INCIDENT CR-001

Suspicious activity detected

Fictional enterprise security scenario

HIGH PRIORITY

INCIDENT CONTEXT

Affected assets3

Evidence items7

Current statusInvestigating

Workstation WS-014Unusual outbound connection

Server SRV-02Authentication anomaly

Account user-17Unexpected privilege activity

AI ANALYST

✦

Analysis ready

Three related indicators suggest a coordinated incident. Further investigation is recommended before containment.

RECOMMENDED NEXT STEP Create a containment action draft

HUMAN APPROVAL QUEUE

No pending action. Ask the agent to create a recommendation.

INCIDENT REPORT

Report will appear here after analysis.

Contain affected assets