Security & Threat Intelligence
Anomaly detection, access logs, and firewall events
14,820
Events Blocked (24h)
5
Open Incidents
8.4
Risk Score
Threat Trends (24h)
Threat Metrics
Security Event Log
| ID | Event Type | Source IP | Attack Vector | Severity | Event Detail | Mitigation Action | Timestamp |
|---|---|---|---|---|---|---|---|
| EVT-24-0827-001 | Kubernetes Privilege Escalation AttemptT1611 | EKS-Cluster-Prod-01 ns: auth-gateway | RBAC Misconfig / Pod Exec | Critical | Unauthorized service account (sa:deploy-bot) used to open an exec shell session into the 'auth-gateway' pod via kube-apiserver. SDD agent terminated the session immediately and suspended sa privileges. | Route Isolation & Token Revocation | 14:32:07 |
| EVT-24-0827-002 | WAF - SQL Injection Payload DroppedT1190 | WAF-Edge-Node 185.14.x.x (RU) | Layer 7 / SQLi | High | POST request containing base64-obfuscated UNION SELECT payload detected targeting the login endpoint. Payload matched by WAF rule set (OWASP CRS v3.3) and packet dropped. | IP Address Blocked (72h) | 13:18:44 |
| EVT-24-0827-003 | CI/CD Pipeline Dependency PoisoningT1195.002 | GitHub Actions Runner-04 | Supply Chain Attack | Critical | During Node.js build process, a tampered external dependency (npm:lodash-utils-v2) detected in 'package-lock.json'. Found to contain a malicious script exfiltrating environment variables (ENV). | Build Process Halted, SDD Security Alert | 11:07:22 |
| EVT-24-0827-004 | Identity & Access - Impossible TravelT1078 | Entra ID / IAM admin_m.kaya | Credential Compromise | Medium | User 'admin_m.kaya' received successful MFA verification requests from both Frankfurt (Germany) and Tokyo (Japan) locations within 10 minutes. Impossible Travel rule violated. | Sessions Terminated, Password Reset Required | 09:45:31 |
| EVT-24-0827-005 | Endpoint - Ransomware PrecursorT1490 | Host-DB-Replica-02 Win Server 2022 | Inhibit System Recovery | High | EDR (Endpoint Detection) system detected attempt to delete system Shadow Copies via vssadmin.exe. Process matched pre-ransomware behavioral analysis pattern. | Host Network Isolated, Process (PID: 4192) Killed | 08:22:15 |