a security decker called, who might in turn inform the physical security to be extra suspicious in case the matrix intrusion was part of a physical intrusion.

Exactly. If multiple IC have been surpressed, it is almost certain that the host will be on active alert afterwards. This really ensures the runner do what they do "in one matrix run" instead of login - do 1 thing - logout - wait until the hosts reset - do next thing. And if you want to keep a low profile, you have to adjust your deck for evasion maneuvers, so you can hide yourself from the IC.

Once the suppressed ICE drops, the security tally jumps and the alarms go off.

What happens after that depends on the level of response, how secure the site (physical, matrix and otherwise) is and just how paranoid they are.
Oh wait, it's Shadowrun, they're paranoid.

Btw: this can lead to some really fun things that happen during a perfect run, like a kiddie trying to crash the server of the facility you're sneaking the physical prototype out of - and then it's double and triple twist time while you try and get paid from people who might be trying to kill you.

And the way Matrix security is in 3rd, you can be sure that, unless someone has nuked the alarm system, if the server goes POP, you can be sure the special-response team as well as the IT-on call will be called.

Hola!
-Tir