41,208
Credential stuffing against the VPN portal. 4,102 attempts from 812 addresses, 3 accounts locked. Rate limit raised and geo-fence applied.
Lateral movement on FRA-APP-07. SMB enumeration followed by a scheduled task creation. Host isolated automatically, image preserved.
Unusual egress to a newly registered domain from a build agent. 42 MB over 9 minutes. Under review by tier 2.
Phishing campaign contained. 214 messages recalled, 0 clicks recorded.