baz threat dashboard

Out-of-hours badge grant for EMP-7734 at LON-HQ, then Mass file access on finance share (Microsoft Purview) 15 minutes later on a host owned by the same identity or site (joined on identity).

Δ 15m · high

Badge grant for EMP-4821 at SLO-DC1 door D-14, then Successful VPN authentication (Cisco Secure Access) for the same identity from an IP geolocating to Sofia, Bulgaria 41 minutes later — 2,045km apart, physically impossible.

Δ 41m · medium

Badge denied at comms room door (Gallagher Command Centre) at a comms room in SLO-DC1, then Unknown MAC address on comms room switch port (Cisco ISE) on an asset in the same room 8 minutes later — consistent with a physical network tap.

Δ 8m · medium