Incidents

Prioritized by Aegis fusion score · 8 active, 4 contained, 3 in triage

Open

−18%

Auto-contained

+3last 24h

Avg. fusion score

of 100

SLA breach risk

HighINC-24817, INC-24814

Sorted by fusion score · desc

ID	Severity	Title	Status	MITRE	Assets	Assignee	Score	Age
INC-24817	Critical	Confirmed lateral movement via compromised service account	Active	T1078 · T1021.002 · T1486	14	Alex R.	96	12m
INC-24816	Critical	Suspected ransomware staging on file server FS-VAULT-02	Contained	T1486 · T1490	3	Auto-SOAR	94	38m
INC-24815	High	OAuth consent grant to unknown 3rd party app	Investigating	T1528	2	Priya S.	82	1h 14m
INC-24814	High	Beaconing to newly registered domain — 4 endpoints	Active	T1071.001	4	Unassigned	78	1h 42m
INC-24813	Medium	Anomalous S3 GetObject burst from EC2 instance	Investigating	T1530	1	Marco V.	64	2h 08m
INC-24812	Medium	Impossible travel — VP Sales	Waiting	T1078.004	1	Alex R.	58	3h
INC-24811	Low	MFA fatigue attempt blocked	Resolved	T1621	1	Auto-SOAR	32	5h
INC-24810	High	Privilege escalation via CVE-2024-38063	Contained	T1068	2	Priya S.	84	6h

Reconstructed attack chain

14:22:14Aegis correlated 6 alerts into INC-24817
Cross-signal fusion · confidence 0.96
14:22:09Suspicious Kerberos ticket request (svc-backup → DC-01)
Windows Security · Event 4769
14:21:58SMB write to ADMIN$ share on 4 hosts
Zeek smb.log
14:21:41Impossible travel: svc-backup signed in from 2 continents in 3m
Okta System Log
14:21:03Password sprayed against svc-backup account (37 attempts)
Okta · 37 events
14:19:11Initial credential access from 185.212.98.14 (Bulletproof host)
Cloudflare · Bot fight

Aegis SOAR · pre-approved