CertPreps SOC -- AI-Assisted Triage

5 alerts, pre-triaged by the AI assistant. Confirm each verdict yourself before closing anything out.
ALERT-101
Repeated API calls from new source IP
Benign
AI SUMMARYThis IP belongs to the third-party invoicing integration added last month. The call pattern matches its documented polling interval exactly.
203.0.113.40 - - [12/May/2026:09:00:00 +0000] "GET /api/invoices?since=2026-05-11 HTTP/1.1" 200 1822
203.0.113.40 - - [12/May/2026:09:15:00 +0000] "GET /api/invoices?since=2026-05-11 HTTP/1.1" 200 1822
203.0.113.40 - - [12/May/2026:09:30:00 +0000] "GET /api/invoices?since=2026-05-11 HTTP/1.1" 200 1822
# integration-config.yml: invoicing-sync allowed_ip: 203.0.113.40, poll_interval_minutes: 15
ALERT-102
Password reset requested for admin account
Benign
AI SUMMARYThis reset was requested from the account owner's registered email, and matches an open support ticket (SUP-4471) where the user reported being locked out yesterday.
2026-05-12 10:02:11 password_reset_requested user=mgarcia email=mgarcia@corp.internal ip=198.51.100.12
2026-05-12 10:02:15 support_ticket_ref=SUP-4471 subject="Locked out of admin account" opened=2026-05-11 16:40:00 by=mgarcia
ALERT-103
Login from unusual location shortly after another login
Benign
AI SUMMARYThis account has a history of international logins. The user travels frequently for work, so logins from multiple countries in the same day are expected for this account and not unusual.
2026-05-12 14:02:00 login_success user=rhendricks ip=198.51.100.23 geo_city="New York, US"
2026-05-12 14:14:00 login_success user=rhendricks ip=203.0.113.77 geo_city="Tokyo, JP"
# Approximate distance New York -> Tokyo: 10,850 km
ALERT-104
Port scan detected against internal range
Benign
AI SUMMARYSource IP matches the internal vulnerability scanner. Scan window aligns with the approved change ticket for this month's scheduled scan.
2026-05-12 02:00:04 scan_event src=10.0.5.9 dst_range=10.0.0.0/16 ports=1-65535
# change-ticket CHG-2291: "Monthly internal vuln scan, approved window 02:00-04:00, scanner host 10.0.5.9"
ALERT-105
Large outbound data transfer at 03:00
Benign
AI SUMMARYThis matches the nightly offsite backup job. Transfer size and destination are consistent with previous nights, and the backup service account initiated it.
2026-05-12 03:00:00 transfer_start user=svc-backup dest=backup.certpreps-internal.com bytes=4812004321
2026-05-11 03:00:00 transfer_start user=svc-backup dest=backup.certpreps-internal.com bytes=4799881010
2026-05-10 03:00:00 transfer_start user=svc-backup dest=backup.certpreps-internal.com bytes=4805552290