Session • data movement investigation
Large data egress from research segment
Synthetic data-egress investigation with account lockdown, forensic export, communication and process proposals.
PreviewAll sessions
2026-05-19•12:00-16:00 AEST•IR agent
Action attempts
8
Authorized
4
Review
3
Blocked
1
Top reason
authority and state sufficient
Selected action • Large data egress from research segment
Account lockdown - 12:09
Lock down the research user account associated with a large outbound transfer.
- Target
- Research user account
- u-research-301@corp.example
- Scope
- Single user account
- Proposed by
- IR agent
- agent-soc-ir-02
- Reason
- Authority and state sufficient