key,ticket_type,summary,details,category,agent,requester_email,team,sla,priority,parent_key,asset_keys,target_date,CFExternallyReportable,CFPotentialAdverseImpact,CFPAINEvaluationNotes,CFIncidentStartedAt,CFIncidentDetectedAt,CFEvaluationCompletedAt,CFReportedTo,CFInitialReportSentAt,CFOngoingReportLastSentAt,CFRecoveryCompletedAt,CFFinalReportSentAt,CFFunctionalImpact,CFRecoveryPlan,CFAffectedAgencies,CFObservedActivity,CFResponseRecoveryActivities,CFRelatedCVEs,CFInternalIndicators,CFExternalIndicators,CFMITRETactics,CFMITRETechniques,CFMITRESubtechniques,CFDetectionSource,CFrootcauses,CFLessonsLearned,CFCorrectiveActions
alert-ssh-brute,Alert,GuardDuty: SSH brute force against the bastion,"Repeated failed SSH authentication attempts against the management bastion from a single source inside the VPC, starting 2026-08-04T04:02:00 and detected at 04:12:00. No successful authentication observed. Alert type carries no Evaluation field group; PAIN assessment happens on escalation to an Incident.",Alerts and Incidents>Security>Suspicious Activity,Demo Account,,Continuous Monitoring,Incident SLA,Low,,bastion,,,,,,,,,,,,,,,,,,,Repeated sshd authentication failures from one private-subnet source against the bastion.,,Credential Access,T1110,,AWS GuardDuty,,,
alert-inference-anomaly,Alert,Defender: anomalous inference API request volume,"Inference API request volume from a single tenant exceeded its established baseline by a wide margin over a short window, starting 2026-08-05T13:20:00 and detected at 13:40:00, consistent with either a misconfigured client or scripted enumeration. All requests authenticated and tenant-scoped; no cross-tenant retrieval observed.",Alerts and Incidents>Security>Suspicious Activity,Demo Account,,Continuous Monitoring,Incident SLA,Low,inc-tenant-enum,alb;inference,,,,,,,,,,,,,,,,,,,Inference request rate for one tenant far above its rolling baseline; all requests authenticated and tenant-scoped.,,Discovery,,,Microsoft Defender for Cloud,,,
inc-unauth-access,Incident,Unauthorized access attempt on the management tier,Correlated from the bastion brute-force alert. Investigation confirmed repeated unauthorized authentication attempts against the management tier with no successful access and no agency data involvement.,Alerts and Incidents>Security>Unauthorized Access,Demo Account,,Continuous Monitoring,Incident SLA,Medium,alert-ssh-brute,bastion,,No,PAIN3,"No successful authentication, no agency data accessed, no customer impact. Assessed as PAIN3 on the basis of attempted privileged access to the management tier.",2026-08-04T04:02:00,2026-08-04T04:12:00,,,,,,,,,,Sustained authentication failures from a single private-subnet source against the management bastion over roughly ten minutes.,,,sshd authentication failures against the bastion; CloudTrail shows no corresponding SSM session establishment.,,Credential Access,T1110,,AWS GuardDuty correlated with CloudTrail,,,
alert-waf-probe,Alert,WAF: blocked probing burst against the public API,"AWS WAF blocked a burst of malformed and enumeration-shaped requests against the public REST API, authenticated with the same tenant's tokens as the concurrent inference-volume anomaly, starting 2026-08-05T13:05:00 and detected at 13:15:00. All requests blocked at the edge; nothing reached the application tier. Alert type carries no Evaluation field group; PAIN assessment happens on the correlating Incident.",Alerts and Incidents>Security>Suspicious Activity,Demo Account,,Continuous Monitoring,Incident SLA,Low,inc-tenant-enum,alb,,,,,,,,,,,,,,,,,,,WAF block-rule hit rate spike for one tenant's tokens against the public API endpoints.,,Reconnaissance,T1595,,AWS WAF,,,
inc-tenant-enum,Incident,Suspected scripted enumeration by a single tenant,"Correlated from TWO alerts on the same tenant and window (N:1): the Defender inference-volume anomaly and the WAF probing burst. Investigation attributes both to a scripted client run under one tenant's credentials probing API surface and inference behavior. All activity authenticated and tenant-scoped; no cross-tenant access, no agency data exposure, service availability unaffected.",Alerts and Incidents>Security>Suspicious Activity,Demo Account,,Continuous Monitoring,Incident SLA,Medium,,alb;inference,,No,PAIN3,"Authenticated, tenant-scoped scripted activity with no cross-tenant access and no availability impact. Assessed PAIN3 for deliberate probing of the service surface by a customer credential set.",2026-08-05T13:05:00,2026-08-05T13:40:00,,,,,,,,,,Coordinated WAF-blocked probing and anomalous inference request volume from one tenant's credentials over a 35-minute window.,,,Correlation on tenant id across WAF block logs and inference audit records; no cross-tenant retrieval in the vector-store audit trail.,,Discovery,T1580,,Microsoft Defender for Cloud correlated with AWS WAF,,,
