Example GmbH · Overview
All quiet. Two items need your review.
⌘K Search
JB
- POSTURE
- 84 / 100
- +3 since last month
- OPEN INCIDENTS
- 0
- last contained 03:12 UTC
- MTTR · 30 DAYS
- 00:17
- SLA 00:45 · met
- ENDPOINTS COVERED
- 1,238 / 1,240
- 2 offline > 7 days
- PATCH COMPLIANCE
- 96%
- within 14 days
Needs your review2 items
Confirm: was j.berg on VPN at 02:48?
Approve new local admin on ws-022
Alerts triaged · 14 daysall by SOC
| SEV | TIME UTC | DETECTION | STATUS |
|---|---|---|---|
| High | 2026-09-24 03:11:52 | Credential dumping (LSASS access) | Contained |
| Medium | 2026-09-24 02:48:07 | Impossible travel sign-in | Needs review |
| Low | 2026-09-24 02:30:19 | Suspicious attachment quarantined | Resolved |
| Medium | 2026-09-24 01:44:31 | New local admin created | Needs review |
| Low | 2026-09-24 00:58:02 | Port scan from internal host | Resolved |
ALR-881202026-09-24 03:11:52 UTC
Credential dumping (LSASS access)
- Host
- host-17.example.com
- Source IP
- 192.0.2.17
- ATT&CK
- T1003.001
- Analyst
- A. Demir (L2)
Contained: host isolated at 03:12:40. Please confirm the user was not running admin tools.
INC-2026-0412 · T+ timelineContained
- T+00:00EDR alert: LSASS memory access on host-17.example.com
- T+00:04Triaged by A. Demir: true positive, High
- T+00:48Host isolated (pre-authorized action)
- T+00:52Client notified by phone: J. Berg
- T+06:00Report available
Audit logimmutable · export CSV
| 2026-09-24 03:11:52 | system | Alert ALR-88120 created |
| 2026-09-24 03:12:10 | a.demir | Status → Investigating |
| 2026-09-24 03:12:40 | a.demir | Action: isolate host-17.example.com |
| 2026-09-24 03:13:05 | a.demir | Phone call to j.berg logged |
| 2026-09-24 03:15:22 | j.berg | Viewed case (MFA: FIDO2) |
| 2026-09-24 03:20:00 | system | Status → Contained |
Open vulnerabilities by age (days)
Critical
1
High
6
Medium
15
Low
16
Segments: 0–14 · 15–30 · 30+ days
| CVSS 4.0 | ID | ASSET | AGE | SLA |
|---|---|---|---|---|
| 9.3 Critical | CVE-2026-XXXXX | vpn-gw.example.com | 1 d | 6 d left |
| 8.1 High | CVE-2026-XXXXX | backup-01.example.com | 5 d | 9 d left |
| 7.5 High | CVE-2026-XXXXX | ws-114.example.com | 33 d | 3 d over |
| 5.4 Medium | CVE-2026-XXXXX | helpdesk.example.com | 12 d | 18 d left |
| 3.1 Low | CVE-2026-XXXXX | cms.example.com | 41 d | no SLA |
| TICKET | SUBJECT | PRIORITY | SLA REMAINING |
|---|---|---|---|
| HD-3319 | New starter: laptop and accounts for M. Sørensen | P4 | 1 d 04:10 |
| HD-3322 | VPN slow from Hamburg office | P2 | 00:38 |
| SEC-0412 | Post-incident: rotate svc-backup credentials | P2 | 03:12 |
| HD-3325 | Printer offline, 2nd floor | P3 | 02:55 |
| USER | ROLE | MFA | LAST LOGIN (UTC) |
|---|---|---|---|
| Jana Berg | Admin | FIDO2 | 2026-09-24 03:15 |
| Tim Kaya | Viewer | Authenticator app | 2026-09-23 17:02 |
| Ole Hansen | Approver | Authenticator app | 2026-09-22 09:41 |
| Service: ticket-sync | API | Scoped token | 2026-09-24 03:00 |
| Nina Richter | Viewer | Not enrolled | invited 2026-09-20 |