Try the console
without signing in

Suspected ransomware execution · CASE-2611-0412

1. Evidence Email attachment invoice_1103.docm opened, then spawned a PowerShell child process (T1566.001, T1059.001)
2. Evidence vssadmin.exe delete shadows /all /quiet executed (T1490)
3. Evidence 412 file extensions changed within 6 seconds
4. Reasoning All three behaviors happened on the same host within 7 minutes, in the same order as the execution stage of a ransomware attack
5. Verdict Suspected ransomware execution · confidence 0.94
6. Recommendation Isolate the host from the network (needs owner approval) · check the 4 mailboxes that received the same attachment

Record: input hash 9f3a…c21e · model v3.2 · policy P-07 · How to read a verdict record

Internal chatbot tried to send data out · CASE-2611-0381

1. Evidence Hidden instruction inside an uploaded document ("Ignore previous instructions…")
2. Evidence Chatbot called the customer lookup tool 12 times more often than usual
3. Evidence Attempt to send to an external address with the mail.send tool (blocked by policy)
4. Reasoning The tool calls followed the order given by the instruction in the document, which matches indirect prompt injection (OWASP LLM01)
5. Verdict Tool misuse through prompt injection · confidence 0.88
6. Recommendation End the session · block the document source · remove the chatbot's permission to send externally

Bulk download in the early hours · CASE-2611-0377

1. Evidence VPN login at 02:14, outside the account's usual hours (09:00 to 19:00)
2. Evidence 1,820 files downloaded from the design document repository in 40 minutes (usual daily average: 30)
3. Evidence The account is on the list of upcoming departures (HR integration)
4. Reasoning Far outside the account's baseline. This may be a handover period, so a person needs to check
5. Verdict Possible insider data exfiltration · confidence 0.71
6. Recommendation Restrict downloads for the account · confirm with the department head