| Time | Actor | Role | Type | Event | Where | Hash |
|---|---|---|---|---|---|---|
| 2026-10-27 09:05:•••• | F••••• H•••• | Head of Security Operations | Incident | Notice sent to affected ROs · INC-2026-0417 | SOC & Incidents | c39a06e2 |
| 2026-10-27 08:19:•••• | Workflow · edge-auto | AI agent · automation | Edge | Blocked 45.155.•••.•••/24 · all platforms · 7 days | Lists & feeds | a02c10ad |
| 2026-10-27 08:12:•••• | Triage agent | AI agent · automation | Action | Escalated AL-90412 · P = 0.97 | Alert queue | 6c84d900 |
| 2026-10-27 07:58:•••• | Wazuh | Connector | Action | Process killed and WS-0571 isolated | EDR detections | 27840541 |
| 2026-10-27 02:14:•••• | svc-goaml | Service account | Access | goaml-sign-2026 sign · 2 of 3 approved | HSM clusters | 27a4533b |
| 2026-10-26 18:30:•••• | N••••• S••••• | Key Custodian | Change | Ceremony KC-58 scheduled | Key ceremonies | de8dd588 |
| 2026-10-26 16:02:•••• | T••••• R••••• | Security Engineer | Workflow | Published v3.2 · Impossible travel → step-up and contain | Workflow Manager | 5c9fe7e8 |
| 2026-10-26 11:10:•••• | M••••• H•••• | Internal Audit (read-only) | Export | Audit export with hash-chain proof | Audit Log | 05927661 |