Mini-Ticket Example
This is how an actual ticket appears on the platform (this example is for learning purposes only).
DEMO-2025-0001
Alert: suspicious sign-in to an employee account from an unusual location
Evidence
A sign-in to the employee's account from a new IP at 09:14 AM, unlike the usual pattern of previous sessions.
Timeline
09:14 — Sign-in attempt
09:16 — Session established
09:21 — User reports they did not sign in
Affected user
Name: Ahmed Salem
Department: Finance
Tenure: 1.5 years
Previous incidents: None
Affected asset
Asset: Microsoft 365 account
Type: Digital identity
Criticality: 4/5
Suggested decision
Verify with the user first through a trusted channel, then escalate if they confirm the activity wasn't theirs.
Analyst notes
There are indicators worth verifying, but not enough evidence of a confirmed compromise. I recommend contacting the user to confirm the activity and reviewing active sessions before any containment action.