[00:00:01] SIEM engine initialized

[00:00:02] Monitoring telemetry streams...

[ALERT] Suspicious outbound connection

Rule: NET-104 / Unusual destination

analyst@lab:~$ select-alert --id 1042

Severity: MEDIUM Status: TRIAGE

analyst@lab:~$ tcpdump -nn -c 3

09:41:02 IP 10.0.4.21.51522 > 203.0.113.42.443

09:41:03 TLS session observed

analyst@lab:~$ triage --correlate --close

[CASE 1042] Evidence reviewed · disposition recorded · CLOSED

analyst@lab:~$ _