Operations · Incident Response

Cases & DFIR

Investigations from first triage through eradication. Drag a case to advance its lifecycle, or open one to work the timeline, evidence, and response.

Active cases

Confirmed · active

SLA breached

49%

Avg progress

Closed

Open

ARG-2026-1035high

Phishing wave — 43 mailboxes impacted

Investigation16%

10134

1h 5m over

JВJ.ВаргаSuspected1d ago

ARG-2026-1034medium

Exposed S3 bucket exfiltration

Investigation59%

101032

4h 59m left

SFS. FischerProbable1d ago

Triage

ARG-2026-1036critical

Domain controller compromise — DCSync

Investigation29%

371236

1h 10m over

JВJ.ВаргаProbable9h ago

Investigating

ARG-2026-1040medium

Cloud account takeover via OAuth abuse

Investigation73%

5168

2h 32m left

SFS. FischerProbable6h ago

ARG-2026-1038medium

Business email compromise — wire fraud attempt

Investigation61%

2237

1h 11m left

MCM. ChenSuspected18h ago

ARG-2026-1033high

APT-grade lateral movement — Crown Vault

Investigation75%

24333

3h 26m left

NRN. ReyesProbable1d ago

Containment

ARG-2026-1042high

Targeted intrusion — FIN dept credential theft

Investigation70%

41310

1h 48m left

NRN. ReyesConfirmed1d ago

Eradication

ARG-2026-1041high

Ransomware precursor — Cobalt Strike beacon

Investigation11%

9135

3h 10m left

JВJ.ВаргаProbable17h ago

Closed

ARG-2026-1039critical

Insider data staging — Engineering repo

Investigation90%

6130

5h 26m left

TAT. AlaviConfirmed1h ago

ARG-2026-1037critical

Supply-chain implant in build pipeline

Investigation50%

29127

3h 0m left

MCM. ChenSuspected12h ago

Made by Gaurav Jain