Loading investigation data…

INC-fe8fa4b9508cHighNew

Suspected compromise of Atlas engineer account

Unfamiliar authentication, privileged access, and account-resource activity share one principal within a thirty-minute window. Session, device and IP relationships provide context; telemetry does not establish malware or external exfiltration.

26 evidence items10 linked alerts36 entitiesOpened 2026-09-17 · 16:04:43 UTCOwner: Unassigned

Why these alerts form one incident

DETERMINISTIC CORRELATION

Principal: USR-004
Alert window · UTC: 14:02–14:2422 min within a 30-minute window
Distinct rules: 910 alerts · minimum 3 distinct rules
Rule families: API · APP · AUTH · IAM · MFA5 families · minimum 2

Grouped by principal and event time. Device, session, and IP relationships provide investigation context.

Inspect correlation rationale

10 alerts reference 1 principal(s): USR-004.
9 distinct rules across 5 families meet the minimum of 3 rules and 2 families.
First-to-last alert span is 22 minutes; the clustering window is 30 minutes, anchored at the first alert.
Principal and event time are grouping predicates. Device, session, and IP relationships provide investigation context; they do not independently join cases.

Read-only public demo. Case changes and approvals are available in the local interview workflow.

Evidence timeline

26 source events · chronological · UTC

Group API bursts

13:57:00Identity
atlas.engineer.04 · Identity Service · 192.0.2.14
AUTH-002 · Unseen authentication source or deviceAUTH-003 · Unusual synthetic location
14:02:00Identity
atlas.engineer.04 · Identity Service · 203.0.113.77
AUTH-002 · Unseen authentication source or deviceAUTH-003 · Unusual synthetic locationMFA-001 · MFA accepted after unfamiliar loginIAM-002 · Privilege follows unfamiliar authenticationAUTH-002 · Unseen authentication source or device
14:03:00Identity
atlas.engineer.04 · Identity Service · 203.0.113.77
MFA-001 · MFA accepted after unfamiliar login
14:07:00Identity
atlas.engineer.04 · Identity Service · 203.0.113.77
IAM-001 · Privileged role assignedIAM-002 · Privilege follows unfamiliar authenticationIAM-003 · Short-lived privileged role
14:11:00Api gateway
18 API requests across 18 endpoints14:11:00–14:11:17 UTC · same principal and sessionAPI-001 · Internal endpoint enumerationInspect all events
API-001 · Internal endpoint enumeration
1. 14:11:00Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/01 · 203.0.113.77
  API-001 · Internal endpoint enumeration
2. 14:11:01Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/02 · 203.0.113.77
  API-001 · Internal endpoint enumeration
3. 14:11:02Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/03 · 203.0.113.77
  API-001 · Internal endpoint enumeration
4. 14:11:03Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/04 · 203.0.113.77
  API-001 · Internal endpoint enumeration
5. 14:11:04Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/05 · 203.0.113.77
  API-001 · Internal endpoint enumeration
6. 14:11:05Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/06 · 203.0.113.77
  API-001 · Internal endpoint enumeration
7. 14:11:06Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/07 · 203.0.113.77
  API-001 · Internal endpoint enumeration
8. 14:11:07Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/08 · 203.0.113.77
  API-001 · Internal endpoint enumeration
9. 14:11:08Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/09 · 203.0.113.77
  API-001 · Internal endpoint enumeration
10. 14:11:09Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/10 · 203.0.113.77
  API-001 · Internal endpoint enumeration
11. 14:11:10Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/11 · 203.0.113.77
  API-001 · Internal endpoint enumeration
12. 14:11:11Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/12 · 203.0.113.77
  API-001 · Internal endpoint enumeration
13. 14:11:12Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/13 · 203.0.113.77
14. 14:11:13Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/14 · 203.0.113.77
15. 14:11:14Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/15 · 203.0.113.77
16. 14:11:15Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/16 · 203.0.113.77
17. 14:11:16Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/17 · 203.0.113.77
18. 14:11:17Unreviewed
  atlas.engineer.04 · /internal/v1/catalog/18 · 203.0.113.77
14:14:00Atlas
atlas.engineer.04 · /internal/v1/accounts/ACC-SYN-0042/profile · 203.0.113.77
APP-001 · Sensitive account resource accessed
14:17:00Atlas
atlas.engineer.04 · /internal/v1/accounts/query · 203.0.113.77
APP-002 · Abnormal account data volume
14:21:00Identity
atlas.engineer.04 · Identity Service · 203.0.113.77
AUTH-002 · Unseen authentication source or device
14:24:00Identity
atlas.engineer.04 · Identity Service · 203.0.113.77
IAM-003 · Short-lived privileged role

Evidence Analyst

Grounded in this investigation

READ ONLY

Ask a question. Inspect the evidence.Answers are limited to this incident’s evidence. Every factual finding must cite a source.

The public demo uses the deterministic evidence analyst for reproducibility. A separately validated OpenAI provider is documented in the repository. Answers are temporary and do not change this case.

No tools, persistent state changes, or cross-incident access. Findings and approvals are read-only in the public demo.