Loading investigation data…
WorkspaceAlerts
SIMULATED TELEMETRY
Individual suspicious signals and sequences, linked to source evidence.
10 alerts from the stored telemetry
| Detection signal | Severity | Time (UTC) | Incident |
|---|---|---|---|
| Short-lived privileged roleIAM-003 · A granted platform administrator role is reverted for the same user within thirty minutes. | Medium | 14:24:00 | INC-fe8fa4b9508c |
| Unseen authentication source or deviceAUTH-002 · Successful login uses an IP or device absent from at least three prior successful logins. | Medium | 14:21:00 | INC-fe8fa4b9508c |
| Abnormal account data volumeAPP-002 · A successful query accesses at least 1,000 records. Normal synthetic queries access no more than 90. | High | 14:17:00 | INC-fe8fa4b9508c |
| Sensitive account resource accessedAPP-001 · A successful read targets an explicitly classified sensitive account resource. | Medium | 14:14:00 | INC-fe8fa4b9508c |
| Internal endpoint enumerationAPI-001 · At least twelve distinct internal endpoints requested by one user/session within five minutes. Alert emits once per window. | Medium | 14:11:11 | INC-fe8fa4b9508c |
| Privilege follows unfamiliar authenticationIAM-002 · A privileged role is granted within fifteen minutes of unfamiliar successful authentication for the same user/session. | High | 14:07:00 | INC-fe8fa4b9508c |
| Privileged role assignedIAM-001 · A platform administrator role is granted. | Medium | 14:07:00 | INC-fe8fa4b9508c |
| MFA accepted after unfamiliar loginMFA-001 · MFA acceptance within five minutes after an unfamiliar successful authentication on the same session. | Medium | 14:03:00 | INC-fe8fa4b9508c |
| Unseen authentication source or deviceAUTH-002 · Successful login uses an IP or device absent from at least three prior successful logins. | Medium | 14:02:00 | INC-fe8fa4b9508c |
| Unusual synthetic locationAUTH-003 · Successful login uses a synthetic location absent from at least three prior successful logins. Location is a simulator label, not real IP geolocation. | Low | 14:02:00 | INC-fe8fa4b9508c |
An alert is a signal, not a conclusion. Open its linked incident to assess the surrounding evidence.