Confirmed lateral movement attempt on FS-Cluster-02 was blocked at the segment firewall. Recommend a full forensic image before restoring the host from backup.

Reviewed admin portal access logs. Source IP geolocates to an unusual region. Enforcing MFA on all privileged accounts as a precaution.

External port scan originated from a known scanning service. Low priority, but added the source range to the watchlist for correlation.

Phishing campaign templates matched a previously tracked threat actor. Blocked sender domains at the mail gateway and notified affected users.

Impossible-travel alert resolved as a false positive after confirming the user was on a corporate VPN exit node. Documented for tuning the detection rule.