Security operations.
Fourteen alerts open, two of them critical. The estate is operational.
Active incidents
The incident is the object an operator works with. Alerts roll up into it; it does not roll up into a chart.
State
Synthetic- Open alerts
- 14 two critical
- Time to acknowledge
- 4 min rolling seven days
- Monitored assets
- 1,046 across four sites
The spike eight hours ago is the credential-reuse cluster that became INC-2418. Volume has since returned to its usual band.
Scope of this pilot
What is real on this page and what is not›
Real: the interface and the operator workflow it implies — alert, correlation, incident, response — with keyboard navigation, focus states and reduced-motion support.
Not real: every alert, asset, hostname and count. No telemetry is collected and no system is monitored. No offensive capability is modelled here, and none is planned; remediation in the product design is an authorised workflow that a human approves.
Credential reuse across sites.
One service credential authenticated at two sites four minutes apart, which the distance makes impossible.
What happened
A single sign-in is not evidence. The pair is.
Affected
Response
What the operator can do, and what requires approval›
Isolating the account is proposed rather than executed. In the product design an action that changes the estate is a request that a named person approves, and the approval is part of the incident record.
Nothing on this page performs an action. There is no estate behind it.
Availability and capacity.
Four sites reachable, one transit link degraded. The degraded link is the only item that is not routine.
Segments
Availability, 30 daysInventory is the precondition for detection.
An asset nobody knows about cannot be defended, which is why discovery is a product surface rather than a setup step.
Coverage
Agent coverageEdge and operational technology sit lowest by a wide margin. That is the usual shape in practice, and it is where an attacker looks first.