Runtime lifecycle
User: aliceIP: 203.0.113.14
Activation trace · why this concept fired
index=* sourcetype=* action=success user="alice" src="203.0.113.14" | transaction user maxpause=6m | where eventcount > 20 AND match(action, "failure") AND match(action, "success")
This would be wrong if
- This would be wrong if the successful login was alice actually logging in from a VPN endpoint that happens to share the source IP.
- This would be wrong if the timing correlation is coincidental (verify with additional context).
Unknowns · concept gaps
A successful login followed a burst of failures from the same source, then that account ran a privileged process, read a sensitive file, and was added to Domain Admins. The individual events are recognized, but this cross-stage sequence is not yet a known pattern.
Affects 47 events · 2 findings
Selected recommendation
Escalate for analyst review
High-risk signals align with known credential-abuse patterns. The agent is not permitted to disable the account — the response action is simulated pending analyst validation.
Within policy · no autonomous action