Loading investigation data…
WorkspaceDetections
SIMULATED TELEMETRY
Versioned rules evaluate normalized events. Correlation gives those signals context.
10 detection definitions · configuration stored as code
| Rule | Logic | Severity | Window | Alerts | Status |
|---|---|---|---|---|---|
| AUTH-001 Repeated authentication failuresAt least five failed logins for a user in five minutes. | Failed logins | Medium | 5 minThreshold ≥ 5 | 0 | Enabled |
| AUTH-002 Unseen authentication source or deviceSuccessful login uses an IP or device absent from at least three prior successful logins. | Unseen auth | Medium | Single eventThreshold ≥ 3 | 2 | Enabled |
| AUTH-003 Unusual synthetic locationSuccessful login uses a synthetic location absent from at least three prior successful logins. Location is a simulator label, not real IP geolocation. | Unseen location | Low | Single eventThreshold ≥ 3 | 1 | Enabled |
| MFA-001 MFA accepted after unfamiliar loginMFA acceptance within five minutes after an unfamiliar successful authentication on the same session. | Mfa after auth | Medium | 5 minThreshold ≥ 1 | 1 | Enabled |
| IAM-001 Privileged role assignedA platform administrator role is granted. | Privileged role | Medium | Single eventThreshold ≥ 1 | 1 | Enabled |
| IAM-002 Privilege follows unfamiliar authenticationA privileged role is granted within fifteen minutes of unfamiliar successful authentication for the same user/session. | Privilege after auth | High | 15 minThreshold ≥ 1 | 1 | Enabled |
| API-001 Internal endpoint enumerationAt least twelve distinct internal endpoints requested by one user/session within five minutes. Alert emits once per window. | Enumeration | Medium | 5 minThreshold ≥ 12 | 1 | Enabled |
| APP-001 Sensitive account resource accessedA successful read targets an explicitly classified sensitive account resource. | Sensitive access | Medium | Single eventThreshold ≥ 1 | 1 | Enabled |
| APP-002 Abnormal account data volumeA successful query accesses at least 1,000 records. Normal synthetic queries access no more than 90. | Data volume | High | Single eventThreshold ≥ 1000 | 1 | Enabled |
| IAM-003 Short-lived privileged roleA granted platform administrator role is reverted for the same user within thirty minutes. | Rapid reversion | Medium | 30 minThreshold ≥ 1 | 1 | Enabled |