Skip to content

Commit afc8614

Browse files
stacknilstacknil
committed
feat: add config-change-investigation-demo
1 parent 5b4243a commit afc8614

1 file changed

Lines changed: 142 additions & 0 deletions

File tree

‎demos/config-change-investigation-demo/artifacts/investigation_hits.json‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
[
2+
{
3+
"investigation_id": "CCI-001",
4+
"severity": "critical",
5+
"rule_id": "cfg_disable_admin_mfa",
6+
"target_system": "identity-proxy",
7+
"actor": "ops-admin",
8+
"triggering_change": {
9+
"change_id": "cfg-001",
10+
"timestamp": "2026-03-22T09:00:00Z",
11+
"actor": "ops-admin",
12+
"target_system": "identity-proxy",
13+
"config_key": "disable_admin_mfa",
14+
"old_value": "false",
15+
"new_value": "true",
16+
"change_result": "success",
17+
"change_ticket": "CHG-1001"
18+
},
19+
"trigger_reason": "Admin MFA was disabled on a protected system.",
20+
"correlation_window_minutes": 15,
21+
"bounded_correlation_reason": "Attached evidence shares target_system 'identity-proxy' and falls within 15 minutes after the triggering change.",
22+
"attached_policy_denials": [
23+
{
24+
"denial_id": "den-001",
25+
"timestamp": "2026-03-22T09:04:00Z",
26+
"actor": "ops-admin",
27+
"target_system": "identity-proxy",
28+
"policy_name": "admin-login-guard",
29+
"decision": "denied",
30+
"reason": "MFA policy blocked admin login after configuration drift."
31+
},
32+
{
33+
"denial_id": "den-002",
34+
"timestamp": "2026-03-22T09:09:00Z",
35+
"actor": "service-account",
36+
"target_system": "identity-proxy",
37+
"policy_name": "token-exchange-guard",
38+
"decision": "denied",
39+
"reason": "Token exchange blocked after admin-auth policy divergence."
40+
}
41+
],
42+
"attached_follow_on_events": [
43+
{
44+
"event_id": "fo-001",
45+
"timestamp": "2026-03-22T09:05:00Z",
46+
"target_system": "identity-proxy",
47+
"event_type": "auth_fail_burst",
48+
"details": "5 privileged login failures from 203.0.113.24 after the config change."
49+
},
50+
{
51+
"event_id": "fo-002",
52+
"timestamp": "2026-03-22T09:11:00Z",
53+
"target_system": "identity-proxy",
54+
"event_type": "service_restart",
55+
"details": "identity-proxy restarted after an auth-policy reload."
56+
}
57+
],
58+
"evidence_counts": {
59+
"policy_denials": 2,
60+
"follow_on_events": 2
61+
}
62+
},
63+
{
64+
"investigation_id": "CCI-002",
65+
"severity": "high",
66+
"rule_id": "cfg_public_bind_cidr",
67+
"target_system": "payments-api",
68+
"actor": "deploy-bot",
69+
"triggering_change": {
70+
"change_id": "cfg-002",
71+
"timestamp": "2026-03-22T09:20:00Z",
72+
"actor": "deploy-bot",
73+
"target_system": "payments-api",
74+
"config_key": "public_bind_cidr",
75+
"old_value": "10.20.0.0/24",
76+
"new_value": "0.0.0.0/0",
77+
"change_result": "success",
78+
"change_ticket": "CHG-1002"
79+
},
80+
"trigger_reason": "Public bind CIDR was expanded to all addresses.",
81+
"correlation_window_minutes": 15,
82+
"bounded_correlation_reason": "Attached evidence shares target_system 'payments-api' and falls within 15 minutes after the triggering change.",
83+
"attached_policy_denials": [
84+
{
85+
"denial_id": "den-003",
86+
"timestamp": "2026-03-22T09:23:00Z",
87+
"actor": "deploy-bot",
88+
"target_system": "payments-api",
89+
"policy_name": "public-exposure-guard",
90+
"decision": "denied",
91+
"reason": "Public bind CIDR exceeded the approved network range."
92+
}
93+
],
94+
"attached_follow_on_events": [
95+
{
96+
"event_id": "fo-003",
97+
"timestamp": "2026-03-22T09:26:00Z",
98+
"target_system": "payments-api",
99+
"event_type": "service_restart",
100+
"details": "payments-api restarted after listener rebind."
101+
},
102+
{
103+
"event_id": "fo-004",
104+
"timestamp": "2026-03-22T09:31:00Z",
105+
"target_system": "payments-api",
106+
"event_type": "edge_warning",
107+
"details": "Edge listener observed requests from the newly public CIDR."
108+
}
109+
],
110+
"evidence_counts": {
111+
"policy_denials": 1,
112+
"follow_on_events": 2
113+
}
114+
},
115+
{
116+
"investigation_id": "CCI-003",
117+
"severity": "high",
118+
"rule_id": "cfg_break_glass_mode",
119+
"target_system": "vault-gateway",
120+
"actor": "sre-admin",
121+
"triggering_change": {
122+
"change_id": "cfg-004",
123+
"timestamp": "2026-03-22T10:00:00Z",
124+
"actor": "sre-admin",
125+
"target_system": "vault-gateway",
126+
"config_key": "break_glass_mode",
127+
"old_value": "disabled",
128+
"new_value": "enabled",
129+
"change_result": "success",
130+
"change_ticket": "CHG-1004"
131+
},
132+
"trigger_reason": "Break-glass mode was enabled on a sensitive service.",
133+
"correlation_window_minutes": 15,
134+
"bounded_correlation_reason": "Attached evidence shares target_system 'vault-gateway' and falls within 15 minutes after the triggering change.",
135+
"attached_policy_denials": [],
136+
"attached_follow_on_events": [],
137+
"evidence_counts": {
138+
"policy_denials": 0,
139+
"follow_on_events": 0
140+
}
141+
}
142+
]

0 commit comments

Comments
 (0)