CYBRARY Incidents
Layout tabs over one incident: fields on the left, indicators extracted by the playbook, the Work Plan for tasks, and the War Room as the running record.
3 open incidents · sorted by severity then SLA pressure
| Reference | Summary | Severity | Status | Owner | Response SLA | Indicators |
|---|---|---|---|---|---|---|
| CASE-2042 | Suspicious LSASS access on ENG-4471 | critical | containment | d.ilves | met | 1 |
| CASE-2041 | Credential-harvest phish reported by Finance | high | investigating | a.okafor | met | 2 |
| CASE-2043 | Public read grant added to finance evidence bucket | medium | triage | unassigned | at-risk | 1 |
CASE-2042 Suspicious LSASS access on ENG-4471
Kestrel Response flagged a handle open against lsass.exe (GrantedAccess 0x1010, high integrity, SeDebugPrivilege held) from an unsigned binary in a user temp path.
critical
containment
respond met · 3m ago
resolve pending · in 42m
credential-dumping
T1003.001
- Queue
- Tier 2 — Endpoint
- Owner
- d.ilves
- Opened
- 18m ago
- Last update
- 3m ago
- Open tasks
- 2
Indicators extracted
- hostENG-4471suspicious
- file-hash9f2c1a70b4d8e5f3a61c0d94ee772b18malicious
- processC:\Users\r.hale\AppData\Local\Temp\svc-helper.exemalicious
A workflow reads case severity as ${case.severity} in this profile — same field, three notations.