Active Incidents
12
3 vs last hour
Critical Incidents
4
1 vs last hour
High Risk Agents
8
2 vs last hour
Security Events
1,842
18% vs last hour
Blocked Actions
312
24% vs last hour
Active Sessions
27
8 vs last hour
1. Live Attack Timeline
- Prompt Injection
- Data Exfiltration
- Tool Misuse
- Unauthorized Access
- Other
2. Active Incidents
| Incident | Severity | Status |
|---|---|---|
Prompt Injection & Data Access Attempt | Critical | Investigating |
Unauthorized File Access | High | Investigating |
Tool Misuse: SQL Execution | High | New |
Data Exfiltration Attempt | Medium | Investigating |
Excessive API Usage | Medium | Monitoring |
3. Threat Heat Map
- Low
- Medium
- High
- Critical
4. Agent Graph
5. Tool Usage (Top 10)
Last 1 Hour
6. Identity Risk
| Identity | Risk | Activity |
|---|---|---|
jane.doe@acme.com | 92 · Critical | Anomalous data access |
svc-data-analyst | 78 · High | Excessive tool usage |
alex.smith@acme.com | 64 · High | Multiple failed guardrails |
research.bot@acme.com | 48 · Medium | New tool usage |
mike.johnson@acme.com | 28 · Low | Normal activity |
7. Response Actions
Last 1 Hour
| Time | Action | Incident | Status |
|---|---|---|---|
| 11:12:45 AM | Block Request | INC-2025-00487 | Success |
| 11:07:32 AM | Disable Tool (sql_query) | INC-2025-00483 | Success |
| 11:03:18 AM | Alert SOC | INC-2025-00481 | Success |
| 11:01:55 AM | Isolate Session | INC-2025-00476 | Success |
| 10:58:40 AM | Require Approval | INC-2025-00472 | Pending |
8. MITRE ATT&CK Mapping
| Tactic | Technique | Active | Trend |
|---|---|---|---|
| Initial Access | T1611 - AI Model Prompt Injection | 4 | 33% |
| Execution | T1059 - Command & Script Execution | 2 | 20% |
| Persistence | T1547 - AI Agent Persistence | 1 | 100% |
| Privilege Escalation | T1622 - Tool Permission Abuse | 2 | 50% |
| Defense Evasion | T1562 - Impair Defenses (Guardrails) | 3 | 25% |
| Credential Access | T1552 - Unsecured Credentials | 1 | 50% |
| Discovery | T1620 - AI System Discovery | 3 | 17% |
| Exfiltration | T1041 - Exfiltration Over Web Channel | 1 | 100% |
9. AI Recommendations
- high
Enable stricter guardrails for sql_query tool
This tool is associated with 3 high-severity incidents.
- high
Review permissions for jane.doe@acme.com
User has triggered multiple critical incidents.
- medium
Implement human approval for export_data
High data exfiltration risk detected.
- low
Update knowledge base access policy
Reduce exposure to sensitive documents.