SOC Director · Watch Commander
Nayan Parakh
Iron-Dome is monitoring 1,204 assets across 5 autonomous agents. One active incident under containment — INC-20294.
● All agents nominal
1 incident in progress
Autonomous Fleet
Agent Activity Rings
5/5 online · agent sync active
Detection
Parsing EDR telemetry · 1,204 hosts/min
Scanning
Triage
Correlating ALRT-88213 w/ identity signal
Classifying
Investigation
Reconstructing timeline for INC-20294
Mapping
Response
Staging isolation · FIN-WKS-114
Staging
Reporting
Compiling shift 03:00–06:00 UTC
Compiling
Open Incidents
4
▲ 1 vs 24h
Mean Time to Triage
41s
▼ 12s
Mean Time to Contain
6.2m
▼ 1.4m
Alerts / Hour
312
▲ 8%
Auto-Contained
89%
▼ 2%
Perimeter
Live Alert Feed
312/hr ingest
Queue — Unresolved
14 open
Critical
Suspicious OAuth grant — mail.read.all
user: d.romero@corp-example.io · app: "QuickSync Helper" · SRC: Azure AD
00:14
Critical
Lateral movement via PsExec
host: FIN-WKS-114 → DC-EAST-02 · T1021.002 · SRC: EDR
02:03
Critical
Shadow copy deletion attempt
host: FIN-WKS-114 · cmd: vssadmin delete shadows /all /quiet · SRC: EDR
02:41
High
Impossible travel — MFA satisfied
user: k.alvarez · SG → US-East in 4m · SRC: Identity
06:41
High
LSASS memory access flagged
proc: rundll32.exe · host: EDR-LNX-0417 · SRC: EDR
09:12
High
New forwarding rule created
mailbox: d.romero@corp-example.io → external SMTP · SRC: M365
11:04
High
Privilege escalation — new domain admin
actor: svc-backup-agent · target: j.chen · SRC: AD
12:58
High
Unsigned driver loaded
host: FIN-WKS-114 · file: rtcore64.sys · SRC: EDR
13:20
High
Outbound beacon to known C2 IOC
host: FIN-WKS-114 → 185.220.101.47:443 · SRC: NDR
13:47
Medium
New S3 bucket policy — public-read
bucket: acct-exports-prod · actor: iam-deploy-svc · SRC: CloudTrail
14:55
Medium
Unusual PowerShell encoded command
host: HR-LT-2291 · parent: outlook.exe · SRC: EDR
18:30
Medium
New OAuth app registered — org-wide consent
app: "DataSync Pro" · actor: svc-appreg · SRC: Azure AD
21:02
Medium
Login from Tor exit node
user: guest-portal-svc · ip: 198.98.51.x · SRC: WAF
23:19
Medium
Excessive failed logins
user: admin-legacy · attempts: 42 in 3m · SRC: AD
26:44
Investigation Agent
Incident Timeline — INC-20294
Phishing → Credential Theft → Lateral Movement
4 events · live
00:14:02 UTC
Spearphishing link delivered
User d.romero@corp-example.io receives "QuickSync Helper" OAuth consent request via email, spoofed as an internal IT tool. Link routes through a fast-flux redirect at sync-cdn-relay.net.
T1566.002 · Detection Agent
00:14:47 UTC
OAuth grant approved — credential theft
User approves mail.read.all + offline_access scopes. Attacker now has persistent mailbox access without needing a password. A forwarding rule is silently created to an external SMTP relay.
T1098.001 · Triage Agent
02:03:15 UTC
Lateral movement — PsExec to domain controller
Harvested session cookie reused to authenticate to FIN-WKS-114. Attacker pushes PsExec to pivot toward DC-EAST-02, consistent with UNC-4821 tradecraft.
T1021.002 · Investigation Agent
02:41:09 UTC
Ransomware precursor — shadow copy deletion
vssadmin delete shadows /all /quiet executed on FIN-WKS-114 — a standard pre-encryption step. Response Agent auto-drafts an isolation action.
T1490 · Response Agent
— pending —
Containment: host isolation
Awaiting approval from Response Playbook Console to isolate FIN-WKS-114 and revoke the OAuth grant. Click "Contain Threat" below or run the scenario from the dome.
Playbook AX-RB-014
Investigation Agent
Entity Relationship Graph
User / identity
Host / asset
External indicator
Cloud resource
Coverage
MITRE ATT&CK Matrix
6 tactics observed
Initial Access
T1566.002Spearphishing link
T1190 Exploit public app
T1133 External remote svc
Execution
T1059.001PowerShell
T1047 WMI
T1204 User execution
Persistence
T1098.001Add cloud creds
T1547 Boot / logon autostart
T1136 Create account
Priv Escalation
T1078.004Cloud accounts
T1548 Bypass UAC
T1068 Exploitation
Defense Evasion
T1562.001Disable tools
T1556Modify auth process
T1070 Indicator removal
Credential Access
T1003.001LSASS memory
T1110 Brute force
T1552 Unsecured creds
Discovery
T1087Account discovery
T1018 Remote system disc.
T1082 System info disc.
Lateral Movement
T1021.002SMB / PsExec
T1550 Use alt auth material
T1080 Taint shared content
Collection
T1114 Email collection
T1005 Local data
T1560 Archive collected
Impact
T1490Inhibit recovery
T1486 Data encrypted
T1489 Service stop
Observed this incident
Confirmed / active technique
Response Agent
Playbook Console
AX-RB-014 · OAuth Consent Phishing → Lateral Movement
Containment
2/3 complete
✓
Revoke OAuth grant "QuickSync Helper"
Application consent revoked org-wide; refresh tokens invalidated for d.romero@corp-example.io.
Done
✓
Remove malicious mail forwarding rule
Inbox rule routing to external SMTP relay deleted; mailbox audit log preserved.
Done
3
Isolate host FIN-WKS-114
Network isolation via EDR agent, preserving memory for forensic capture.
Awaiting approval
Eradication & Recovery
Queued
4
Reset credentials for affected accounts
Force password reset + re-enroll MFA for d.romero and any accounts touched via lateral movement.
Queued
5
Rebuild FIN-WKS-114 from known-good image
Standard rebuild after BYOVD driver load; restore from last clean backup snapshot.
Queued
6
Block C2 indicators at perimeter
185.220.101.47 and sync-cdn-relay.net pushed to firewall + DNS sinkhole.
Queued
Reporting Agent
Executive Dashboard
Shift summary · 03:00–06:00 UTC
Incidents Handled
4
▲ 1
Auto-Contained
89%
▼ 2%
Analyst Hours Saved
14.2
▼ est.
Residual Risk
Med
▲ from Low
Alert Volume — 24H
Risk Heatmap — Business Units
Low
Elevated
Critical
Telemetry
System Logs
[DETECTION] new signature deployed: RANSOM_PRECURSOR_VSS_DELETE
[SIEM] 4,812 events/min ingested, cluster nominal
[TRIAGE] ALRT-88213 escalated to Critical, correlation score 0.94
[THREAT-INTEL] IOC feed sync complete, 214 new indicators
[CLOUD] AWS GuardDuty finding UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration
[RESPONSE] isolation drafted for FIN-WKS-114, awaiting approval
[IDENTITY] impossible travel flagged for k.alvarez
[REPORTING] shift summary compilation at 90%
Reference Architecture
Open-Source Tool Stack
What a real build of this platform could run on
SIEM / Log Aggregation
Network Detection
Endpoint / Host Telemetry
SOAR / Automation
Case Management
Threat Intelligence
Detection Engineering
ATT&CK Mapping
Autonomous Agent Orchestration
Dashboards / Metrics
This Prototype's Frontend
This dashboard itself is a static HTML/CSS/JS prototype with synthetic demo data — it isn't wired to any of the above. The list names real open-source projects that commonly fill each role in an actual SOC build, for reference if this were taken from mockup to production.