CloudSentinel — SOC Analyst Console

Every call to POST /events/ingest — from any client, including scripts/banking_simulator.py running as its own process — streams here over a WebSocket the instant it happens, independent of the scenario buttons below. This is the always-on view; the panels further down replay one bundled scenario on demand.

A bank-owned brokerage employee's OCI credential is stolen and used from attacker infrastructure to re-authenticate (T1078), escalate IAM privilege (T1098), enumerate storage (T1619), then bulk-download a unified customer record store holding both banking KYC and demat/trading-account data. One incident, four regulators: CERT-In, RBI Cyber Security Framework, SEBI CSCRF, and DPDP obligations all surface together at the final escalation. Needs both sector rule packs ON for the full picture (see badge above) — otherwise the same events still fire via the default detection rules, just without the two sector-specific rule hits.

Replays the bundled OCI fixture (privilege escalation → enumeration → bulk download) through POST /events/ingest, one event at a time, exactly as a real connector would deliver them.

A back-office bank employee's credential is used from a new source IP to bulk-download customer KYC documents — no privilege escalation this time. Fires BFSI_SENSITIVE_DATA_ACCESS (MITRE T1530) only when the sector rule pack is ON (see badge above), and evaluates CERT-In/RBI/DPDP compliance obligations for the resulting incident.

A structurally different telemetry domain from the cloud/host scenarios above — flow-log records (src:port → dst:port, protocol, bytes, accept/reject), not actor/action/resource audit events — replayed through POST /network/ingest. Port-scan sweeps distinct destination host:port pairs, all rejected (PORT_SCAN_DETECTION, MITRE T1046). Egress-volume sends a sustained burst of bytes to one external destination (ANOMALOUS_EXTERNAL_EGRESS_VOLUME, MITRE T1048). Both are hard-capped at Tier 1 (notify) — no automated network remediation action exists yet. Bundled scenarios are OCI VCN Flow Logs; the same rules fire identically against AWS VPC Flow Logs with zero rule-code changes (see README's "Network telemetry" section) — not wired to a dashboard button here to keep this console focused, but exercised end-to-end in tests/integration/test_aws_network_flow_end_to_end.py.

A fourth telemetry domain — not an event stream at all. A ResourceConfigSnapshot is "as of scan time, resource X currently has configuration Y," a standing condition scanned via POST /posture/scan, not something that happened at a point in time. Checks a bundled mixed compartment scan (some resources misconfigured, some clean) for public Object Storage buckets (PUBLIC_OBJECT_STORAGE_BUCKET, T1530), permissive internet ingress on sensitive ports (PERMISSIVE_INGRESS_FROM_INTERNET_<port>, T1133), and volume key-management posture (VOLUME_MISSING_CUSTOMER_MANAGED_KEY for OCI / UNENCRYPTED_VOLUME for AWS — deliberately separate rules, not one reused, since AWS volumes can be genuinely unencrypted while OCI's are always encrypted at rest regardless). Findings persist across scans (open → resolved | risk_accepted) and durably survive a restart when the mini cloud is enabled. Beyond this bundled OCI scenario, a post-quantum-cryptography check (QUANTUM_VULNERABLE_ASYMMETRIC_KEY) fires identically across all four primary clouds, an AWS IAM entitlement check (EXCESSIVE_PERMISSIONS_POLICY) covers over-privileged policies, and three Container/Kubernetes checks (PRIVILEGED_CONTAINER, PUBLICLY_EXPOSED_K8S_SERVICE, EXCESSIVE_KUBERNETES_RBAC_PERMISSIONS) cover cluster posture — none wired to a dashboard button here to keep this console focused, but all exercised end-to-end in the integration test suite (see README's "Cloud Security Posture Management" section).

Durable record of every regulatory obligation a fired verdict on sensitive data has triggered — not just what one API response showed once, but a queryable, status-tracked trail (GET /compliance/obligations). Engineering scaffolding, not legal advice: a regulated entity's compliance/legal function must independently verify every obligation, deadline, and reporting channel.