Investigation | Cyberion EDR Console

Organisation Endpoint Type Severity Search payload

process_start on WS-ACME-01 high

Acme Corp · 03/06/2026 15:52:49 · source=agent

{
  "cmdline": "powershell -enc JABj...",
  "process_name": "powershell.exe",
  "user": "CORP\\jsmith"
}

Demo rule · alert #1

network_connect on WS-ACME-01 critical

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "protocol": "tcp",
  "remote_ip": "185.220.101.45",
  "remote_port": 4444
}
```
Demo rule · alert #1
process_start on WS-ACME-01 medium

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "cmdline": "cmd /c whoami",
  "process_name": "cmd.exe",
  "user": "CORP\\admin"
}
```
Demo rule · alert #1
network_connect on WS-ACME-01 low

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "protocol": "udp",
  "remote_ip": "8.8.8.8",
  "remote_port": 53
}
```
Demo rule · alert #1
agent_status on WS-ACME-01 low

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "message": "heartbeat ok",
  "status": "ok",
  "version": "1.2.0"
}
```
Demo rule · alert #1
network_threat on WS-ACME-01 high

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "action": "blocked",
  "reason": "known_c2",
  "remote_ip": "45.33.32.156"
}
```
Demo rule · alert #1
process_start on WS-ACME-01 critical

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "cmdline": "mimikatz privilege::debug",
  "process_name": "mimikatz.exe",
  "user": "SYSTEM"
}
```
Demo rule · alert #1
inventory_scan on WS-ACME-01 low

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "duration_ms": 12400,
  "packages_scanned": 847
}
```
Demo rule · alert #1
action_result on WS-ACME-01 low

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "action_type": "full_scan",
  "findings": 0,
  "status": "completed"
}
```
Demo rule · alert #1
network_delta on WS-ACME-01 medium

Acme Corp · 03/06/2026 15:52:49 · source=agent
```
{
  "closed_connections": 12,
  "new_connections": 3
}
```
Demo rule · alert #1

Investigation timeline