GT3 Tech Security Lab / Case 001

Every alert should carry its evidence.

This synthetic illustration shows an intended deterministic Mini-SIEM pipeline: a scheduled patrol carries bounded evidence through written rules, explains why an event matters, and leaves response decisions with a human.

Every event and outcome is a fixed synthetic fixture—not evidence of a deployed or accepted production system. The demo has no production connection, private logs, credentials, or response controls.

Illustrated operation: Scheduled patrol
Illustrated decision model: Written deterministic rules
Illustrated response: Report only · human approved

Illustrated monitor contract

What the intended patrol would watch

Four synthetic evidence lanes illustrate one practical question: did the scheduled patrol finish, and did it find something a human should review?

Host health

CPU, memory, disk, load

Daily scheduled patrol

Read-only metrics; no tuning or cleanup

Required workloads

Runtime state and restart count

Daily scheduled patrol

Observes state; never restarts a workload

Authentication activity

Failed sign-ins and elevated-command anomalies

Scheduled bounded lookback

Reports aggregates; identities stay private

Patrol completion

Fresh trusted heartbeat

Independent scheduled watchdog

Warns on silence; never marks failure complete

Synthetic illustration / fixed evidence

Open the decision record

Select a synthetic event, then inspect how its evidence would move through each intended custody gate. Nothing here is live telemetry or acceptance evidence.

JavaScript is off. The complete default synthetic incident, intended monitoring scope, response guidance, and six-stage custody record remain readable below; event selection and replay controls are unavailable.

SF-2026-041 REPLAY 08:14 UTC

Failed sign-in rate crossed the written threshold

Eighteen rejected sign-ins were counted inside the synthetic 15-minute window. The deterministic rule fires above eight.

Critical Investigating

Authentication patrol · 15-minute synthetic fixture

Observed 18 rejected sign-ins
Threshold > 8 within 15 minutes
Sources 3 private groups

Deterministic rule receipt

AUTH-FAIL-015

Condition: failed_sign_ins_15m > 8
Observed: 18 rejected sign-ins
Verdict: FINDING / CRITICAL

ACTION TAKEN / FALSE

Why it matters

A sudden concentration of rejected sign-ins can indicate credential guessing or a misconfigured client. The count deserves investigation even though source identities remain private.

Recommended response

Confirm that no planned automation changed, inspect the private authentication record on the monitored host, and restrict the source at the network edge only after human verification.

Evidence custody tape

Collect to trusted completion

Swipe to inspect all six gates →

01 / Collect

captured

Input: Bounded authentication window
Output: 18 rejected sign-ins across three private source groups

Read-only collection completed; detailed identities stayed in private evidence.

02 / Sanitize

sanitized

Input: Private event records
Output: Counts, window, and source-group total only

Addresses, account labels, and raw log lines were removed from the replay packet.

03 / Validate

accepted

Input: Bounded authentication aggregate
Output: Schema-valid evidence

Required counts were present, non-negative, internally consistent, and free of unknown fields.

04 / Evaluate

finding

Input: 18 rejected sign-ins; threshold above 8
Output: AUTH-FAIL-015 matched

The observed count exceeded the written threshold. Severity came from policy, not model judgment.

05 / Report

completed

Input: Validated rule result
Output: Critical finding with reason and human response

The report states what happened and what to check without claiming compromise.

06 / Heartbeat

recorded

Input: Completed finding report
Output: Trusted completion with findings

A finding is a successful patrol outcome, so completion was recorded after the report became valid.

Security boundary

A product demo, not a production window.

All events, values, labels, timestamps, and rule outcomes on this page are synthetic illustrations of the intended deterministic pipeline. They are not operational acceptance evidence. The demo cannot contact the private system or perform a response.

No real logs, identities, addresses, topology, or credentials
No autonomous blocking, account changes, restarts, or remediation
No enterprise SOC, continuous real-time, or certification claim
No connection to a private or production endpoint