Step 6 of 8

Incident timeline

HoneyNet reconstructed the attacker's path by correlating lure interactions with your cloud logs. Full breach sequence visible in under 3 minutes.

Active incident

Attacker: 185.220.101.47 · Dwell time: < 8 minutes

2026-06-13 · 09:08:14 UTC

Initial reconnaissance — M365 user enumeration

185.220.101.47 probed 14 M365 mailboxes via Exchange autodiscover. No lures hit. Logged by Defender but not alerted (below threshold).
2026-06-13 · 09:10:03 UTC

Internal route probe — DNS decoy hit

Attacker queried internal-logs.corp.contoso.com (HoneyNet DNS decoy). First lure contact. Alert queued.
2026-06-13 · 09:11:50 UTC

S3 bucket access — ghost bucket touched

AWS API call to list objects in corp-backup-archive-hn17 (HoneyNet lure). Canary token triggered. IP flagged.
2026-06-13 · 09:13:20 UTC

Credential discovery — fake secret accessed

Attacker accessed /prod/legacy/db-admin in Secrets Manager. Retrieved fake PG connection string from ghost S3 README.
2026-06-13 · 09:14:32 UTC — CONFIRMATION

Authentication attempt — honeypot credential used

fake_admin@corp.local password-sprayed against Entra ID. High-confidence breach indicator. IP blocked via Conditional Access in 3 seconds. Incident created.
2026-06-13 · 09:14:35 UTC

Automated response — IP blocked

HoneyNet triggered Entra ID Conditional Access block on 185.220.101.47. Incident escalated to SOC via Slack.
2026-06-13 · 09:14:41 UTC

Remediation plan generated

HoneyNet assembled 4 remediation steps: disable touched accounts, rotate exposed secrets, block IP range, open Jira ticket. Awaiting SOC approval.

Key insight: Your SIEM had 3 low-severity events from this session. None would have triggered an alert in isolation. HoneyNet correlated the lure touches into a single high-confidence incident in under 8 minutes of attacker dwell time.