Every knowledge gap across all cases, in one place. Teach it once — it becomes known everywhere.
14 to teach
Cross-user propagation pattern not recognized (potential worm behavior)
Potential pattern: Token Usage Pattern — how authorization tokens are granted and reused
Potential pattern: Workspace Access Pattern — access spanning multiple tenants
Potential pattern: Policy Override Pattern — grants that bypass the standard policy
Post-exploitation lateral-movement pattern not recognized
A successful login followed a burst of failures from the same source, then that account ran a privileged process, read a sensitive file, and was added to Domain Admins. The individual events are recognized, but this cross-stage sequence is not yet a known pattern.
Unknown field: usr_id
Unmapped vendor event: VendorX token_exchange
Unknown field: pid_parent
Unknown vocabulary: actor_ref
Unknown vocabulary: workspace_key
Unknown vocabulary: object_guid
Unknown vocabulary: policy_token
Unknown field: tcp_flags