Home
Alerts
CASE-6014
Ask Matters AI
Back to Alerts
Drew Kim generated a SAS token with 30-day expiry and full read/write access
High
Open
New alert — not yet reviewed by an analyst.
User:
drew.kim@acme-corp.com
Detected:
02 Jul 26, 19:19
Remediate with AI
Take action
Overview
Timeline
Evidence
Similar Cases
AI Summary
Automated threat verdict, key finding analysis, and flagged risk indicators.
87% confidence
Why 87% confidence?
✓
Download/transfer volume is 40× user baseline
✓
Pattern matches prior confirmed exfiltration incidents
✓
Elevated risk context detected for user account
✓
Unrecognized device or ASN/location involved
True positive — High confidence data exposure pattern
Drew Kim
triggered a data exposure signal on
Azure Blob
.
WHY FLAGGED
✓
Activity on
Azure Blob
deviates from this user's 90-day behavioral baseline
✓
Confidence score 87% — matches known data exposure pattern
Prevent Recurrence
AI suggested policy updates and proactive safeguards to prevent similar incidents.
AI Recommendations
High-confidence containment path generated based on verified incident patterns.
Restrict Azure Blob access + notify Sales lead
Accept
Override
Alert Info
Assigned to
Unassigned
Change…
Alert ID
CASE-6014
AI Investigation
High confidence data exposure pattern
Alerts
3 linked
Detection
Datastore types
Azure Blob
Policy
Data-Exposure-24 ↗
Risk type
Data Exposure
User
User
Drew Kim
drew.kim@acme-corp.com
Department
Sales
Ask Matters AI
Hi, I'm Matters AI. Ask me about your alerts, cases, or policies.
What are today's critical alerts?
Summarize this week's escalations
Who has the most unassigned cases?