Incidents

25 incidents in the last 24 hours · grouped from 1,284 alerts

25 shown

Incident	Severity	Title	Sources	Assets / users	MITRE tactic	AI verdict	Status	Owner	Updated
XDR-4821	Critical	Suspected Cobalt Strike beacon on ENG-WS-114 (CUI enclave)CUI	Cortex XDRNGFWDefender for Office 365	ENG-WS-114 · j.reyes	Command and Control	True Positive94%	Awaiting approval	Vault engineer	07:24
ENTRA-RS-338	High	Impossible travel sign-in from Lagos for m.alvarez	Entra IDDefender for Office 365Prisma Access	m.alvarez@halcyonprecision.us	Initial Access	True Positive88%	Awaiting approval	Vault engineer	07:08
SCM-TP-2290	High	Outbound C2 attempts to 185.220.101.47 blocked by Advanced Threat Prevention	NGFWPrisma Access	ENG-WS-087, ENG-WS-131	Command and Control	True Positive91%	Contained	AI SOC	06:49
XDR-4817	High	Credential dumping attempt – lsass access blocked by XDR agent	Cortex XDR	HP-FS-01 · svc_backup	Credential Access	True Positive90%	Contained	AI SOC	04:24
MDO-1177	High	WildFire malicious verdict on email attachment – quarantined	Defender for Office 365NGFW	3 mailboxes	Initial Access	True Positive97%	Contained	AI SOC	02:14
SCM-DNS-5512	Critical	Advanced DNS Security: DNS tunneling from ERP server	NGFWCortex XDR	HP-ERP-01	Exfiltration	True Positive96%	Awaiting approval	Vault engineer	07:27
ENTRA-AP-092	Medium	Suspicious OAuth app consent in Entra ("PDF Toolkit Pro")	Entra ID	k.nguyen	Persistence	Needs Review66%	AI investigating	AI SOC	07:21
PUR-DLP-0912	High	Purview DLP: CUI drawing sent to personal GmailCUI	Purview DLPDefender for Office 365NGFW	r.patel → r.patel.personal@gmail.com	Exfiltration	Needs Review78%	Awaiting approval	Customer	07:16
XDR-4820	Low	PowerShell download cradle – IT admin script, benign	Cortex XDR	ENG-WS-009 · it.admin	Execution	Benign98%	Resolved	AI SOC	05:55
PA-BF-1440	Medium	Brute force on VPN portal – blocked by Prisma Access, benign	Prisma Access	GlobalProtect portal	Credential Access	Benign96%	Resolved	AI SOC	05:20
XDR-4815	Low	Unsigned binary executed from Downloads – SOLIDWORKS plugin	Cortex XDR	ENG-WS-151	Execution	Benign95%	Resolved	AI SOC	02:30
SCM-URL-883	Low	Advanced URL Filtering: newly registered domain accessed	NGFW	ENG-WS-044	Command and Control	Benign93%	Resolved	AI SOC	01:50
MDO-1176	Medium	Credential phishing link clicked – Safe Links blocked	Defender for Office 365	t.brooks	Initial Access	True Positive89%	Resolved	AI SOC	00:40
ENTRA-RS-337	Low	Risky sign-in: unfamiliar location (Denver) – traveling user	Entra ID	d.kim	Initial Access	Benign92%	Resolved	AI SOC	22:50
XDR-4812	Medium	certutil downloading file on HP-ERP-01	Cortex XDR	HP-ERP-01	Defense Evasion	Benign87%	Resolved	AI SOC	21:20
XDR-4799	High	Anomalous RDP from HP-ERP-01 to HP-DC-02	Cortex XDRNGFW	HP-ERP-01, HP-DC-02	Lateral Movement	Needs Review74%	Escalated to Unit 42	Vault engineer	19:30
SCM-TP-2288	Low	Port scan from guest Wi-Fi blocked by zone protection	NGFW	Guest zone	Discovery	Benign97%	Resolved	AI SOC	18:30
DLP-0456	Low	Purview DLP: ITAR keyword in Teams chat – internal only	Purview DLP	Engineering channel	Collection	Benign90%	Resolved	AI SOC	17:30
MDO-1175	Low	Bulk spam campaign – ZAP removed 41 messages	Defender for Office 365	41 mailboxes	Initial Access	Benign99%	Resolved	AI SOC	16:30
XDR-4809	Medium	Ransomware behavioural rule – Veeam backup job	Cortex XDR	HP-FS-01	Impact	Benign95%	Resolved	AI SOC	14:50
PA-DNS-219	Low	DGA-like domain lookups from mobile user	Prisma Access	s.ortiz (Prisma Access)	Command and Control	Benign88%	Resolved	AI SOC	13:30
ENTRA-PIM-045	Medium	Global Administrator activated outside change window	Entra ID	a.chen	Privilege Escalation	Benign91%	Resolved	AI SOC	12:20
XDR-4806	Low	Agent disconnected > 7 days – ENG-WS-019	Cortex XDR	ENG-WS-019	Defense Evasion	Benign99%	Resolved	AI SOC	10:40
SCM-WF-772	Medium	WildFire malicious verdict – download blocked at HQ-FW-01	NGFW	ENG-WS-066	Execution	True Positive96%	Contained	AI SOC	09:50
MDO-1178	Medium	Look-alike domain halcyon-precision.co registered	Defender for Office 365	Brand	Reconnaissance	Needs Review70%	New	Customer	07:18