SOC Security Analyst Workspace & Incident Workflow
Incident Response PortalAlert Correlation, State Transitions (New → Acknowledged → Investigating → Mitigated → Resolved), & Forensic Notes
Active Incidents:1 Under Management
Simulated End-to-End Operator-to-Satellite Compromise Sequencecritical
ID: inc-2026-001Investigating
INCIDENT ID: inc-2026-001critical
Simulated End-to-End Operator-to-Satellite Compromise Sequence
Transition State:
1. What Happened? & 2. Timestamp
Simulated End-to-End Operator-to-Satellite Compromise Sequence
Created: 2026-09-02T13:30:15Z
3. Primary Affected Asset & Owner
Cmdr. Sarah Vance (Flight Director)
Owner: Space Operations Command
4. Threat Confidence & 5. Correlated Alerts
Confirmed Defensive Simulation (High Confidence)
4 Correlated Multi-Stage Events
6. Downstream Reachable Assets
3 Assets in Blast Surface
Trajectory reaches Spacecraft OBC Flight Computer
7. Operational Mission Impact Translation:
Compromise of operator credentials exposes the mission control pipeline to unauthorized telecommand injection, potentially risking loss of payload control or vehicle orientation.
8. What to Investigate Next:
Audit SSO authentication tokens for Sarah Vance identity, check telecommand queue logs on CMD-API-01, and inspect Svalbard ground station baseband frame counters.
9. Recommended Defensive Action:
Force immediate session revocation, trigger emergency 2FA re-authentication, and freeze non-essential telecommand queues.
Analyst Forensic Notes & Audit Log (3)
Initial anomaly observed on Sarah Vance SSO account.
Traversed via MCC command API to Svalbard ground station.
Uplink frame replay anomaly correlated with onboard flight computer memory checksum warning.