ContractsHigh
managedhelpdesk@techopspartners.com
ActiveFrozenAccesses via web login
Frozen: Open high-severity behavioral incident
1 open breach on this contract
Contract terms
Hard rules — always in effect
- An actor deleted an unusually large number of resources in a short window.
- An actor changed permissions on many resources in a short window.
- External email forwarding was configured or used.
- A burst of failed / suspicious logins for one actor in a short window (brute-force / credential-stuffing signal).
- A new OAuth token was granted to a previously-unknown client.
- A resource was shared publicly (anyone / public visibility).
Learned behavior
Typical hourly volume
4
95th-pct hourly
4
Events observed
1,960
Observation days
100
Breaches
View all in ViolationsHighcalendar volume of 12 in 60m is 3× this actor's normal upper bound (p95 4/h, median 4)Jul 9, 11:10
calendar volume of 12 in 60m is 3× this actor's normal upper bound (p95 4/h, median 4)
Actor: managedhelpdesk@techopspartners.com (user)
Observed
{
"spikes": [
{
"p95": 4,
"count": 12,
"ratio": 3,
"median": 4,
"robustZ": 5.4,
"category": "calendar"
}
],
"windowMinutes": 60
}Expected
{
"calendar": {
"p95": 4,
"median": 4
}
}Why this is unusual
- calendar: 12 vs p95 4 (3× normal upper bound)+100
Baseline confidence: 100%
Disposition