Structural Application HostCasebook · Cybersecurity Edition
Live
Cybersecurity
security-agent · Agent A · v1.4
Runtime V3 · r44 · splunk-cim
Structural0
Neural0
Constitution v3

Runtime lifecycle

Runtime eventevt_bf_001
Adaptersplunk-cim · v2.1
Baselinebusiness-hours · v4
Knowledge overlayacme-corp · v7
Agentsecurity-agent · A · v1.4
Artifactsha256:abc123…4f2a
91%Casebook explained 91% of this evidence · 3 items to review.

567 of 623 events explained · 3 in Needs Review

Constructed entities

Hosts
APP-011×
WIN-DC011×
Users
svc-backup1×
alice2×
IP addresses
203.0.113.142×

Mapping coverage

Recognized fields

source_ip source_ip
timestamp observed_at
user user_identity
event_code event_code
host host
process process

Unknown fields · residual

usr_id → user_identity
token_exchange → authentication_method
Live evidence stream Streaming
Time (UTC)EventDetailsLocationRisk
19:59:28App MessageConfig reloadedCorporateInfo
19:58:00Process executionoutlook.exeCorporateInfo
19:57:40Successful sign-inSuccessful logon for bobLAPTOP-B123Info
19:56:15Network ErrorTemporary network failure — connection resetCorporateLow
19:55:57Outbound connectionOutbound HTTPS to office365.comWIN-DC01Info
19:53:04Process executionNon-critical process exit code 1CorporateLow
19:51:30Successful sign-inSuccessful logon for erinLAPTOP-B123Info
19:48:37Privileged accountGroup policy object queriedCorporateInfo
19:48:02Scheduled TaskScheduled task warning — ran longer than expectedCorporateMedium
19:47:11Process executionoutlook.exeCorporateInfo
19:46:31Process executionpowershell.exeCorporateInfo
19:45:00Successful sign-inSuccessful logon for aliceLAPTOP-B123Info
19:44:39App MessageMetrics flushedCorporateInfo
19:44:21App MessageCache refreshedCorporateInfo
19:42:18Outbound connectionOutbound HTTPS to office365.comAPP-01Info
19:42:01App MessageRetry succeeded after transient errorCorporateInfo
19:41:41Sensitive fileFile read: \\fileshare\dept\roadmap.pptxCorporateInfo
19:40:43Successful sign-inService account svc-backup authenticatedAPP-01Info
19:40:04Scheduled TaskScheduled task warning — ran longer than expectedCorporateMedium
19:38:37Successful sign-inAuth via legacy gateway (unmapped fields)APP-01Info
19:35:55Health CheckHealth check OK — /healthz 200CorporateInfo
19:33:47Successful sign-inSuccessful logon for bobAPP-01Info
19:33:25Privileged accountGroup policy object queriedCorporateInfo
19:31:25Outbound connectionOutbound HTTPS to github.comAPP-01Info
19:30:57Scheduled TaskScheduled task "NightlyBackup" completedCorporateInfo
19:29:48App ErrorApplication timeout after 30sCorporateMedium
19:29:32Successful sign-inSuccessful logon for carolAPP-01Info
19:27:54Sensitive fileFile read: \\fileshare\dept\report.xlsxCorporateInfo
19:27:01Successful sign-inSuccessful logon for daveWIN-DC01Info
19:26:04Process executionchrome.exeCorporateInfo
19:24:04Successful sign-inSign-in for alice asserted by partner gateway 198.51.100.203 (unmapped assertion)WIN-DC01Info
19:22:44Successful sign-inSign-in for alice asserted by partner gateway 198.51.100.203 (unmapped assertion)WIN-DC01Info
19:22:29Successful sign-inSuccessful logon for daveWIN-DC01Info
19:20:59Successful sign-inSuccessful logon for aliceWIN-DC01Info
19:20:43Successful sign-inService account svc-backup authenticatedAPP-01Info
19:20:29Successful sign-inSign-in for alice asserted by partner gateway 198.51.100.203 (unmapped assertion)WIN-DC01Info
19:19:25Outbound connectionOutbound HTTPS to github.comLAPTOP-B123Info
19:18:32Successful sign-inSign-in for alice asserted by partner gateway 198.51.100.203 (unmapped assertion)WIN-DC01Info
19:16:27Successful sign-inSign-in for alice asserted by partner gateway 198.51.100.203 (unmapped assertion)WIN-DC01Info
19:16:11Privileged accountUser added to group "Domain Admins"CorporateHigh