Incident Workflow Pipeline
Global operational state across active telemetry streams
Unauthorized RDP Brute-Force Wave
Suspicious Outbound DNS Tunneling
Privilege Escalation on Core DC02
Sarah Chen
Malware Beacon Detected: APT29 Sig
Alex Mercer
Phishing Credential Harvester Sinkhole
Elena Rostova
SQL Injection Attempt on API Gateway
Active Incidents Registry
| Incident ID / Title | Severity | Assigned Analyst | Created Time | Status | Actions |
|---|---|---|---|---|---|
|
INC-8921
Unauthorized RDP Brute-Force Wave
|
CRITICAL | Unassigned | 2025-05-14 14:22 | OPEN | |
|
INC-8915
Privilege Escalation on Core DC02
|
CRITICAL |
Sarah Chen
|
2025-05-14 13:10 | INVESTIGATING | |
|
INC-8920
Suspicious Outbound DNS Tunneling
|
HIGH | Unassigned | 2025-05-14 14:06 | OPEN | |
|
INC-8908
Phishing Credential Harvester Sinkhole
|
MEDIUM |
Elena Rostova
|
2025-05-14 10:15 | CONTAINED |
Privilege Escalation via Vulnerable Service Binary on DC02
An anomalous process execution was detected spawning an interactive cmd.exe shell from an unquoted service path vulnerability on domain controller DC02 (`10.100.4.12`). Lateral movement indicators point to credential dumping activity via Mimikatz in memory.
bolt Playbook Triggers
Isolate Host & Flush ARP
Drops interface connection immediately
Revoke Active User Tokens
Force AzureAD / Okta session logout
Capture RAM Dump
Initiate remote forensic snapshot
schedule Incident Activity Timeline
EDR Alert Triggered
Sysmon event ID 1 recorded anomalous process spawning from unquoted path.
Analyst Assigned
Sarah Chen claimed INC-8915 for tier-2 forensic review.
YARA Rule Match Verified
Memory signature confirmed Mimikatz payload injected into LSASS.
forum SOC Team Notes
Verified administrative accounts active on DC02. Initiating token revocation now.
Firewall rules updated to block C2 IP `185.220.101.5`. Good catch team.