Reconcile four independent evidence bundles into one authoritative breach timeline, then find root cause and scope
Meridian Freight, a national trucking and logistics broker, has confirmed a breach after customer manifests and driver PII began circulating outside the company. Four teams, Email Security, Endpoint/EDR, Network/Perimeter, and Identity/IAM, have handed over independent evidence bundles from the Denver dispatch hub. Assemble one authoritative timeline from initial access to exfiltration, then determine root cause and scope.
Solstice Health's EDR fires a high-severity alert on a clinic workstation for a newly-installed remote-access tool. The alert turns out to be a legitimate, validly-signed IT support install, timed purely by coincidence. The real intrusion is an adversary-in-the-middle phishing kit that relayed a live MFA session and stole the resulting session cookie, and the analyst has to rule out the loud alert before the quiet one gets found.
Aurora BioTech's EDR console reports zero alerts anywhere in the environment during the suspected intrusion window. A closer asset-inventory check shows one legacy Linux build server never enrolled the EDR sensor in the first place, and its own auth log, not the EDR console, is the only place the intrusion is visible.
Kestrel Logistics confirms initial access and lateral movement to a host holding shipment-manifest data, but the perimeter proxy logs that would show whether that data actually left the network rolled off retention three days before anyone started looking. The case has to conclude honestly that exfiltration cannot be established from the available data, and name exactly what evidence would settle it.