Select scenario
CRITICALINV-4471 · Today
Sensitive Fiber Network Design Document Shared Outside Organization
Scenario: Confidential Network Architecture Leak
Internal Network ArchitectureInfrastructure PlanningVendor InformationProprietary Engineering Designs
Step 0 of 7
Incident detected
Evidence Collection Agent
Sweeps the digital estate for relevant signals
OutlookTeamsSharePointOneDriveM365 CopilotFile Activity Logs
Timeline Reconstruction Agent
Builds a defensible chronology of the incident
Unified Audit LogPurviewEndpoint telemetry
Communication Intelligence Agent
Understands who discussed what, and when
EmailsTeams messagesMeeting transcripts
Data Impact Agent
Determines what information may have been exposed
Purview Information ProtectionFabric OneLakeDocument classifiers
Regulatory Compliance Agent
Maps exposure to obligations and contracts
Privacy obligationsIndustry regulationsInternal policyContracts
Root Cause Analysis Agent
Explains how the event actually happened
Defender for EndpointDefender for Cloud AppsEntra sign-in logs
Response Recommendation Agent
Turns findings into an executive action plan
Purview DLPSentinel playbooksHR & policy catalogue
Data impact risk
0
Highly sensitive engineering IP with infrastructure and vendor detail.
Compliance Risk Dashboard
Privacy obligationsNo personal data exposed
Industry regulationsCritical infrastructure review
Contractual obligationsVendor NDA clause 7.2
Internal policySEC-114 violated
Investigation Playback
Scrub the timeline to replay the incident event by event.
2:37 PM · Event 8 of 8
Investigation Started
InvestigationAI orchestrated 7 agents across 1,247 evidence sources.
Document CreatedDocument EditedMeeting DiscussedDownloadedShared ExternallyAttachment OpenedFlagged by AIInvestigation Started
Response Recommendations
Immediate
- Revoke access
- Notify security team
- Preserve evidence
Near-Term
- Additional DLP controls
- Employee coaching
- Policy update
Long-Term
- Automated classification
- Enhanced monitoring
Executive Copilot
Investigation INV-4471 is complete. Ask me anything about the incident.
Scenario Summary
CRITICAL
Confidential Network Architecture Leak
Sensitive Fiber Network Design Document Shared Outside Organization
A highly confidential engineering document left the organization through a downloaded copy forwarded to a vendor domain.
Evidence events
584
Risk score
92 / 100
Exposure scope
Limited — 1 external recipient
Root cause confidence
88%
Revoke access and recall external message
Preserve evidence package for legal
Deploy DLP control for engineering IP