Loading investigation data…
WorkspaceOverview
SIMULATED TELEMETRY
Investigate connected signals. Follow the evidence.
Correlated activity that deserves a closer look
Unfamiliar authentication, privileged access, and account-resource activity share one principal within a thirty-minute window. Session, device and IP relationships provide context; telemetry does not establish malware or external exfiltration.
Principal + time window + rule diversity
Evidence-driven detections
| Detection signal | Severity | Time (UTC) |
|---|---|---|
| Short-lived privileged roleIAM-003 | Medium | 14:24:00 |
| Unseen authentication source or deviceAUTH-002 | Medium | 14:21:00 |
| Abnormal account data volumeAPP-002 | High | 14:17:00 |
| Sensitive account resource accessedAPP-001 | Medium | 14:14:00 |
| Internal endpoint enumerationAPI-001 | Medium | 14:11:11 |
Across the Atlas environment
atlas.engineer.04 · Identity
atlas.engineer.04 · Identity
atlas.engineer.04 · Atlas
atlas.engineer.04 · Atlas
atlas.engineer.04 · Api gateway