Multiple failed admin logins followed by success on web03
Source: 10.0.8.44 · 2026-04-02 03:47:12 UTC
No whitelist match for the source of these attempts. Investigate web03's access logs for the window 2026-04-02 03:00-04:00 UTC to confirm and identify the attacking IP.
Unusual login time for user r.patel
Source: 192.0.2.31 · 2026-04-02 01:10:05 UTC
Confirmed on-call rotation for this user this week; after-hours access is expected.
Large file download from finance-srv
Source: 10.0.2.20 · 2026-04-02 06:00:00 UTC
Matches the scheduled monthly reporting export job; authorized and expected at this time.
New device registered for user t.nguyen
Source: 192.0.2.77 · 2026-04-02 09:15:40 UTC
Employee confirmed a new laptop was provisioned via IT ticket #4521 this week.
Repeated DNS queries to an unusual TLD
Source: 10.0.1.9 · 2026-04-02 05:30:00 UTC
Domain matches a known SaaS vendor's infrastructure, verified against vendor documentation.