Synthetic data & simulated integrations. Every incident, host, identity, indicator and detection source on this page is fabricated for portfolio demonstration. There is no live ServiceNow instance, SIEM, EDR or identity provider connected, and this project is not affiliated with or endorsed by ServiceNow.

Evidence & Audit

Chain of custody

Every artifact carries a collector, timestamp and simulated integrity digest. Every consequential action produces an audit entry that names the actor and whether a human approved it.

Evidence items

7

Audit entries

11

Human approvals

3

Automation entries

7

Digests are fabricated placeholders over synthetic content — they demonstrate the integrity model, they do not attest to anything.

Evidence register

log excerptIdP session replay windowSIR-2041

02:04:11Z session S-88213 issued; 02:08:02Z reuse from second region

automation:pb-identity · 2026-08-14T02:15:00Z · digest sha256:9f2c…a1d0 (synthetic)

network indicatorSource range (synthetic)SIR-2041

203.0.113.0/24 (documentation range)

analyst:j.whitfield · 2026-08-14T02:22:00Z · digest sha256:41be…77c4 (synthetic)

analyst noteClick-through scopeSIR-2042

2 of 9 recipients opened the link; no credential POST observed

analyst:d.reyes · 2026-08-14T04:05:00Z · digest sha256:0c73…be19 (synthetic)

hashLoader sample digest (synthetic)SIR-2043

sha256:0000000000000000000000000000000000000000000000000000000000000043

automation:pb-endpoint · 2026-08-14T04:57:00Z · digest sha256:aa10…4f52 (synthetic)

screenshot referenceBucket policy before revertSIR-2044

artifact://synthetic/bucket-policy-2044.png

automation:pb-cloud · 2026-08-13T21:06:00Z · digest sha256:5d81…0b3a (synthetic)

log excerptEgress volume baseline deltaSIR-2045

05:03Z 1.9 GB in 4 min vs 48 MB/hr trailing baseline

automation:pb-exfil · 2026-08-14T05:07:00Z · digest sha256:7e46…c9d1 (synthetic)

analyst noteDownload manifest summarySIR-2047

412 documents, 3 repositories, all within prior access grants

analyst:d.reyes · 2026-08-13T19:40:00Z · digest sha256:b214…8e77 (synthetic)

Audit trail

In-memory for the demo; production requires immutable storage.

  1. systemIncident createdSIR-20412026-08-14T02:10:00Z

    intake-normalizer — Correlated 2 signals under dedupe key idp:priv-token:as-01

  2. automationRouted to Incident Response (IR)SIR-20412026-08-14T02:11:00Z

    routing-engine — Rule: P1 or critical severity -> Incident Response

  3. automationExecuted low-impact actionSIR-20412026-08-14T02:15:00Z

    pb-identity — Snapshot authentication history (24h)

  4. analystApproved containmenthuman approvedSIR-20412026-08-14T02:31:00Z

    j.whitfield — Approved credential rotation; session revocation held for second approver

  5. automationRouted to SOC Tier 2 AnalysisSIR-20422026-08-14T03:41:00Z

    routing-engine — Rule: P2, or tier0/tier1 production asset -> SOC Tier 2

  6. automationQuarantined messagesSIR-20422026-08-14T03:58:00Z

    pb-phish — 9 messages matched dedupe key mail:lookalike:corp

  7. automationBlocked auto-isolationSIR-20432026-08-14T04:55:00Z

    pb-endpoint — High-impact action on high-severity incident requires human approval

  8. automationSnapshotted resource policySIR-20442026-08-13T21:06:00Z

    pb-cloud — Pre-mutation snapshot stored as EV-4005

  9. automationPreserved evidenceSIR-20452026-08-14T05:06:00Z

    pb-exfil — Netflow and archive metadata captured before any containment

  10. analystDeclined auto-closehuman approvedSIR-20472026-08-13T22:14:00Z

    d.reyes — High-severity incident: closure requires human validation

  11. analystValidated containmenthuman approvedSIR-20482026-08-14T02:00:00Z

    d.reyes — Edge rate limiting confirmed effective