SIEM AI-014 · Anomalous record access by service principal
svc-support-agent read platinum account NW-PLAT-0042 outside any ticket context, then made an outbound call to returns-verify.example. You are the AI security engineer on shift.
Agent run trace · conversation c-8841
One user sentence, end to end. Malicious spans are marked only after you expand them — the point of the exercise is reading the provenance yourself.
CYBRARY