attack_type: normal

label: normal

recommended_actions: Retain as baseline context unless correlated with another alert.

risk_level: low

description: Session contains actions that often deserve identity-security review.

reason: Sensitive identity, logging, data, or infrastructure action.

workflow_uses:
SOC triage
identity-control review
incident reconstruction support
red-team or tabletop evaluation


action: <BLACKOUT>

label: attack

recommended_actions: Open an identity-security triage item for this session.

recommended_actions: Review the principal, source IP category, user agent, and target resources.

recommended_actions: Check whether logging gaps, suppressed telemetry, or event-delivery delays explain the missing segment.

recommended_actions: Correlate the source network with VPN, geolocation, and known corporate egress paths.

risk_level: high

description: Session contains intentionally missing or blacked-out event slots.

description: Principal naming suggests an unknown, suspicious, or stolen-token context in the example data.

description: Session includes access from an external or Tor-like source category.