{ "exported_at": "2026-09-06T06:48:33.422707+00:00", "company": "ProPera Online", "contact": "info@propera.online", "subject": { "username": "admin", "email": "admin@propera.local", "display_name": "Administrator", "role": "administrator", "language": "en", "active": true, "created_at": "2026-08-18T20:07:49.653934", "last_login_at": "2026-09-06T06:48:33.025904" }, "workspace": { "id": 1, "name": "ProPera Demo", "slug": "propera-demo", "plan": "basic", "status": "active", "country": "NZ", "industry": "healthcare", "created_at": "2026-08-18T20:07:48.032803" }, "audit_log_entries": [ { "timestamp": "2026-08-21T03:49:46.035768", "action": "auth.login", "category": "auth", "result": "success", "details": { "method": "password" } }, { "timestamp": "2026-08-21T04:18:47.962719", "action": "approval.request.run_av_scan", "category": "approval", "result": "pending", "details": { "approval_id": "APR-AB762AEAF1", "policy": "manual", "action_id": "ACT-887944DF73" } }, { "timestamp": "2026-08-21T04:19:04.739059", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block Office applications from creating executable content", "rule_id": "3b576869-a4ec-4529-8536-b80a7769e899", "mode": "disabled", "device_group": "All devices", "approval_id": "APR-849EECA7BD" } }, { "timestamp": "2026-08-21T04:19:13.385557", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-21T04:26:35.759208", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-010", "approval_id": "APR-FF703B5E79", "score_impact": 4.7 } }, { "timestamp": "2026-08-21T04:26:41.222112", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-009", "approval_id": "APR-85ACE9AF20", "score_impact": 5.2 } }, { "timestamp": "2026-08-21T04:26:45.029292", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-006", "approval_id": "APR-E4832AAA71", "score_impact": 7.2 } }, { "timestamp": "2026-08-21T04:26:58.526956", "action": "integration.test.mde", "category": "integrations", "result": "failure", "details": { "ok": false, "result": { "connected": false, "message": "Microsoft Entra ID is not configured for this tenant. Set AZURE_TENANT_ID, AZURE_CLIENT_ID and a credential (or configure the tenant in Settings).", "demo": false } } }, { "timestamp": "2026-08-21T04:47:26.996101", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-02517328D5", "reason": "" } }, { "timestamp": "2026-08-21T04:48:10.457214", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-17C9B292C2", "reason": "ok for testing" } }, { "timestamp": "2026-08-21T04:48:42.281072", "action": "pipeline.enrich", "category": "automation", "result": "success", "details": { "match_count": 0, "verified_matches": [], "external_count": 0, "external_ips": [] } }, { "timestamp": "2026-08-21T04:48:49.801723", "action": "pipeline.investigate", "category": "automation", "result": "success", "details": { "confidence": "CONFIRMED" } }, { "timestamp": "2026-08-21T04:51:23.134087", "action": "tenant.settings_updated", "category": "settings", "result": "success", "details": { "tenant": "propera-demo", "configured": false, "sso": false, "branding": true, "compliance": false } }, { "timestamp": "2026-08-21T04:52:06.621893", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-21T04:52:07.937417", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-46B5DDBF05", "policy": "ai-auto-remediation", "action_id": "ACT-8890756BB4" } }, { "timestamp": "2026-08-21T04:52:07.965312", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-8588C1179C", "policy": "ai-auto-remediation", "action_id": "ACT-8696838532" } }, { "timestamp": "2026-08-21T04:52:07.992090", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-8FDA78679B", "policy": "ai-auto-remediation", "action_id": "ACT-347944B5F8" } }, { "timestamp": "2026-08-21T04:52:08.019984", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-11165F7A5B", "policy": "ai-auto-remediation", "action_id": "ACT-E1B7FC2245" } }, { "timestamp": "2026-08-21T04:52:08.036873", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-21T04:52:23.827077", "action": "sentinel.incident.created", "category": "sentinel", "result": "success", "details": { "sentinel_incident_id": "propera-1003", "demo": true } }, { "timestamp": "2026-08-21T04:54:07.977858", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-E50E18D595", "policy": "manual", "action_id": "ACT-A29428B523" } }, { "timestamp": "2026-08-21T04:54:19.941279", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block untrusted and unsigned processes that run from USB", "rule_id": "b2b3f03d-6a14-4eb2-aa82-1b9222d4bcd9", "mode": "block", "device_group": "All devices", "approval_id": "APR-B4ADB8891D" } }, { "timestamp": "2026-08-21T05:17:01.329594", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-21T05:17:02.411656", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-21T05:17:21.699983", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-21T05:17:31.161092", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-5ED5DF84D8", "policy": "ai-auto-remediation", "action_id": "ACT-2FE06619E1" } }, { "timestamp": "2026-08-21T05:17:31.199737", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-0FBE6B4D1B", "policy": "ai-auto-remediation", "action_id": "ACT-EA8EDAE3AD" } }, { "timestamp": "2026-08-21T05:17:31.227290", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-EC12CED421", "policy": "ai-auto-remediation", "action_id": "ACT-5B619549B1" } }, { "timestamp": "2026-08-21T05:17:31.253899", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-568C36114E", "policy": "ai-auto-remediation", "action_id": "ACT-9B43CB4258" } }, { "timestamp": "2026-08-21T05:17:31.264106", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-21T05:17:54.166017", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-001", "approval_id": "APR-B5E274E9E4" } }, { "timestamp": "2026-08-21T05:19:46.181070", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-B5E274E9E4", "reason": "" } }, { "timestamp": "2026-08-21T05:28:53.501065", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-568C36114E", "reason": "" } }, { "timestamp": "2026-08-21T05:28:57.127026", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-EC12CED421", "reason": "" } }, { "timestamp": "2026-08-21T05:29:14.866091", "action": "pipeline.verify", "category": "automation", "result": "pending", "details": { "devices_healthy": true, "actions_completed": false, "exposure_reduced": true } }, { "timestamp": "2026-08-21T05:29:18.885714", "action": "pipeline.enrich", "category": "automation", "result": "success", "details": { "match_count": 0, "verified_matches": [], "external_count": 0, "external_ips": [] } }, { "timestamp": "2026-08-21T07:26:41.752426", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-21T07:26:46.675128", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-21T07:27:02.050144", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-21T07:27:05.335453", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-75DA552720", "policy": "ai-auto-remediation", "action_id": "ACT-39A9D076EB" } }, { "timestamp": "2026-08-21T07:27:05.385645", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-B0F9E3F9AD", "policy": "ai-auto-remediation", "action_id": "ACT-86A2039BC9" } }, { "timestamp": "2026-08-21T07:27:05.435526", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-B039A846B5", "policy": "ai-auto-remediation", "action_id": "ACT-8936FE4F95" } }, { "timestamp": "2026-08-21T07:27:05.484869", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-4361A5E8D4", "policy": "ai-auto-remediation", "action_id": "ACT-8FEBFFE237" } }, { "timestamp": "2026-08-21T07:27:05.546842", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-21T08:37:32.055476", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-21T09:39:51.514832", "action": "vulnerability.remediation.requested", "category": "vulnerability", "result": "pending", "details": { "cve": "CVE-2024-3094", "approval_id": "APR-C3006B461A", "method": "" } }, { "timestamp": "2026-08-21T09:40:00.411184", "action": "remediation.denied_registry.apply_recommendation", "category": "remediation", "result": "registry_required", "details": { "reason": "Secure Now: Remove deprecated SMBv1 protocol", "recommendation_id": "rec-006", "vulnerability_id": "", "message": "This action requires a Windows registry change. ProPera Online does not modify the registry - an Administrator or Global Administrator must apply this change through their managed channel (Intune, Group Policy or direct admin access). The automated action has been denied." } }, { "timestamp": "2026-08-21T09:40:32.896894", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-F861636DEC", "reason": "" } }, { "timestamp": "2026-08-21T11:29:09.295808", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-21T11:50:30.483598", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-21T11:52:26.233785", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-21T11:52:30.149467", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-21T12:36:47.100787", "action": "tenant.settings_updated", "category": "settings", "result": "success", "details": { "tenant": "propera-demo", "configured": false, "sso": false, "branding": true, "compliance": false } }, { "timestamp": "2026-08-21T17:17:20.677297", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-21T18:26:44.481184", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "provider": "stripe", "session": "demo-standard", "order": "" } }, { "timestamp": "2026-08-21T20:32:11.657087", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "demo", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-08-21T20:46:27.504278", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "provider": "paypal", "session": "demo-standard", "order": "" } }, { "timestamp": "2026-08-21T21:57:12.613878", "action": "config.test.cti", "category": "configuration", "result": "success", "details": { "checks": { "sources": { "label": "10 source(s) healthy", "ok": true, "status": "passed" } }, "message": "Connection successful" } }, { "timestamp": "2026-08-22T01:26:28.033234", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-22T01:26:33.118033", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-22T01:26:40.544810", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-22T01:26:41.711547", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-153D1AE80D", "policy": "ai-auto-remediation", "action_id": "ACT-EEF3E375D1" } }, { "timestamp": "2026-08-22T01:26:41.739324", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-EFB649BDAC", "policy": "ai-auto-remediation", "action_id": "ACT-CB4C51C824" } }, { "timestamp": "2026-08-22T01:26:41.769208", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-CB5ADB40FE", "policy": "ai-auto-remediation", "action_id": "ACT-FFF237DF29" } }, { "timestamp": "2026-08-22T01:26:41.795854", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-369DCFE3AA", "policy": "ai-auto-remediation", "action_id": "ACT-F45C3DE6D3" } }, { "timestamp": "2026-08-22T01:26:41.806421", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-22T01:26:46.915132", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-22T01:27:03.417098", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-98A13F887F", "policy": "manual", "action_id": "ACT-5E00F7D944" } }, { "timestamp": "2026-08-22T01:27:03.432957", "action": "intelligence.contain", "category": "incident", "result": "success", "details": { "devices": [ "corp-wks-1187" ], "statuses": [ "awaiting_approval" ] } }, { "timestamp": "2026-08-22T01:27:28.881244", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-8FCC71C908", "policy": "manual", "action_id": "ACT-ADF41F2D1D" } }, { "timestamp": "2026-08-22T01:27:51.556344", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-22T01:27:57.518463", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-22T02:51:23.791849", "action": "approval.request.run_av_scan", "category": "approval", "result": "pending", "details": { "approval_id": "APR-4656FBD171", "policy": "manual", "action_id": "ACT-21CB27E9F4" } }, { "timestamp": "2026-08-22T05:40:21.935056", "action": "pipeline.verify", "category": "automation", "result": "pending", "details": { "devices_healthy": true, "actions_completed": false, "exposure_reduced": true } }, { "timestamp": "2026-08-22T05:40:58.434729", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-002", "approval_id": "APR-3F167FE046", "score_impact": 12.0 } }, { "timestamp": "2026-08-22T05:43:49.064685", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-002", "approval_id": "APR-82E1EF9709", "score_impact": 12.0 } }, { "timestamp": "2026-08-22T05:50:16.919080", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-22T05:50:25.617857", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-22T05:50:35.060563", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Increase monitoring on affected devices.", "2. Re-assess after hunting results." ], "actions": [] } }, { "timestamp": "2026-08-22T06:06:32.548701", "action": "automation.Persistence & Defense Evasion Response", "category": "automation", "result": "matched", "details": { "rule": "Persistence & Defense Evasion Response", "trigger": "incident", "matched_conditions": [ { "field": "mitre_techniques", "operator": "in", "value": [ "T1055", "T1547", "T1547.001", "T1053.005", "T1484", "T1136", "T1505.003" ] } ], "mode": "approval_required" } }, { "timestamp": "2026-08-22T06:06:32.633603", "action": "approval.request.investigate", "category": "approval", "result": "pending", "details": { "approval_id": "APR-814FFDCBD9", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-F1EDEA3E04" } }, { "timestamp": "2026-08-22T06:06:32.682937", "action": "approval.request.collect_investigation_package", "category": "approval", "result": "pending", "details": { "approval_id": "APR-CCD5DCB828", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-734776398E" } }, { "timestamp": "2026-08-22T06:06:32.738853", "action": "approval.request.run_hunting_queries", "category": "approval", "result": "pending", "details": { "approval_id": "APR-6341FAAAEE", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-F3C36780B2" } }, { "timestamp": "2026-08-22T06:06:32.776738", "action": "approval.request.notify_soc", "category": "approval", "result": "pending", "details": { "approval_id": "APR-FEFE3E7D28", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-56A360DD01" } }, { "timestamp": "2026-08-22T06:06:32.850111", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-DBE1ABE62C", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-8629B2DC6F" } }, { "timestamp": "2026-08-22T06:06:32.950826", "action": "automation.High Risk Device SOC Alert", "category": "automation", "result": "matched", "details": { "rule": "High Risk Device SOC Alert", "trigger": "incident", "matched_conditions": [ { "field": "severity", "operator": "in", "value": [ "Critical", "High", "Medium" ] }, { "field": "device_risk", "operator": "eq", "value": "High" } ], "mode": "automatic" } }, { "timestamp": "2026-08-22T06:06:33.076584", "action": "remediation.notify_teams", "category": "remediation", "result": "succeeded", "details": { "policy": "High Risk Device SOC Alert", "run_id": "RUN-2148F9F5B7", "action_id": "ACT-A254C8EBE1" } }, { "timestamp": "2026-08-22T06:06:33.158934", "action": "remediation.update_incident", "category": "remediation", "result": "succeeded", "details": { "policy": "High Risk Device SOC Alert", "run_id": "RUN-2148F9F5B7", "action_id": "ACT-B359039206" } }, { "timestamp": "2026-08-22T06:07:03.528113", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block Office applications from creating executable content", "rule_id": "3b576869-a4ec-4529-8536-b80a7769e899", "mode": "block", "device_group": "All devices", "approval_id": "APR-D0C8B3A826" } }, { "timestamp": "2026-08-22T06:07:11.463198", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-22T06:07:21.066056", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-22T06:07:39.862472", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-001", "approval_id": "APR-3C565C7D23" } }, { "timestamp": "2026-08-22T06:10:05.961884", "action": "pipeline.investigate", "category": "automation", "result": "success", "details": { "confidence": "CONFIRMED" } }, { "timestamp": "2026-08-22T06:10:35.982025", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-003", "approval_id": "APR-5EE88B389E", "score_impact": 10.5 } }, { "timestamp": "2026-08-22T07:30:27.195199", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-22T07:30:39.951711", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-22T22:11:39.316237", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-22T22:11:47.416741", "action": "approval.request.run_av_scan", "category": "approval", "result": "pending", "details": { "approval_id": "APR-D04716FA5E", "policy": "manual", "action_id": "ACT-3282B208C5" } }, { "timestamp": "2026-08-23T00:18:09.686086", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:09.743592", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:09.986049", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:10.224882", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:11.097794", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:11.112891", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:11.339280", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T00:18:11.556750", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T01:23:16.186301", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T01:53:15.918013", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T01:53:54.166499", "action": "report.generated.soc", "category": "reporting", "result": "success", "details": { "format": "json" } }, { "timestamp": "2026-08-23T01:53:57.203646", "action": "report.generated.vulnerability", "category": "reporting", "result": "success", "details": { "format": "json" } }, { "timestamp": "2026-08-23T01:54:28.649645", "action": "report.generated.executive", "category": "reporting", "result": "success", "details": { "format": "json" } }, { "timestamp": "2026-08-23T01:54:30.468981", "action": "report.generated.compliance", "category": "reporting", "result": "success", "details": { "format": "json" } }, { "timestamp": "2026-08-23T01:54:36.865408", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-23T01:55:02.559220", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-23T01:55:06.515681", "action": "report.generated.soc", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T01:55:11.906919", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "paypal" } }, { "timestamp": "2026-08-23T01:55:12.483048", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-23T01:55:15.487963", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "demo", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-08-23T01:55:17.877836", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "paypal", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-08-23T01:55:18.393779", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "stripe", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-08-23T01:55:26.291943", "action": "report.generated.improvement", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T01:55:26.967415", "action": "report.generated.executive", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T01:55:27.268543", "action": "report.generated.compliance", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T01:55:27.848831", "action": "report.generated.vulnerability", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T02:56:09.853501", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-23T02:57:01.946029", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-F86AC18A0E", "policy": "manual", "action_id": "ACT-F5B27B1D73" } }, { "timestamp": "2026-08-23T02:57:01.958539", "action": "intelligence.contain", "category": "incident", "result": "success", "details": { "devices": [ "corp-wks-1187" ], "statuses": [ "awaiting_approval" ] } }, { "timestamp": "2026-08-23T02:57:39.013477", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-23T02:58:32.806736", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-23T02:58:41.830556", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Increase monitoring on affected devices.", "2. Re-assess after hunting results." ], "actions": [] } }, { "timestamp": "2026-08-23T03:00:15.842858", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-69E7608008", "reason": "" } }, { "timestamp": "2026-08-23T08:56:46.349609", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T10:03:23.769521", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T12:13:54.307255", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-23T12:14:44.616157", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-23T12:14:50.576909", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-23T12:14:59.059679", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "paypal" } }, { "timestamp": "2026-08-23T12:15:14.931501", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-23T12:15:19.154322", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "provider": "stripe", "session": "demo-standard", "order": "" } }, { "timestamp": "2026-08-23T12:15:53.553910", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-23T12:16:06.685919", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-23T18:13:39.004232", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-23T18:13:49.181067", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-23T20:35:32.049778", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-23T20:51:55.023867", "action": "secure_score.secure_now.requested", "category": "secure_score", "result": "pending", "details": { "improvement": "ss-007", "approval_id": "APR-2C8745551F", "score_impact": 6.8 } }, { "timestamp": "2026-08-23T21:52:03.268243", "action": "approval.request.collect_investigation_package", "category": "approval", "result": "pending", "details": { "approval_id": "APR-94781A29F2", "policy": "manual", "action_id": "ACT-3F0FC27391" } }, { "timestamp": "2026-08-23T21:52:17.261815", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-23T21:52:34.779769", "action": "vulnerability.remediation.requested", "category": "vulnerability", "result": "pending", "details": { "cve": "CVE-2024-3094", "approval_id": "APR-D7E3E519C1", "method": "" } }, { "timestamp": "2026-08-23T21:52:37.341544", "action": "vulnerability.remediation.verify", "category": "vulnerability", "result": "failure", "details": { "cve": "CVE-2024-3094", "checks": { "vulnerability_resolved": false, "devices_healthy": true, "exposure_reduced": true } } }, { "timestamp": "2026-08-23T21:54:47.566966", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-D7E3E519C1", "reason": "" } }, { "timestamp": "2026-08-23T21:55:11.410470", "action": "pipeline.enrich", "category": "automation", "result": "success", "details": { "match_count": 0, "verified_matches": [], "external_count": 0, "external_ips": [] } }, { "timestamp": "2026-08-23T21:55:52.013846", "action": "report.generated.soc", "category": "reporting", "result": "success", "details": { "format": "pdf" } }, { "timestamp": "2026-08-23T21:57:13.100089", "action": "tenant.settings_updated", "category": "settings", "result": "success", "details": { "tenant": "propera-demo", "configured": false, "sso": false, "branding": true, "compliance": true } }, { "timestamp": "2026-08-23T23:08:30.422302", "action": "automation.Persistence & Defense Evasion Response", "category": "automation", "result": "matched", "details": { "rule": "Persistence & Defense Evasion Response", "trigger": "incident", "matched_conditions": [ { "field": "mitre_techniques", "operator": "in", "value": [ "T1055", "T1547", "T1547.001", "T1053.005", "T1484", "T1136", "T1505.003" ] } ], "mode": "approval_required" } }, { "timestamp": "2026-08-23T23:08:30.465535", "action": "approval.request.investigate", "category": "approval", "result": "pending", "details": { "approval_id": "APR-9483578B25", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-CBE075A93B" } }, { "timestamp": "2026-08-23T23:08:30.498532", "action": "approval.request.collect_investigation_package", "category": "approval", "result": "pending", "details": { "approval_id": "APR-15798AF4E2", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-2C5E9EC116" } }, { "timestamp": "2026-08-23T23:08:30.544239", "action": "approval.request.run_hunting_queries", "category": "approval", "result": "pending", "details": { "approval_id": "APR-A86CB41BFA", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-8735EEA919" } }, { "timestamp": "2026-08-23T23:08:30.576246", "action": "approval.request.notify_soc", "category": "approval", "result": "pending", "details": { "approval_id": "APR-03D7E0CD0C", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-1AA8E072DD" } }, { "timestamp": "2026-08-23T23:08:30.669486", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-D44D6B092F", "policy": "Persistence & Defense Evasion Response", "action_id": "ACT-E768DFE281" } }, { "timestamp": "2026-08-23T23:08:30.724576", "action": "automation.High Risk Device SOC Alert", "category": "automation", "result": "matched", "details": { "rule": "High Risk Device SOC Alert", "trigger": "incident", "matched_conditions": [ { "field": "severity", "operator": "in", "value": [ "Critical", "High", "Medium" ] }, { "field": "device_risk", "operator": "eq", "value": "High" } ], "mode": "automatic" } }, { "timestamp": "2026-08-23T23:08:30.764458", "action": "remediation.notify_teams", "category": "remediation", "result": "succeeded", "details": { "policy": "High Risk Device SOC Alert", "run_id": "RUN-B3C9FEFBDD", "action_id": "ACT-F7D6DCDB17" } }, { "timestamp": "2026-08-23T23:08:30.796844", "action": "remediation.update_incident", "category": "remediation", "result": "succeeded", "details": { "policy": "High Risk Device SOC Alert", "run_id": "RUN-B3C9FEFBDD", "action_id": "ACT-AB18A649A7" } }, { "timestamp": "2026-08-23T23:08:45.629875", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-23T23:08:54.498667", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-5FACB2D0D4", "policy": "ai-auto-remediation", "action_id": "ACT-CC90B07832" } }, { "timestamp": "2026-08-23T23:08:54.530194", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-C369A2BCEC", "policy": "ai-auto-remediation", "action_id": "ACT-88CEB2B662" } }, { "timestamp": "2026-08-23T23:08:54.572931", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-A0D303D245", "policy": "ai-auto-remediation", "action_id": "ACT-63D240A769" } }, { "timestamp": "2026-08-23T23:08:54.615821", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-1C62C4FD72", "policy": "ai-auto-remediation", "action_id": "ACT-3FA2A92220" } }, { "timestamp": "2026-08-23T23:08:54.633150", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-23T23:15:10.830492", "action": "vulnerability.remediation.verify", "category": "vulnerability", "result": "failure", "details": { "cve": "CVE-2024-3094", "checks": { "vulnerability_resolved": false, "devices_healthy": true, "exposure_reduced": true } } }, { "timestamp": "2026-08-23T23:15:13.208871", "action": "vulnerability.remediation.requested", "category": "vulnerability", "result": "pending", "details": { "cve": "CVE-2024-3094", "approval_id": "APR-F97F81B45C", "method": "" } }, { "timestamp": "2026-08-23T23:57:55.244399", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-24T00:15:21.905640", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block Office communication application from creating child processes", "rule_id": "26190899-1602-49e8-8b27-eb1d0a1ce869", "mode": "block", "device_group": "All devices", "approval_id": "APR-238E24CB59" } }, { "timestamp": "2026-08-24T00:15:27.590749", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-24T00:15:57.949801", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-AF0A5E9D12", "reason": "" } }, { "timestamp": "2026-08-24T00:25:49.234608", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-24T00:25:51.269273", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-24T00:25:52.654421", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Increase monitoring on affected devices.", "2. Re-assess after hunting results." ], "actions": [] } }, { "timestamp": "2026-08-24T00:26:00.904173", "action": "sentinel.incident.created", "category": "sentinel", "result": "success", "details": { "sentinel_incident_id": "propera-1004", "demo": true } }, { "timestamp": "2026-08-24T00:57:23.800172", "action": "approval.request.collect_investigation_package", "category": "approval", "result": "pending", "details": { "approval_id": "APR-1DA880A645", "policy": "manual", "action_id": "ACT-41A634E917" } }, { "timestamp": "2026-08-24T02:06:31.536157", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-4BEE3F39CE", "reason": "" } }, { "timestamp": "2026-08-24T02:56:44.665436", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-BD9709936F", "reason": "Breach confirmed - c.reyes@propera-demo.com in LinkedIn 2021. Reset required." } }, { "timestamp": "2026-08-24T03:57:30.856596", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-24T03:57:35.124006", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-24T03:57:45.935683", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-89C4278C0B", "policy": "manual", "action_id": "ACT-35E3D3ECDD" } }, { "timestamp": "2026-08-24T03:57:45.949318", "action": "intelligence.contain", "category": "incident", "result": "success", "details": { "devices": [ "corp-wks-1187" ], "statuses": [ "awaiting_approval" ] } }, { "timestamp": "2026-08-24T17:03:08.986921", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-24T17:03:15.695231", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-24T18:44:47.997467", "action": "approval.request.release_isolation", "category": "approval", "result": "pending", "details": { "approval_id": "APR-C7680906F0", "policy": "manual", "action_id": "ACT-F467F0C78E" } }, { "timestamp": "2026-08-24T18:45:11.129632", "action": "approval.request.run_av_scan", "category": "approval", "result": "pending", "details": { "approval_id": "APR-FE0EA8F739", "policy": "manual", "action_id": "ACT-61A4DB86C8" } }, { "timestamp": "2026-08-24T18:49:31.517447", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-87489D3B35", "reason": "" } }, { "timestamp": "2026-08-24T21:46:56.177968", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-25T08:19:54.682742", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-25T09:35:27.109499", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-D91107E842", "reason": "" } }, { "timestamp": "2026-08-25T10:37:51.183782", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-25T13:00:41.658421", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-25T19:56:29.240636", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block Office applications from injecting code into other processes", "rule_id": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", "mode": "block", "device_group": "All devices", "approval_id": "APR-09286B4973" } }, { "timestamp": "2026-08-25T23:18:47.602759", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-25T23:22:54.551572", "action": "integration.test.mde", "category": "integrations", "result": "failure", "details": { "ok": false, "result": { "connected": false, "message": "Microsoft Entra ID is not configured for this tenant. Set AZURE_TENANT_ID, AZURE_CLIENT_ID and a credential (or configure the tenant in Settings).", "demo": false } } }, { "timestamp": "2026-08-25T23:22:59.166662", "action": "integration.test.teams", "category": "integrations", "result": "failure", "details": { "ok": false, "error": "Teams is not configured (set TEAMS_WEBHOOK_URL or enable Teams Graph)." } }, { "timestamp": "2026-08-26T00:29:47.797028", "action": "remediation.denied_registry.restrict_code_execution", "category": "remediation", "result": "registry_required", "details": { "reason": "manual", "recommendation_id": "", "vulnerability_id": "", "message": "This action requires a Windows registry change. ProPera Online does not modify the registry - an Administrator or Global Administrator must apply this change through their managed channel (Intune, Group Policy or direct admin access). The automated action has been denied." } }, { "timestamp": "2026-08-26T00:32:19.993417", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-26T04:56:27.463716", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-31F98FB381", "reason": "" } }, { "timestamp": "2026-08-26T06:42:21.735411", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-26T15:45:17.561073", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-26T15:47:33.251106", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-26T19:38:22.994725", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-26T19:39:04.765371", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-27T10:13:27.475356", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-27T12:32:15.846446", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-27T14:51:49.020194", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "paypal" } }, { "timestamp": "2026-08-27T15:03:01.402784", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-27T15:36:17.855276", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-08-27T16:03:11.963165", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "demo", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-08-27T17:05:37.187571", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-08-27T17:41:16.755861", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "provider": "demo", "session": "demo-standard", "order": "" } }, { "timestamp": "2026-08-27T17:54:19.388184", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-08-27T18:08:30.174554", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "paypal" } }, { "timestamp": "2026-08-27T22:41:04.332133", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-27T22:41:13.077455", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Increase monitoring on affected devices.", "2. Re-assess after hunting results." ], "actions": [] } }, { "timestamp": "2026-08-29T10:32:46.930642", "action": "asr.change.requested", "category": "endpoint_security", "result": "pending", "details": { "rule": "Block execution of potentially obfuscated scripts", "rule_id": "01443614-e7cf-4acb-b74c-4d7e6a9b6b7e", "mode": "warn", "device_group": "All devices", "approval_id": "APR-992A73EDFB" } }, { "timestamp": "2026-08-29T10:33:04.081814", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-004", "approval_id": "APR-3B956CB629" } }, { "timestamp": "2026-08-31T01:31:51.306651", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-31T01:31:52.881184", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-31T01:32:11.172987", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-31T01:32:16.719163", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-6386054C51", "policy": "ai-auto-remediation", "action_id": "ACT-A56FEC9A36" } }, { "timestamp": "2026-08-31T01:32:16.759093", "action": "approval.request.block_indicator", "category": "approval", "result": "pending", "details": { "approval_id": "APR-CF3254DE63", "policy": "ai-auto-remediation", "action_id": "ACT-B8787A9A42" } }, { "timestamp": "2026-08-31T01:32:16.792694", "action": "approval.request.quarantine_file", "category": "approval", "result": "pending", "details": { "approval_id": "APR-001AC6A618", "policy": "ai-auto-remediation", "action_id": "ACT-FE20D59408" } }, { "timestamp": "2026-08-31T01:32:16.817470", "action": "approval.request.disable_account", "category": "approval", "result": "pending", "details": { "approval_id": "APR-3FC649FC17", "policy": "ai-auto-remediation", "action_id": "ACT-00444B444A" } }, { "timestamp": "2026-08-31T01:32:16.827431", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Approve and isolate affected devices (selective isolation).", "2. Block identified indicators (hashes/IPs/URLs) in Defender.", "3. Quarantine malicious files via Stop & Quarantine.", "4. Disable compromised accounts via approved identity workflow.", "5. Verify remediation: re-run hunting queries, confirm device health.", "6. Update incident classification/determination and record audit trail." ], "actions": [ "isolate_device", "block_indicator", "quarantine_file", "disable_account" ] } }, { "timestamp": "2026-08-31T06:26:04.123483", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-08-31T06:26:06.002388", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-08-31T06:26:22.806550", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "UNKNOWN", "mode": "local-engine" } }, { "timestamp": "2026-08-31T06:26:27.850325", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "No remediation required at this time; document and monitor." ], "actions": [] } }, { "timestamp": "2026-08-31T06:28:11.215404", "action": "integration.test.intune", "category": "integrations", "result": "failure", "details": { "ok": false, "error": "Unknown integration slug" } }, { "timestamp": "2026-08-31T22:13:08.299342", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-08-31T22:14:30.891915", "action": "auth.api_token_issued", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-08-31T23:03:42.402595", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-001", "approval_id": "APR-BD6EAE0C4A" } }, { "timestamp": "2026-08-31T23:03:47.574392", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-001", "approval_id": "APR-80317FB491" } }, { "timestamp": "2026-08-31T23:03:55.716530", "action": "recommendation.secure_now.requested", "category": "recommendation", "result": "pending", "details": { "recommendation": "rec-001", "approval_id": "APR-64540AD01D" } }, { "timestamp": "2026-09-01T19:51:16.614430", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-09-01T19:51:21.966401", "action": "approval.request.isolate_device", "category": "approval", "result": "pending", "details": { "approval_id": "APR-387EA8D065", "policy": "manual", "action_id": "ACT-68CE199663" } }, { "timestamp": "2026-09-01T19:51:21.980635", "action": "intelligence.contain", "category": "incident", "result": "success", "details": { "devices": [ "corp-wks-1187" ], "statuses": [ "awaiting_approval" ] } }, { "timestamp": "2026-09-01T19:51:41.519762", "action": "approval.request.release_isolation", "category": "approval", "result": "pending", "details": { "approval_id": "APR-4E622AEA6C", "policy": "manual", "action_id": "ACT-0224D1E033" } }, { "timestamp": "2026-09-01T19:54:46.650281", "action": "config.save.microsoft", "category": "configuration", "result": "success", "details": { "fields": [ "azure_tenant_id", "azure_client_id", "azure_client_secret", "mde_api_url", "graph_api_url", "sentinel_subscription_id", "sentinel_resource_group", "sentinel_workspace_id", "teams_webhook_url" ] } }, { "timestamp": "2026-09-02T09:23:55.521182", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-09-02T09:24:00.374089", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-09-02T17:33:14.745470", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-09-03T19:45:43.558459", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-09-03T20:44:40.302535", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "stripe" } }, { "timestamp": "2026-09-03T21:31:46.917738", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "paypal" } }, { "timestamp": "2026-09-03T21:34:15.062571", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-09-03T21:42:41.249981", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "stripe", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-09-03T22:21:28.390081", "action": "billing.plan_upgraded", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "provider": "paypal", "session": "demo-basic", "order": "" } }, { "timestamp": "2026-09-03T22:30:22.036950", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-09-04T01:00:08.596847", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-09-04T04:00:10.905946", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "basic", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-09-04T06:41:42.484400", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "LIKELY", "mode": "local-engine" } }, { "timestamp": "2026-09-04T06:41:47.739987", "action": "pipeline.remediate", "category": "automation", "result": "initiated", "details": { "steps": [ "1. Increase monitoring on affected devices.", "2. Re-assess after hunting results." ], "actions": [] } }, { "timestamp": "2026-09-05T02:33:34.864462", "action": "ai.analyze_incident", "category": "investigation", "result": "success", "details": { "confidence": "CONFIRMED", "mode": "local-engine" } }, { "timestamp": "2026-09-05T02:33:47.178829", "action": "approval.request.run_av_scan", "category": "approval", "result": "pending", "details": { "approval_id": "APR-9276157B1D", "policy": "manual", "action_id": "ACT-9D31D3DCE2" } }, { "timestamp": "2026-09-05T02:36:57.655147", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-9276157B1D", "reason": "" } }, { "timestamp": "2026-09-05T02:36:59.243317", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-81B16232DE", "reason": "" } }, { "timestamp": "2026-09-05T02:37:01.747788", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-B3410438F7", "reason": "" } }, { "timestamp": "2026-09-05T02:37:03.194930", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-857799ADEE", "reason": "" } }, { "timestamp": "2026-09-05T02:37:07.105202", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-245CB0B3D4", "reason": "" } }, { "timestamp": "2026-09-05T02:37:12.610427", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-AF9F62524A", "reason": "" } }, { "timestamp": "2026-09-05T02:37:16.129872", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-CD23F168C0", "reason": "" } }, { "timestamp": "2026-09-05T02:37:17.468667", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-7A6005820F", "reason": "" } }, { "timestamp": "2026-09-05T02:37:27.215982", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-663138DC17", "reason": "" } }, { "timestamp": "2026-09-05T02:37:28.753183", "action": "approval.decision.approved", "category": "approval", "result": "approved", "details": { "approval_id": "APR-F807CF15A9", "reason": "" } }, { "timestamp": "2026-09-05T03:12:39.450396", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-09-05T03:13:24.054953", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } }, { "timestamp": "2026-09-05T11:09:12.944231", "action": "intelligence.analyze", "category": "incident", "result": "success", "details": { "verdict": "SUSPICIOUS", "confidence": 0.7288 } }, { "timestamp": "2026-09-06T06:16:33.377836", "action": "auth.logout", "category": "auth", "result": "success", "details": {} }, { "timestamp": "2026-09-06T06:47:28.906230", "action": "billing.checkout_started", "category": "billing", "result": "success", "details": { "tenant": "propera-demo", "plan": "standard", "mode": "demo", "provider": "demo" } }, { "timestamp": "2026-09-06T06:48:33.127264", "action": "auth.data_export", "category": "privacy", "result": "success", "details": { "method": "self_service" } } ], "subscriptions": [] }