Admin console
Unauthorized device detected
A previously unknown endpoint appeared in ACME Health's tenant environment. Fixture data is shown because the backend API is unavailable.
82
SOC2-CC7.2
ACME Health
v1
RMM + SIEM lite + compliance
Platform story
RMM
Asset visibilityEndpoint appeared from agent-simulator and was compared with approved inventory.
SIEM lite
Rule traceA deterministic rule converted a validated event into a critical alert.
Compliance
Auditor readyEvidence links source event, alert, delivery, and audit chain to SOC2-CC7.2.
Tenant
ACME Health
All records remain tenant-scoped.
Correlation
44444444-...-8444
One trace across event, alert, delivery, evidence, and audit.
Schema
v1
Envelope and payload validated before persistence.
Idempotency
sha256 tenant/event/rule/adapter
Duplicate events do not create duplicate deliveries.
Tenant posture
Controlled
1 critical workflow active
Detection latency
42s
Event to alert
Audit coverage
100%
All workflow steps recorded
Evidence chain
Linked
Event -> alert -> delivery
Immediate attention
Latest critical alert
Unauthorized device detected
rogue-laptop ยท ALT-1048
delivered
EVD-2206
Unauthorized Device Detection
Detection timeline
Workflow SLA
3m
discovery to auditor view
Material actions
5
all audit recorded
Delivery
idempotent
attempt persisted
Device discovered
agent-simulator
New endpoint fingerprint observed in ACME network segment.
Classified as unmanaged
rule-worker
Device ID not found in approved inventory for tenant ACME.
Risk score assigned
rule-worker
Risk score elevated because ownership and baseline are unknown.
Alert generated
alert-service
Critical unauthorized device alert opened for operator review.
Affected entity
Asset context
rogue-laptop
device_id: rogue-laptop
- Tenant
- ACME Health
- Observed IP
- 10.0.8.55
- Fingerprint
- fp-rogue-laptop
- OS guess
- macOS
- Classification
- unmanaged
- Last seen
- 12:01 UTC
- Collector
- agent-simulator
- Confidence
- 95%
No approved inventory record found for this device in the tenant inventory.
Command and quarantine actions require future command-policy API contracts.
API boundary
Data source
Current read mode
fixture fallback