Ransomware Blast-Radius Isolation
Follow a fictional endpoint alert from detection to containment. See how a simulated policy limits lateral movement.
Compliance Drift Remediation
Explore a fictional HIPAA / NIST CSF control audit and access-policy repair. The demo contains no real ePHI.
Autonomous Incident Triage
Follow fictional log correlation, root-cause analysis, and an SLA-aware engineering handoff that requires human approval.
Detect an endpoint anomaly
The fictional host DEMO-WS-07 shows a burst of encryption activity. The console flags the behavior for investigation.
Quarantine the affected host
The containment policy isolates the demo host while retaining a management channel. Turn the policy off to hold the action.
Simulate a firewall webhook
A local animation represents the firewall response blocking lateral traffic. No webhook or network request is sent.
Review the containment result
The fictional incident closes with no simulated data loss when containment is enabled. With policy off, response remains pending.
Run the daily control audit
A simulated daily audit compares the demo environment with its HIPAA / NIST CSF access-control baseline.
Spot unauthorized bucket access
The fictional bucket demo-ephi-sandbox has an unauthorized access grant. All records and permissions shown are invented.
Restore the zero-trust baseline
The simulated policy removes the unauthorized grant and restores least-privilege access. Disable it to keep the repair pending.
Review the simulated audit trail
Review the local remediation record or the open finding. This walkthrough illustrates control evidence; it is not a compliance certification.
Correlate the incident logs
Synthetic logs from DEMO-API-03 show retries and queue delays. The console groups them into one fictional incident.
Build a root-cause hypothesis
The simulated analysis links the delay to a saturated worker pool and prepares an evidence summary for an engineer to validate.
Prepare the SLA-aware handoff
The demo prepares DEMO-ENG-312 with a 15-minute response target and an evidence summary. An engineer must approve the handoff.
Keep the engineer in control
The walkthrough ends at the approval checkpoint. No ticket is created and no remediation is applied; a human owns the next decision.
Enable quarantine and a simulated firewall response, or hold both actions for review.
Restore the demo access baseline automatically, or leave the finding open for review.
Prepare an SLA-aware handoff for human approval, or hold the draft locally. No ticket is sent.
