Ingext Monthly SOC Report

Most of August's alerts came from detection-test replay data, not from Acme's own people or devices. Acme's real exposure is in its configuration: eight global administrators where two are needed, gaps in email authentication, and a broken audit feed.

Acme Inc (tenant acme) · Managed SOC by Apex MSSP · 1–31 Aug 2026 UTC, compared with July 2026 · Review threshold risk score ≥ 3,000 · Issued 2026-09-27 · Read-only
Sanitized sample — company and identity details are fictional.

Chapter 1 · Executive and board — Where things stand §1

Executive summary

Posture: Amber · Trend: stable

Only 6 of August's 240 cases involved Acme's own accounts, and 5 of those were closed as harmless or expected. The other 234 refer to user accounts, guests and computers that do not exist in Acme's directory: they come from the attack-scenario recordings Acme's security team replays into the SIEM to test detections.

The detection rules responded correctly to every replayed scenario, which is good evidence that they work. But replayed alerts and real alerts land in one queue with nothing to tell them apart. That makes the workload figures unreliable, and a genuine attack could sit unnoticed among more than 150 open test cases.

Chapter 2 · IT and SOC — What happened this month §2

Security events overview

Case volume rose by 23%. More than half of it arrived in a single week, and almost all of it relates to identities outside Acme's directory.

Cases by period, August 2026

Total 240. 24–28 Aug: 129 cases (54%) in five working days — 24, 30, 32, 24 and 19 per day. Before that, volume held at 0–11 a day.

The surge was mostly newly created replay users on the sim.acme.example domain and partner.com guests signing in for the first time. That burst is consistent with a bulk replay, not organic activity.

Who the cases were about

Acme's Microsoft 365 directory holds 38 user records, 15 of them active licensed staff, all on Acme's own domains. None of the 147 replay users and none of the 81 guests appear in it, and the Ingext AI triage notes on these cases report "user record could not be found". The five endpoint cases carry the site names of two lab sites, not Acme's fleet.

§3

Rolling trends

Partial — counts from named case shapes, indicative Chapter 3 · IT and SOC — What the patterns tell us §4

Repeat offenders

All but one of the repeat actors are replayed identities. The more useful pattern is how the SOC handled them.

Replay users are on sim.acme.example; ops-admin is on acme.example. "<2" in the July column means the account was below the repeat threshold that month.

§5

Root-cause themes

Partial — analyst reading; not yet computed by the platform Chapter 4 · IT and SOC — What we can and cannot see §6

Operational exposure

Microsoft 365 and Google Workspace identity data is flowing and fresh. The gaps are one broken audit subscription, no endpoint agent inventory, no perimeter or vulnerability data, and the replay mix-in.

Coverage and health

• Office365:AcmeEU — second Microsoft 365 tenant Error

  "failed to start subscription: Audit.General" (×9) and no data received. The error and the zero throughput together confirm a real outage.

• Endpoint agent inventory None

  There is no SentinelOne or CrowdStrike agent index for this tenant, so Acme's own devices are not covered by endpoint detection and response (EDR).

• Acronis backup Unconfigured

  Ingext can see Acronis resources, but no source is configured to collect them.

• Office365-acme OK

  Sending data (428,646 bytes in 24 h). Its token-refresh warnings are routine. Directory data is fresh: Google Workspace 5 h 51 m, Office 365 1 h 47 m.

Configuration and health data is a live snapshot taken on 27 Sep 2026, not an August history.

Microsoft 365 hygiene — Acme's own directory

Email authentication

§7

Monitoring blind spots

Chapter 5 · IT, SOC and executive — What's at risk §8

Attack pathway observations

The three highest-scoring case groups were examined in detail. Each deep dive is followed by what it means for Acme's own environment.

Deep dive 1 — App registered with a new credential

Score 88,800 · Open · sim-user-08 · 26 Aug

Sequence (UTC)	12:06 authenticator app registered from 203.0.113.45 → 19:34–20:08 sign-ins from 198.51.100.14 (a new residential ISP), including two sign-in request types never seen before → 20:10 app "Wiki SSO" created (single-tenant), then updated and given a new certificate or secret.
Why it scored high	New ISP, new sign-in request types (high-confidence alerts), a new application, and a credential added to that application.
AI triage	Flagged as actionable one hour after the first event. The user record could not be found in the directory.
Assessment	Detection worked as intended. In a live tenant this is the setup for persistent access, because an app credential survives a password reset. Here the account does not exist in the directory, so this is replayed scenario data.

Deep dive 2 — Inbox rules changed

Scores 30,000 and 6,200 · Open · sim-user-12 · 31 Aug

Sequence (UTC)	09:38 four inbox rules disabled and one new rule, "CC team lead", created from 203.0.113.139 → 09:48 sign-in from 203.0.113.197. Both addresses are in the same residential ISP range.
Correlation	A separate IP-keyed case (203.0.113.139, score 6,200) covers the same five rule events. The two cases are one incident and should be closed together.
AI triage	Escalation to tier two recommended about 1 h 40 m after the rule changes.
Assessment	Lower risk than the rule names suggest. A single home ISP, a rule named after a colleague and no external forwarding address all point to a user tidying their inbox. The detection logic is sound.

Deep dive 3 — "Quarantine failed" on five endpoints

Scores 36,800–86,800 · 4 of 5 open · 9 Aug, 20:34 UTC

What was flagged	A Linux host running /tmp/coder.*/coder agent (a remote-workspace agent), classified by SentinelOne as ransomware with a hash unknown to VirusTotal. A macOS host running a device-management agent's policy executor. Plus three similar agents.
Outcome on the endpoint	Every process was killed. Quarantine failed, which is common for management agents that reinstall themselves or run from protected paths.
Provenance	All five belong to two lab sites in the replay set. They share an identical timestamp, and this tenant has no SentinelOne agent inventory.
Assessment	Probably false positives on legitimate management software. Resolve with the lab owners, not in Acme's production queue. Host names are withheld from this report.

Pathways that matter for Acme's own environment

• 8 global admins → 9 accounts with no password policy → 14 users with OAuth apps

  One phished administrator exposes the whole tenant

  Any one of eight accounts can take over the tenant. If one of them lacks phishing-resistant MFA, a single successful phish or token theft grants full control, and their connected apps give an attacker ways to stay in after a password reset.

• DMARC p=none on acmeinc.example → no DMARC on the onmicrosoft domain

  Spoofed email against partners

  Fraudsters can send convincing mail as Acme to partners and customers — the first step of the invoice-fraud pattern the replay scenarios model.

• 156 open replay cases → no replay label → no acknowledged state in use

  A real attack hidden in test noise

  A genuine inbox-rule or app-consent alert on a staff account would look exactly like the dozens of test cases left open this month.

• Audit.General subscription failing → no admin or config events

  Changes in the AcmeEU tenant go unseen

  With that feed down, none of the patterns above could be detected in that tenant.

No rule has an approved MITRE ATT&CK mapping, so no formal technique coverage is claimed.

§9

Telemetry-derived risk register

Partial — analyst scores

Likelihood × impact on a 1–5 scale. Bands: 1–5 Low · 6–10 Medium · 11–17 High · 18–25 Critical.

Highest residual risk is R4 (16, High). No Critical risks; no confirmed active compromise this period.

Chapter 6 · IT and SOC — How our defences performed §10

Control effectiveness

Detection and automated triage performed well on the replayed scenarios. Human follow-through did not keep up.

Gap. Agent exclusions, stale agents and integration versions are not exposed to reporting tools.

§11

Response performance

How the 84 closed cases were classified

The open backlog

156 cases are open. 27 of them score 10,000 or more, including the three deep dives. The oldest has been open since 3 Aug (55 days at time of writing). Closing slowed badly in the first three weeks: 21 of the 84 cases opened 1–22 Aug were closed (25%), against 63 of 156 for 23–31 Aug (40%).

Gap. SOC containment actions are not exposed. The only actions on record are process kills by the endpoint agent.

§12

Escalation log

Gap — escalation log not exposed to reporting tools

AI triage recommended tier-two escalation on the deep-dive 2 inbox-rule cases (user- and IP-keyed) and on the macOS endpoint case. Whether a human acted on those recommendations is not recorded.

Chapter 7 · IT and client — What needs to happen next §13

Actionable remediation plan

§14

Items requiring client action

• Leadership · due 2026-10-09 · R1

  Confirm which two people keep Global Administrator and designate a break-glass account

  Each admin account can take over the whole tenant.

• M365 admin · due 2026-10-09 · R4

  Re-authorize the AcmeEU Microsoft 365 connection

  That tenant's audit trail is not reaching the SOC.

• Leadership · due 2026-10-09 · R4

  Decide whether replay work moves to a separate tenant or stays here with labels

  Reports and the live queue stay unreliable until this is done.

• IT / DNS owner · due 2026-10-16 · R3

  Approve DMARC enforcement for acmeinc.example

  Stops attackers sending mail as Acme.

• Leadership · due 2026-10-09 · R4

  Provide escalation contacts for after-hours P1 alerts

  None are on file.

Chapter 8 · Closing — How we're moving forward §15

What we improved this month

• The share of cases closed rose from 23% to 35%.
• The 90th-percentile time to close fell from 7 h 08 m to 2 h 35 m.
• The replay exercised the email-fraud and app-persistence detections end to end.

Gap. The SOC change log is not exposed to reporting tools; the items above are derived from metric movement.

§16

Appendix

A. Log-source inventory (snapshot 27 Sep 2026, 24 h)

16 configured sources: 13 OK (5 listed, 3 fetchers, 5 remaining), 1 error, 2 inactive.

B. Remediation tracker and escalation contacts

This is the first report in this format, so all ten actions in §13 are new and open. No escalation contacts are on file; they are requested in §14.

C. Fingerprint glossary

D. MITRE ATT&CK

None of the rules in the top 25 fingerprints has an approved local mapping, so no technique table is included. Inferred mappings are not formal coverage.

E. Glossary

Case	One user's or asset's alerts on one day, with a risk score of 3,000 or more.
Risk score	How likely it is that a case needs review. It is not a severity or a verdict.
Fingerprint	The exact set of rules a case triggered.
Replay	Recorded or synthetic events sent into a tenant to test detections.
Undetermined / Benign positive	Closed without evidence either way / real but expected activity.