| Time | Alert | Source | Verdict | Risk | Action |
|---|---|---|---|---|---|
| 08:41 | Cobalt Strike beacon — periodic HTTPS callback, front-desk PC (Umhlanga) | Security Onion | Suspicious | 90 | Containment proposed — awaiting analyst approval |
| 07:58 | QakBot hash match on downloaded installer | EDR | Clean | 6 | Auto-closed — false positive (signed vendor updater) |
| 06:12 | SSH brute-force — 412 failed logins on PMS jump host | Wazuh | Malicious | 94 | Source IP auto-contained · rule 5712 · evidence sealed |
| 04:37 | Impossible travel — finance controller session (CPT → Lagos, 9 min) | Elastic | Malicious | 91 | Session revoked · password reset proposed — approved 04:51 |
| 03:20 | Credential-stuffing burst against guest Wi-Fi portal | Security Onion | Suspicious | 68 | Rate-limit tightened · monitoring elevated |
| 01:55 | Anomalous auth.log pattern — night-audit service account | LogSentinelAI | Suspicious | 57 | Under review — correlated with scheduled batch job |
| 00:48 | Lookalike domain resolving to booking-portal clone | DNS telemetry | Suspicious | 72 | Containment proposed — awaiting analyst approval |
| 23:14 | Phishing email — "invoice overdue" lure to reservations | Email gateway | Malicious | 86 | Message purged fleet-wide · sender domain blocked |