← queueCHR-2035-0398opened 2035-04-09T22:41:55Z // IN REVIEW

Lateral movement via forgotten service mesh cert

high
81Fusion score
CURRENT RISK SCORE:81 / 100
CASE TARGET:mesh-gw-legacy

Incident Storyboard (Fused Narrative)

10:41 PMstep-1
EXPAND TELEMETRY +

At 10:41 PM, the legacy mesh gateway accepted and authenticated an expired certificate cert-2031-heirloom, which should have been decommissioned 3 years ago.

10:52 PMstep-2
EXPAND TELEMETRY +

Eleven minutes later, dynamic eBPF flow monitors flagged unexpected east-west connection requests flowing directly from the legacy gateway into payments-ns.

11:05 PMstep-3
EXPAND TELEMETRY +

Hawkes predictive model detects lateral credential usage targeting Settlements Account ACCT-9921-5501. Window shrinking rapidly.

Ingestion Architecture Flow

REALTIME AGENT AGGREGATION
Syslog
Netflow
Auditd
Hawkes Fusion
Entity Graph
Risk Timeline

Unified Entity Graph (Shared Screen)

mesh-gw-legacypayments-nscert-2031-heirloomACCT-9921-550110.233.4.15usr-pavan-99
User ID
IP Address
MAC / Registry
High-Value Account
Failed Auth Pulse

Predictive Timeline (Smart Warning System)

INGESTED SIGNAL TRAIL (PAST)T-MINUTES
HAWKES PROCESS RISK PROBABILITYIMMINENT FRAUD
Past (Ingested)
NOW
Future (Hawkes Predictive)
94%Fraud Prob
TIME WINDOW LEFT:8m 20s