INC-2026-0941
Qakbot lateral movement — payments segment
Owner Daniel Okafor · opened
APPEND-ONLY
RISK POSTURE
Executive overview
30-day exposure, active intelligence, and SOC throughput.
updated · live
RISK SCORE726 pts / 30d
ACTIVE CRITICAL175 correlated internally
ACTIVE HIGH14328 new since 00:00Z
OPEN ALERTS28641 unassigned
MEDIAN TRIAGE08m 42s1m 18s faster
INGEST + CORRELATION
Threat volume
indicatorsinternal sightings
Peak 18,422 on 2026-09-24correlation ratio 3.8%
SOC OPERATIONS
Alert throughput
1,842raised
1,706resolved
92.6%clearance
EXPOSURE
Targeted assets
| Asset group | Sightings | Δ 7d |
|---|---|---|
| identity-prod | 382 | +18% |
| payments-edge | 241 | +31% |
| corp-endpoints | 198 | -7% |
SOC ANALYST
Triage queue
updated · live
NEW36
UNASSIGNED41
MY QUEUE12
jk move Enter open
INCIDENT RESPONSE
Incident workspace
SEV-1
· live
THREAT HUNTING
Hunt workspace
ADMIN · INGESTION
Feeds
updated · live
ADMIN · ACCESS
Users and roles
ADMIN · GOVERNANCE
Audit log
ADMIN · PLATFORM
System health
API STATUS—GET /health
DATABASE—canonical store
FEEDS OK—enabled · polling
WS CHANNELS—bus subscribers
TL
SENTINOVA CTI
Sign in
SEEDED PERSONAS
Passwords are seeded demo credentials for the ThreatLens reference build.