Audit Review Portal
Immutable event log with AI intent attribution.
APPEND-ONLY STORE — TAMPER EVIDENT
Events Today
0
Events (7 Days)
0
Events (30 Days)
20
20 entries
| Mar 11, 2026, 11:18:00 AM | hunter.zhao | QUERY_EXECUTED | UBUNTU_SERVER_PROD.lime | L5 | d8e1f4a7c0d3… | — | aud-011 |
| Mar 11, 2026, 11:15:00 AM | hunter.zhao | YARA_SCAN_RUN | UBUNTU_SERVER_PROD.lime | L5 | c5d8e1f4a7c0… | YARA rule SuspiciousShellcode executed against UBUNTU_S… | aud-010 |
| Mar 11, 2026, 11:02:00 AM | hunter.zhao | IMAGE_UPLOAD | UBUNTU_SERVER_PROD.lime | L5 | f91c3a2b5d8e… | — | aud-009 |
| Mar 11, 2026, 10:45:00 AM | analyst.park | IMAGE_UPLOAD | MACBOOK_EXEC_07.mem | L3 | b7d4e2c1f0a9… | — | aud-008 |
| Mar 11, 2026, 10:02:00 AM | analyst.chen | FINDING_RESOLVED | Stale Authentication Token | WIN_DESKTOP_42_20260311.raw | L3 | d3e6f9b2c5d8… | — | aud-018 |
| Mar 11, 2026, 09:28:00 AM | analyst.chen | FINDING_ESCALATED | Unsigned Kernel Driver Loaded | WIN_DESKTOP_42_20260311.raw | L3 | 9c0d3e6f9b2c… | — | aud-007 |
| Mar 11, 2026, 09:25:00 AM | analyst.chen | FINDING_VIEWED | Hidden Process Detected | WIN_DESKTOP_42_20260311.raw | L3 | — | — | aud-006 |
| Mar 11, 2026, 09:20:00 AM | system.ai | FINDING_CREATED | Unsigned Kernel Driver Loaded | WIN_DESKTOP_42_20260311.raw | L3 | e6f9b2c5a8d1… | Unsigned kernel driver maldrv.sys matches Lazarus Group… | aud-005 |
| Mar 11, 2026, 09:19:00 AM | system.ai | FINDING_CREATED | Suspicious Memory Injection | WIN_DESKTOP_42_20260311.raw | L3 | b2c5d8e1f4a7… | Shellcode injection detected. Entropy 7.98. YARA rule S… | aud-004 |
| Mar 11, 2026, 09:18:00 AM | system.ai | FINDING_CREATED | Hidden Process Detected | WIN_DESKTOP_42_20260311.raw | L3 | 7d3f1a9c2b8e… | DKOM rootkit indicator confirmed via EPROCESS/PspCidTab… | aud-003 |
| Mar 11, 2026, 09:12:45 AM | system.ai | AI_ANALYSIS_START | WIN_DESKTOP_42_20260311.raw | L3 | — | Initiating volatility3 analysis pipeline with plugins: … | aud-002 |
| Mar 11, 2026, 09:12:00 AM | analyst.chen | IMAGE_UPLOAD | WIN_DESKTOP_42_20260311.raw | L3 | a3f2c8d4e1b0… | — | aud-001 |
| Mar 11, 2026, 08:15:00 AM | mgr.williams | SLA_OVERRIDE | CASE-2024-038 | L4 | f4a7c0d3e6f9… | — | aud-015 |
| Mar 11, 2026, 08:00:00 AM | mgr.williams | CASE_REVIEWED | CASE-2024-042 | L4 | — | — | aud-014 |
| Mar 11, 2026, 07:30:00 AM | ciso.anderson | AUDIT_EXPORT | COMPLIANCE_REPORT_FEDRAMP | L4 | e6f9b2c5d8e1… | — | aud-019 |
| Mar 10, 2026, 04:20:00 PM | analyst.park | FINDING_ESCALATED | Pass-the-Hash Credential Theft | WIN_WORKSTATION_HR.raw | L3 | e1f4a7c0d3e6… | — | aud-013 |
| Mar 10, 2026, 04:15:00 PM | analyst.park | FINDING_VIEWED | Pass-the-Hash Credential Theft | WIN_WORKSTATION_HR.raw | L3 | — | — | aud-012 |
| Mar 10, 2026, 01:10:00 PM | hunter.zhao | FINDING_ESCALATED | DCSync Attack Detected | WIN_DC01_DOMAINCTRL.raw | L5 | c0d3e6f9b2c5… | — | aud-017 |
| Mar 10, 2026, 01:05:00 PM | system.ai | FINDING_CREATED | DCSync Attack Detected | WIN_DC01_DOMAINCTRL.raw | L5 | a7c0d3e6f9b2… | DCSync attack pattern detected. Non-DC host performing … | aud-016 |
| Mar 10, 2026, 09:00:00 AM | mgr.williams | ROLE_GRANT | analyst.chen → tier2 | L2 | f9b2c5d8e1f4… | — | aud-020 |