← queueCHR-2035-0412opened 2035-04-12T06:17:03Z // ACTIVE

Credential relay across build infrastructure

critical
94Fusion score
CURRENT RISK SCORE:94 / 100
CASE TARGET:svc-build-runner-07

Incident Storyboard (Fused Narrative)

10:02 AMstep-1
EXPAND TELEMETRY +

At 10:02 AM, this account failed three logins from an unknown Chicago IP (64.233.161.4). The device did not match any hardware footprint in the user history.

10:04 AMstep-2
EXPAND TELEMETRY +

Two minutes later, a password reset was approved from that same Chicago IP by replaying a continuous-integration token from svc-build-runner-07.

10:04:10 AMstep-3
EXPAND TELEMETRY +

Ten seconds later, an anomalous outbound burst of 2.3 GB was exfiltrated from edge-fw-eu-2 to the same Chicago destination ASN.

10:06 AMstep-4
EXPAND TELEMETRY +

At 10:06 AM, a dormant personal access token (unused for 212 days) was activated to request write scope on the artifact registry, finalizing credentials control.

10:08 AMstep-5
EXPAND TELEMETRY +

Predictive alert triggered: A maximum-limit transfer from the high-value bank account ACCT-4928-1002 is expected within 2 minutes. Immediate freeze recommended.

Ingestion Architecture Flow

REALTIME AGENT AGGREGATION
Syslog
Netflow
Auditd
Hawkes Fusion
Entity Graph
Risk Timeline

Unified Entity Graph (Shared Screen)

ivan.k@corpsvc-build-runner-0764.233.161.4 (Chicago IP)00:50:56:C0:00:08ACCT-4928-1002edge-fw-eu-2artifact-registry
User ID
IP Address
MAC / Registry
High-Value Account
Failed Auth Pulse

Predictive Timeline (Smart Warning System)

INGESTED SIGNAL TRAIL (PAST)T-MINUTES
HAWKES PROCESS RISK PROBABILITYIMMINENT FRAUD
Past (Ingested)
NOW
Future (Hawkes Predictive)
94%Fraud Prob
TIME WINDOW LEFT:1m 45s