Events (7d)42
320
in stream
Failures6%
65
FAILURE + DENY
High-risk findings2
19
score ≥ 55
Retention gaps1
15
under floor / gaps
Sources healthy1
6/24
validation on
Integrity pass1.2pp
72%
digest chain
Ingested vs failed
Northline Systems · daily
IngestedFailed
Mon Cert rotation windowWed Off-hours admin spikeThu Retention policy reviewSat Digest gap repaired
Events by severity
320 stream
135
info
86
notice
55
warning
44
error
High-score anomalies
score ≥ 55
| Finding | Actor | Score |
|---|---|---|
| Service principal spike | Indie Drew | 80 |
| Impossible travel pattern | Samir Patel | 66 |
| Off-hours admin burst | svc-ellis45 | 66 |
| Bulk data export | svc-dana81 | 64 |
| Service principal spike | svc-deploy | 60 |
| Log delete attempt | Alex Zahn | 60 |
| Service principal spike | Samir Patel | 60 |
Noisiest actors
by event count
| Actor | Events |
|---|---|
| nightly-sync | 8 |
| bg-indie54 | 7 |
| svc-dana81 | 7 |
| svc-deploy | 7 |
| Marcus Chen | 7 |
| Quinn Cole | 7 |
| Sky Cole | 6 |
| Wei Chen | 6 |
Assurance health
integrity × source coverage
47
score
Integrity pass72%
Sources healthy6/24
Admin-class events124
High-risk findings19
Sources by kind
24 trails
4
Cloud API
4
Identity
3
Code platform
6
SaaS
5
Endpoint
2
Network
Root-caused alerts
symptom → cause → fix
Do this next
scored from anomaly × retention risk
#188
Raise identity-prod retention to 90d
Compliance floor shortfall 45d
impact 72
#284
Investigate Wei Chen off-hours admin
9 events · policy + membership
impact 78
#376
Enable WORM on saas-crm
Delete attempt already denied once
impact 70
#471
Close endpoint-fleet digest gap
2d gap · validation on
impact 58