{ "generatedAt": "2026-09-14T04:00:01.860Z", "organization": "Contoso (demo)", "count": 89, "findings": [ { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": "NLwFfSGzxGEdHZB7FsTmq", "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "aws:NLwFfSGzxGEdHZB7FsTmq:aws-bedrock", "lane": "cloud.aws", "appKey": "aws-bedrock", "appId": null, "appDisplayName": "Amazon Bedrock", "vendor": "Amazon Web Services", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "CloudTrail eventSource bedrock.amazonaws.com" ], "sanctioned": null, "riskScore": 90, "severity": "critical", "userCount": 6, "orgWide": false, "users": [ { "id": "arn:aws:sts::123456789012:assumed-role/Developers/alice@contoso.com", "upn": "alice@contoso.com", "source": "aws", "department": null, "displayName": "alice@contoso.com via Developers" }, { "id": "arn:aws:iam::123456789012:user/dave", "upn": "dave", "source": "aws", "department": null, "displayName": "dave" }, { "id": "arn:aws:iam::123456789012:user/frank", "upn": "frank", "source": "aws", "department": null, "displayName": "frank" }, { "id": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "upn": "grace@contoso.com", "source": "aws", "department": null, "displayName": "grace@contoso.com via PlatformEngineer" }, { "id": "arn:aws:sts::123456789012:assumed-role/Developers/mia@contoso.com", "upn": "mia@contoso.com", "source": "aws", "department": null, "displayName": "mia@contoso.com via Developers" }, { "id": "arn:aws:iam::123456789012:root", "upn": "root", "source": "aws", "department": null, "displayName": "root" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "cloudtrail_activity", "detail": { "services": [ "bedrock.amazonaws.com" ], "topActions": [ { "name": "InvokeModel", "count": 17 }, { "name": "ListFoundationModels", "count": 9 }, { "name": "Converse", "count": 9 }, { "name": "GetFoundationModel", "count": 5 }, { "name": "CreateAgent", "count": 2 }, { "name": "CreateKnowledgeBase", "count": 1 }, { "name": "PutModelInvocationLoggingConfiguration", "count": 1 }, { "name": "DeleteModelInvocationLoggingConfiguration", "count": 1 }, { "name": "CreateModelCustomizationJob", "count": 1 }, { "name": "PutFoundationModelEntitlement", "count": 1 } ], "invocationLogging": false }, "source": "aws:cloudtrail", "summary": "AWS (demo) (123456789012): Amazon Bedrock, 47 CloudTrail events by 6 identities, 29 write, 23 invocations, 4 denied, 3 resources in 90 days across eu-west-1, us-east-1, us-west-2", "observedAt": "2026-09-13T15:44:00.000Z" }, { "kind": "root_activity", "detail": { "events": [ "ListFoundationModels", "PutFoundationModelEntitlement" ] }, "source": "aws:cloudtrail", "summary": "Root user called Amazon Bedrock APIs", "observedAt": "2026-09-05T22:36:00.000Z" }, { "kind": "access_denied", "detail": { "arn": "arn:aws:iam::123456789012:user/frank", "errorCode": "AccessDeniedException" }, "source": "aws:cloudtrail", "summary": "frank was denied InvokeModel in us-east-1", "observedAt": "2026-09-10T10:57:00.000Z" }, { "kind": "access_denied", "detail": { "arn": "arn:aws:iam::123456789012:user/frank", "errorCode": "AccessDeniedException" }, "source": "aws:cloudtrail", "summary": "frank was denied InvokeModel in us-east-1", "observedAt": "2026-09-09T10:04:00.000Z" }, { "kind": "access_denied", "detail": { "arn": "arn:aws:iam::123456789012:user/frank", "errorCode": "AccessDeniedException" }, "source": "aws:cloudtrail", "summary": "frank was denied InvokeModel in us-east-1", "observedAt": "2026-09-08T10:11:00.000Z" }, { "kind": "access_denied", "detail": { "arn": "arn:aws:iam::123456789012:user/frank", "errorCode": "AccessDeniedException" }, "source": "aws:cloudtrail", "summary": "frank was denied CreateAgent in eu-west-1", "observedAt": "2026-09-09T10:10:00.000Z" }, { "kind": "bedrock:agent", "detail": { "arn": "arn:aws:bedrock:us-east-1:123456789012:agent/AGENT1234", "status": "PREPARED", "description": "Answers tier-1 support questions from the ticket archive" }, "source": "aws:inventory", "summary": "agent 'support-copilot' in us-east-1", "observedAt": null }, { "kind": "bedrock:knowledge-base", "detail": { "arn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/KB5678", "status": "ACTIVE" }, "source": "aws:inventory", "summary": "knowledge base 'support-tickets-kb' in us-east-1", "observedAt": null }, { "kind": "bedrock:custom-model", "detail": { "arn": "arn:aws:bedrock:us-west-2:123456789012:custom-model/tickets-ft-v2", "baseModel": "amazon.titan-text-express-v1", "customization": "FINE_TUNING" }, "source": "aws:inventory", "summary": "custom model 'tickets-ft-v2' in us-west-2", "observedAt": null } ], "tags": [ "aws", "account:123456789012", "root-used", "denied-attempts", "builders", "invocations", "custom-models", "agents", "invocations-unlogged" ], "recommendations": [ "The root user of account 123456789012 called Amazon Bedrock APIs. Root should never do day-to-day work: move this to an IAM role, enable MFA on root, and alert on any further root activity.", "Bedrock model invocation logging is off in account 123456789012, so prompts and completions leave no record. Turn it on (CloudWatch Logs or S3) before this becomes the default way people reach models.", "4 calls were denied by IAM. People are trying to reach Amazon Bedrock; decide whether to grant it through a reviewed role or block it with a service control policy so the attempts stop.", "Custom or fine-tuned models exist. Confirm what data trained them, that the training bucket is classified, and that the models are not shared across accounts.", "Agents or knowledge bases are configured. Review which S3 buckets, databases, and APIs they can reach; a knowledge base is a permanent grant of that data to whoever can query the agent." ], "firstSeen": "2026-08-24T09:00:00.000Z", "lastSeen": "2026-09-13T15:44:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 2 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 5 }, { "date": "2026-09-06", "count": 3 }, { "date": "2026-09-07", "count": 4 }, { "date": "2026-09-08", "count": 6 }, { "date": "2026-09-09", "count": 6 }, { "date": "2026-09-10", "count": 5 }, { "date": "2026-09-11", "count": 4 }, { "date": "2026-09-12", "count": 3 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 0 } ], "events": 47, "lastAt": "2026-09-13T15:44:00.000Z", "firstAt": "2026-08-24T09:00:00.000Z", "regions": [ "eu-west-1", "us-east-1", "us-west-2" ], "rootUsed": true, "services": [ "bedrock.amazonaws.com" ], "accountId": "123456789012", "resources": [ { "arn": "arn:aws:bedrock:us-east-1:123456789012:agent/AGENT1234", "name": "support-copilot", "type": "bedrock:agent", "detail": { "status": "PREPARED", "description": "Answers tier-1 support questions from the ticket archive" }, "region": "us-east-1" }, { "arn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/KB5678", "name": "support-tickets-kb", "type": "bedrock:knowledge-base", "detail": { "status": "ACTIVE" }, "region": "us-east-1" }, { "arn": "arn:aws:bedrock:us-west-2:123456789012:custom-model/tickets-ft-v2", "name": "tickets-ft-v2", "type": "bedrock:custom-model", "detail": { "baseModel": "amazon.titan-text-express-v1", "customization": "FINE_TUNING" }, "region": "us-west-2" } ], "identities": [ { "arn": "arn:aws:sts::123456789012:assumed-role/Developers/mia@contoso.com", "name": "mia@contoso.com", "type": "AssumedRole", "denied": 0, "events": 19 }, { "arn": "arn:aws:sts::123456789012:assumed-role/Developers/alice@contoso.com", "name": "alice@contoso.com", "type": "AssumedRole", "denied": 0, "events": 17 }, { "arn": "arn:aws:iam::123456789012:user/frank", "name": "frank", "type": "IAMUser", "denied": 4, "events": 4 }, { "arn": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "name": "grace@contoso.com", "type": "AssumedRole", "denied": 0, "events": 3 }, { "arn": "arn:aws:iam::123456789012:user/dave", "name": "dave", "type": "IAMUser", "denied": 0, "events": 2 }, { "arn": "arn:aws:iam::123456789012:root", "name": "root", "type": "Root", "denied": 0, "events": 2 } ], "topActions": [ { "name": "InvokeModel", "count": 17 }, { "name": "ListFoundationModels", "count": 9 }, { "name": "Converse", "count": 9 }, { "name": "GetFoundationModel", "count": 5 }, { "name": "CreateAgent", "count": 2 }, { "name": "CreateKnowledgeBase", "count": 1 }, { "name": "PutModelInvocationLoggingConfiguration", "count": 1 }, { "name": "DeleteModelInvocationLoggingConfiguration", "count": 1 }, { "name": "CreateModelCustomizationJob", "count": 1 }, { "name": "PutFoundationModelEntitlement", "count": 1 } ], "windowDays": 90, "invocations": 23, "writeEvents": 29, "deniedEvents": 4, "connectionName": "AWS (demo)", "invocationLogging": false }, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "tPH00sX_Cba9etj7T4St8", "createdAt": "2026-09-14T02:32:42.365Z", "updatedAt": "2026-09-14T02:32:41.973Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002", "lane": "m365.oauth_consent", "appKey": "openai-chatgpt", "appId": "aaaa0002-0000-4000-8000-000000000002", "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "publisher 'openai, l.l.c.'" ], "sanctioned": null, "riskScore": 85, "severity": "critical", "userCount": 4, "orgWide": true, "users": [ { "id": "u4", "upn": "dave@contoso.com", "source": "signin", "signIns": 12, "department": null, "displayName": "Dave Patel", "lastSignInAt": "2026-09-10T09:28:00.000Z" }, { "id": "u5", "upn": "erin@contoso.com", "source": "signin", "signIns": 8, "department": null, "displayName": "Erin Walsh", "lastSignInAt": "2026-09-11T11:21:00.000Z" }, { "id": "u2", "upn": "bob@contoso.com", "source": "signin", "signIns": 4, "department": null, "displayName": "Bob Okafor", "lastSignInAt": "2026-09-10T08:28:00.000Z" }, { "id": "u1", "upn": "alice@contoso.com", "source": "signin", "signIns": 2, "department": null, "displayName": "Alice Ng", "lastSignInAt": "2026-08-29T10:52:00.000Z" } ], "permissions": [ "Files.Read.All", "Mail.Read", "User.Read", "offline_access" ], "permissionTier": "high", "dataClasses": [ "directory", "email", "files" ], "grants": [ { "grantId": "g-chatgpt-all", "consentType": "AllPrincipals", "permissions": [ "Files.Read.All", "Mail.Read", "User.Read", "offline_access" ], "principalId": null, "principalUpn": null, "resourceDisplayName": null, "principalDisplayName": null } ], "evidence": [ { "kind": "service_principal", "detail": { "appId": "aaaa0002-0000-4000-8000-000000000002", "homepage": "https://chatgpt.com", "objectId": "sp-chatgpt", "publisherName": "OpenAI, L.L.C.", "accountEnabled": true, "verifiedPublisher": "OpenAI" }, "source": "graph:servicePrincipals", "summary": "Service principal 'ChatGPT' present in tenant (publisher: OpenAI, L.L.C.)", "observedAt": "2026-03-10T09:30:00.000Z" }, { "kind": "delegated_grant", "detail": { "grantId": "g-chatgpt-all", "resourceId": "sp-graph", "consentType": "AllPrincipals", "principalId": null }, "source": "graph:oauth2PermissionGrants", "summary": "all users (admin consent) granted Files.Read.All, Mail.Read, User.Read, offline_access" }, { "kind": "sign_in_activity", "detail": { "clients": [ { "count": 18, "client": "Browser" }, { "count": 8, "client": "Mobile Apps and Desktop clients" } ], "countries": [ { "count": 26, "country": "US" } ], "windowDays": 30, "activeUsers7d": 3 }, "source": "graph:auditLogs/signIns", "summary": "26 successful sign-ins by 4 people in the last 30 days (1 failed)", "observedAt": "2026-09-11T11:21:00.000Z" }, { "kind": "consent_event", "detail": { "scopes": [ "Mail.Read", "Files.Read.All", "offline_access", "User.Read" ], "recordId": "ual-0098", "isAdminConsent": true }, "source": "graph:security/auditLog", "summary": "Consent to application. (admin consent) by admin@contoso.com: Mail.Read, Files.Read.All, offline_access, User.Read", "observedAt": "2026-08-27T10:18:00.000Z" } ], "tags": [ "active-7d", "admin-consent-audited" ], "recommendations": [ "ChatGPT has tenant-wide admin consent. Confirm a documented approval exists, or revoke the grant and require per-user consent.", "Scopes expose directory, email, files. Evaluate the vendor's retention and training terms before allowing continued use.", "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "4 people signed in during the last 30 days under the tenant-wide consent. Start the conversation with them.", "Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access." ], "firstSeen": "2026-03-10T09:30:00.000Z", "lastSeen": "2026-09-11T11:21:00.000Z", "usage": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 5 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 2 }, { "date": "2026-08-29", "count": 2 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 2 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "clients": [ { "count": 18, "client": "Browser" }, { "count": 8, "client": "Mobile Apps and Desktop clients" } ], "signIns": 26, "countries": [ { "count": 26, "country": "US" } ], "windowDays": 30, "activeUsers": 4, "lastSignInAt": "2026-09-11T11:21:00.000Z", "activeUsers7d": 3, "failedSignIns": 1 }, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "JdSTO2zAdYnh8U-RtZevh", "createdAt": "2026-09-14T01:25:59.370Z", "updatedAt": "2026-09-14T01:26:01.010Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001", "lane": "m365.oauth_consent", "appKey": "otter-ai", "appId": "aaaa0001-0000-4000-8000-000000000001", "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "confirmed", "matchReasons": [ "publisher 'aisense inc'" ], "sanctioned": null, "riskScore": 85, "severity": "critical", "userCount": 3, "orgWide": false, "users": [ { "id": "u1", "upn": "alice@contoso.com", "source": "both", "signIns": 10, "department": "Sales", "displayName": "Alice Ng", "lastSignInAt": "2026-09-12T09:14:00.000Z" }, { "id": "u2", "upn": "bob@contoso.com", "source": "both", "signIns": 6, "department": "Finance", "displayName": "Bob Okafor", "lastSignInAt": "2026-09-06T11:56:00.000Z" }, { "id": "u3", "upn": "carol@contoso.com", "source": "grant", "signIns": 0, "department": "HR", "displayName": "Carol Diaz" } ], "permissions": [ "Calendars.Read", "Mail.Read", "OnlineMeetingTranscript.Read.All", "OnlineMeetings.Read", "User.Read", "offline_access", "openid", "profile" ], "permissionTier": "high", "dataClasses": [ "calendar", "directory", "email", "meetings" ], "grants": [ { "grantId": "g-otter-1", "consentType": "Principal", "permissions": [ "Calendars.Read", "OnlineMeetingTranscript.Read.All", "OnlineMeetings.Read", "User.Read", "offline_access", "openid", "profile" ], "principalId": "u1", "principalUpn": "alice@contoso.com", "resourceDisplayName": null, "principalDisplayName": "Alice Ng" }, { "grantId": "g-otter-2", "consentType": "Principal", "permissions": [ "Calendars.Read", "OnlineMeetings.Read", "User.Read", "offline_access", "openid", "profile" ], "principalId": "u2", "principalUpn": "bob@contoso.com", "resourceDisplayName": null, "principalDisplayName": "Bob Okafor" }, { "grantId": "g-otter-3", "consentType": "Principal", "permissions": [ "Calendars.Read", "User.Read", "offline_access", "openid", "profile" ], "principalId": "u3", "principalUpn": "carol@contoso.com", "resourceDisplayName": null, "principalDisplayName": "Carol Diaz" }, { "grantId": "ara-otter-1", "grantedAt": "2026-06-01T00:00:00.000Z", "consentType": "Application", "permissions": [ "Mail.Read" ], "resourceDisplayName": "Microsoft Graph" } ], "evidence": [ { "kind": "service_principal", "detail": { "appId": "aaaa0001-0000-4000-8000-000000000001", "homepage": "https://otter.ai", "objectId": "sp-otter", "publisherName": "AISense Inc", "accountEnabled": true, "verifiedPublisher": null }, "source": "graph:servicePrincipals", "summary": "Service principal 'Otter.ai' present in tenant (publisher: AISense Inc)", "observedAt": "2026-05-02T10:00:00.000Z" }, { "kind": "delegated_grant", "detail": { "grantId": "g-otter-1", "resourceId": "sp-graph", "consentType": "Principal", "principalId": "u1" }, "source": "graph:oauth2PermissionGrants", "summary": "alice@contoso.com granted Calendars.Read, OnlineMeetingTranscript.Read.All, OnlineMeetings.Read, User.Read, offline_access, openid, profile" }, { "kind": "delegated_grant", "detail": { "grantId": "g-otter-2", "resourceId": "sp-graph", "consentType": "Principal", "principalId": "u2" }, "source": "graph:oauth2PermissionGrants", "summary": "bob@contoso.com granted Calendars.Read, OnlineMeetings.Read, User.Read, offline_access, openid, profile" }, { "kind": "delegated_grant", "detail": { "grantId": "g-otter-3", "resourceId": "sp-graph", "consentType": "Principal", "principalId": "u3" }, "source": "graph:oauth2PermissionGrants", "summary": "carol@contoso.com granted Calendars.Read, User.Read, offline_access, openid, profile" }, { "kind": "application_grant", "detail": { "appRoleId": "810c84a8-4a9e-49e6-bf7d-12d183f40d01", "resourceId": "sp-graph", "assignmentId": "ara-otter-1" }, "source": "graph:appRoleAssignments", "summary": "Application permission Mail.Read on Microsoft Graph", "observedAt": "2026-06-01T00:00:00.000Z" }, { "kind": "sign_in_activity", "detail": { "clients": [ { "count": 10, "client": "Browser" }, { "count": 6, "client": "Mobile Apps and Desktop clients" } ], "countries": [ { "count": 15, "country": "US" }, { "count": 1, "country": "GB" } ], "windowDays": 30, "activeUsers7d": 1 }, "source": "graph:auditLogs/signIns", "summary": "16 successful sign-ins by 2 people in the last 30 days", "observedAt": "2026-09-12T09:14:00.000Z" }, { "kind": "consent_event", "detail": { "scopes": [], "recordId": "ual-0097", "isAdminConsent": false }, "source": "graph:security/auditLog", "summary": "Add app role assignment to service principal. by admin@contoso.com", "observedAt": "2026-08-25T10:40:00.000Z" } ], "tags": [ "unverified-publisher", "active-7d" ], "recommendations": [ "Otter.ai holds application permissions and can read data with no user signed in. Review the app role assignments and remove any that are not essential.", "Scopes expose calendar, directory, email, meetings. Evaluate the vendor's retention and training terms before allowing continued use.", "Sign-ins came from 2 countries (US, GB). Check that matches where these people work.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-05-02T10:00:00.000Z", "lastSeen": "2026-09-12T09:14:00.000Z", "usage": { "daily": [ { "date": "2026-08-16", "count": 2 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 1 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 2 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 2 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 2 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "clients": [ { "count": 10, "client": "Browser" }, { "count": 6, "client": "Mobile Apps and Desktop clients" } ], "signIns": 16, "countries": [ { "count": 15, "country": "US" }, { "count": 1, "country": "GB" } ], "windowDays": 30, "activeUsers": 2, "lastSignInAt": "2026-09-12T09:14:00.000Z", "activeUsers7d": 1, "failedSignIns": 0 }, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "JdSTO2zAdYnh8U-RtZevh", "createdAt": "2026-09-14T01:25:59.346Z", "updatedAt": "2026-09-14T01:26:00.998Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt", "lane": "code.repositories", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: openai", "secret: OpenAI project key", "package: github.com/sashabaranov/go-openai", "endpoint: api.openai.com", "alert: openai_api_key" ], "sanctioned": null, "riskScore": 81, "severity": "critical", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/customer-portal", "contoso/data-pipeline", "contoso/go-gateway", "contoso/research-notebooks" ], "configs": [], "packages": [ { "name": "openai", "repos": 1, "ecosystem": "npm" }, { "name": "openai", "repos": 1, "ecosystem": "pypi" }, { "name": "github.com/sashabaranov/go-openai", "repos": 1, "ecosystem": "go" } ], "endpoints": [ { "host": "api.openai.com", "repos": 2 } ] }, "source": "repos:fixture", "summary": "ChatGPT in 4 repositories via GitHub (demo): packages openai, openai, github.com/sashabaranov/go-openai; direct calls to api.openai.com; 2 hardcoded or alerted keys", "observedAt": "2026-09-13T01:26:01.958Z" }, { "kind": "code_secret", "detail": { "path": "config.py", "repo": "contoso/research-notebooks" }, "source": "repos:fixture", "summary": "OpenAI project key in contoso/research-notebooks at config.py" }, { "kind": "code_alert", "detail": { "path": "pipeline/summarise.py", "repo": "contoso/data-pipeline" }, "source": "repos:fixture", "summary": "Secret scanning: openai_api_key in contoso/data-pipeline at pipeline/summarise.py" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" } ], "tags": [ "source-code", "fixture", "hardcoded-keys", "public-exposure", "corroborated" ], "recommendations": [ "2 keys for ChatGPT are in source control, including a public repository. Rotate them now, move to a secret manager, and turn on push protection so it cannot happen again.", "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "ChatGPT SDKs appear in 4 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.", "Direct HTTP calls to api.openai.com bypass any SDK-level controls. Add the hosts to egress policy and prefer the sanctioned client library." ], "firstSeen": null, "lastSeen": "2026-09-13T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/customer-portal", "name": "contoso/customer-portal", "signals": [ "package", "endpoint" ], "pushedAt": "2026-09-13T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "package", "alert" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/go-gateway", "name": "contoso/go-gateway", "signals": [ "package", "endpoint" ], "pushedAt": "2026-09-12T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/research-notebooks", "name": "contoso/research-notebooks", "signals": [ "secret" ], "pushedAt": "2026-09-02T01:26:01.958Z", "isPrivate": false } ], "alerts": 1, "configs": [], "secrets": 1, "signals": { "alert": 1, "config": 0, "secret": 1, "package": 3, "endpoint": 2, "model_file": 0 }, "packages": [ { "name": "openai", "repos": 1, "ecosystem": "npm" }, { "name": "openai", "repos": 1, "ecosystem": "pypi" }, { "name": "github.com/sashabaranov/go-openai", "repos": 1, "ecosystem": "go" } ], "provider": "fixture", "endpoints": [ { "host": "api.openai.com", "repos": 2 } ], "lastPushAt": "2026-09-13T01:26:01.958Z", "modelFiles": 0, "publicRepos": 1, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mail:openai-chatgpt", "pp:shared_openai", "dlp:openai-chatgpt", "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt", "mde:openai-chatgpt" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.166Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:google-gemini", "lane": "code.repositories", "appKey": "google-gemini", "appId": null, "appDisplayName": "Gemini", "vendor": "Google", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: google-generativeai", "secret: Google API key", "endpoint: generativelanguage.googleapis.com" ], "sanctioned": null, "riskScore": 76, "severity": "critical", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/research-notebooks" ], "configs": [], "packages": [ { "name": "google-generativeai", "repos": 1, "ecosystem": "pypi" } ], "endpoints": [ { "host": "generativelanguage.googleapis.com", "repos": 1 } ] }, "source": "repos:fixture", "summary": "Gemini in 1 repository via GitHub (demo): packages google-generativeai; direct calls to generativelanguage.googleapis.com; 1 hardcoded or alerted keys", "observedAt": "2026-09-02T01:26:01.958Z" }, { "kind": "code_secret", "detail": { "path": "config.py", "repo": "contoso/research-notebooks" }, "source": "repos:fixture", "summary": "Google API key in contoso/research-notebooks at config.py" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini)" } ], "tags": [ "source-code", "fixture", "hardcoded-keys", "public-exposure", "corroborated" ], "recommendations": [ "1 key for Gemini is in source control, including a public repository. Rotate them now, move to a secret manager, and turn on push protection so it cannot happen again.", "Gemini trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Gemini SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.", "Direct HTTP calls to generativelanguage.googleapis.com bypass any SDK-level controls. Add the hosts to egress policy and prefer the sanctioned client library." ], "firstSeen": null, "lastSeen": "2026-09-02T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/research-notebooks", "name": "contoso/research-notebooks", "signals": [ "package", "secret", "endpoint" ], "pushedAt": "2026-09-02T01:26:01.958Z", "isPrivate": false } ], "alerts": 0, "configs": [], "secrets": 1, "signals": { "alert": 0, "config": 0, "secret": 1, "package": 1, "endpoint": 1, "model_file": 0 }, "packages": [ { "name": "google-generativeai", "repos": 1, "ecosystem": "pypi" } ], "provider": "fixture", "endpoints": [ { "host": "generativelanguage.googleapis.com", "repos": 1 } ], "lastPushAt": "2026-09-02T01:26:01.958Z", "modelFiles": 0, "publicRepos": 1, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.180Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mdca:40311", "lane": "m365.cloud_app_discovery", "appKey": "deepseek", "appId": null, "appDisplayName": "DeepSeek", "vendor": "DeepSeek", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "domain deepseek.com" ], "sanctioned": null, "riskScore": 75, "severity": "critical", "userCount": 2, "orgWide": false, "users": [ { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "noah@contoso.com", "upn": "noah@contoso.com", "source": "network", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "network_discovery", "detail": { "domains": [ "deepseek.com", "chat.deepseek.com" ], "category": "generativeAi", "mdcaAppId": "40311", "riskScore": 2, "ipAddresses": 2, "downloadBytes": 35651584 }, "source": "graph:security/dataDiscovery/cloudAppDiscovery", "summary": "Seen on the network via Defender for Endpoint, Palo Alto log collector: 2 users, 2130 transactions, 275 MB uploaded in 30 days", "observedAt": "2026-09-12T01:25:59.427Z" } ], "tags": [ "network", "no-entra-footprint", "low-defender-score" ], "recommendations": [ "275 MB uploaded to DeepSeek in 30 days from 2 people. Check what data is leaving with Defender's file and session policies.", "DeepSeek shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.", "Defender rates DeepSeek 2/10 on security, compliance, and legal criteria. Treat it as unsuitable for work data unless the vendor closes those gaps.", "DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training." ], "firstSeen": null, "lastSeen": "2026-09-12T01:25:59.427Z", "usage": null, "network": { "domains": [ "deepseek.com", "chat.deepseek.com" ], "streams": [ "Defender for Endpoint", "Palo Alto log collector" ], "mdcaTags": [ "Generative AI" ], "mdcaAppId": "40311", "userCount": 2, "lastSeenAt": "2026-09-12T01:25:59.427Z", "periodDays": 30, "uploadBytes": 288358400, "mdcaCategory": "generativeAi", "transactions": 2130, "downloadBytes": 35651584, "mdcaRiskScore": 2, "ipAddressCount": 2 }, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "V3q69yhE6ynFkRBaAe9xg", "createdAt": "2026-09-14T01:25:59.641Z", "updatedAt": "2026-09-14T01:25:59.422Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "dlp:openai-chatgpt", "lane": "m365.purview_dlp", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT: sensitive data", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "DLP target chatgpt.com" ], "sanctioned": null, "riskScore": 70, "severity": "high", "userCount": 3, "orgWide": false, "users": [ { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [ "files" ], "grants": [], "evidence": [ { "kind": "dlp_activity", "detail": { "domains": [ { "count": 5, "domain": "chatgpt.com" } ], "byAction": { "warn": 0, "audit": 3, "block": 1, "unknown": 0, "override": 1 }, "policies": [ { "name": "Endpoint DLP - Customer data", "count": 2 }, { "name": "Endpoint DLP - Credentials", "count": 1 }, { "name": "Endpoint DLP - HR data", "count": 1 } ], "applications": [ { "count": 3, "application": "chrome.exe" }, { "count": 1, "application": "msedge.exe" } ], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 120 }, { "name": "U.S. Social Security Number (SSN)", "count": 1, "matches": 42 }, { "name": "Credit Card Number", "count": 3, "matches": 19 }, { "name": "Azure Storage Account Key", "count": 1, "matches": 1 } ] }, "source": "graph:security/auditLog", "summary": "5 DLP events for ChatGPT by 3 people in 30 days: 1 blocked, 0 warned, 1 overridden, 3 audit only; types: All Full Names, U.S. Social Security Number (SSN), Credit Card Number, Azure Storage Account Key", "observedAt": "2026-09-11T09:33:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [ "Endpoint DLP - Customer data" ], "recordId": "ual-0099", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "FileUploadedToCloud 'Q3 customer list.xlsx' to chatgpt.com by dave@contoso.com: Credit Card Number ×14, All Full Names ×120 (audit)", "observedAt": "2026-08-26T11:29:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [ "Endpoint DLP - Credentials" ], "recordId": "ual-0100", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "TextPastedToBrowser to chatgpt.com by dave@contoso.com: Azure Storage Account Key ×1 (audit)", "observedAt": "2026-09-02T15:12:00.000Z" }, { "kind": "dlp_override", "detail": { "policies": [ "Endpoint DLP - HR data" ], "recordId": "ual-0101", "application": "msedge.exe" }, "source": "graph:security/auditLog", "summary": "FileUploadedToCloud 'payroll-aug.csv' to chatgpt.com by erin@contoso.com: U.S. Social Security Number (SSN) ×42 (override)", "observedAt": "2026-09-08T10:06:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [], "recordId": "ual-0108", "application": null }, "source": "graph:security/auditLog", "summary": "AIAppInteraction to chatgpt.com by dave@contoso.com: Credit Card Number ×3 (audit)", "observedAt": "2026-09-09T11:55:00.000Z" }, { "kind": "dlp_block", "detail": { "policies": [ "Endpoint DLP - Customer data" ], "recordId": "ual-0102", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "TextPastedToBrowser to chatgpt.com by henry@contoso.com: Credit Card Number ×2 (block)", "observedAt": "2026-09-11T09:33:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" } ], "tags": [ "dlp", "high-impact-data", "not-blocked", "user-overrides", "dlp-blocked", "corroborated" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "4 of 5 matches were not blocked (All Full Names, U.S. Social Security Number (SSN), Credit Card Number). Review which rules still run in audit mode and align them with the blocking rules.", "1 person overrode the DLP warning. Read the business justifications in Activity explorer; repeated overrides for the same data type mean the policy is wrong or the training is.", "High-impact information types were involved (All Full Names, U.S. Social Security Number (SSN), Credit Card Number). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved." ], "firstSeen": "2026-08-26T11:29:00.000Z", "lastSeen": "2026-09-11T09:33:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 1 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 1 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "files": 2, "users": 3, "events": 5, "lastAt": "2026-09-11T09:33:00.000Z", "domains": [ { "count": 5, "domain": "chatgpt.com" } ], "firstAt": "2026-08-26T11:29:00.000Z", "byAction": { "warn": 0, "audit": 3, "block": 1, "unknown": 0, "override": 1 }, "policies": [ { "name": "Endpoint DLP - Customer data", "count": 2 }, { "name": "Endpoint DLP - Credentials", "count": 1 }, { "name": "Endpoint DLP - HR data", "count": 1 } ], "windowDays": 30, "byOperation": [ { "count": 2, "operation": "FileUploadedToCloud" }, { "count": 2, "operation": "TextPastedToBrowser" }, { "count": 1, "operation": "AIAppInteraction" } ], "applications": [ { "count": 3, "application": "chrome.exe" }, { "count": 1, "application": "msedge.exe" } ], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 120 }, { "name": "U.S. Social Security Number (SSN)", "count": 1, "matches": 42 }, { "name": "Credit Card Number", "count": 3, "matches": 19 }, { "name": "Azure Storage Account Key", "count": 1, "matches": 1 } ] }, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt", "mail:openai-chatgpt", "pp:shared_openai" ], "status": "open", "lastRunId": "BpsZ3fgKQDtSx3lcAK65a", "createdAt": "2026-09-14T01:26:01.647Z", "updatedAt": "2026-09-14T01:26:01.627Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "dlp:deepseek", "lane": "m365.purview_dlp", "appKey": "deepseek", "appId": null, "appDisplayName": "DeepSeek: sensitive data", "vendor": "DeepSeek", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "DLP target chat.deepseek.com" ], "sanctioned": null, "riskScore": 70, "severity": "high", "userCount": 2, "orgWide": false, "users": [ { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "noah@contoso.com", "upn": "noah@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [ "files" ], "grants": [], "evidence": [ { "kind": "dlp_activity", "detail": { "domains": [ { "count": 2, "domain": "chat.deepseek.com" } ], "byAction": { "warn": 0, "audit": 2, "block": 0, "unknown": 0, "override": 0 }, "policies": [ { "name": "Endpoint DLP - Source code", "count": 1 }, { "name": "Endpoint DLP - Customer data", "count": 1 } ], "applications": [ { "count": 1, "application": "chrome.exe" }, { "count": 1, "application": "msedge.exe" } ], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 30 }, { "name": "Source Code", "count": 1, "matches": 1 } ] }, "source": "graph:security/auditLog", "summary": "2 DLP events for DeepSeek by 2 people in 30 days: 0 blocked, 0 warned, 0 overridden, 2 audit only; types: All Full Names, Source Code", "observedAt": "2026-09-10T16:44:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [ "Endpoint DLP - Source code" ], "recordId": "ual-0103", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "TextPastedToBrowser to chat.deepseek.com by mia@contoso.com: Source Code ×1 (audit)", "observedAt": "2026-09-05T14:39:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [ "Endpoint DLP - Customer data" ], "recordId": "ual-0104", "application": "msedge.exe" }, "source": "graph:security/auditLog", "summary": "FileUploadedToCloud 'pricing-model.xlsx' to chat.deepseek.com by noah@contoso.com: All Full Names ×30 (audit)", "observedAt": "2026-09-10T16:44:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:40311" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:40311)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:deepseek" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:deepseek)" } ], "tags": [ "dlp", "high-impact-data", "not-blocked", "corroborated" ], "recommendations": [ "DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.", "Every DLP match for DeepSeek was audit or warn only (All Full Names, Source Code). The policy sees the data leaving and lets it go. Move the rule to Block for these information types, at least for uploads and pastes to unsanctioned AI sites.", "High-impact information types were involved (All Full Names, Source Code). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved." ], "firstSeen": "2026-09-05T14:39:00.000Z", "lastSeen": "2026-09-10T16:44:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "files": 1, "users": 2, "events": 2, "lastAt": "2026-09-10T16:44:00.000Z", "domains": [ { "count": 2, "domain": "chat.deepseek.com" } ], "firstAt": "2026-09-05T14:39:00.000Z", "byAction": { "warn": 0, "audit": 2, "block": 0, "unknown": 0, "override": 0 }, "policies": [ { "name": "Endpoint DLP - Source code", "count": 1 }, { "name": "Endpoint DLP - Customer data", "count": 1 } ], "windowDays": 30, "byOperation": [ { "count": 1, "operation": "TextPastedToBrowser" }, { "count": 1, "operation": "FileUploadedToCloud" } ], "applications": [ { "count": 1, "application": "chrome.exe" }, { "count": 1, "application": "msedge.exe" } ], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 30 }, { "name": "Source Code", "count": 1, "matches": 1 } ] }, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:40311", "mde:deepseek" ], "status": "open", "lastRunId": "BpsZ3fgKQDtSx3lcAK65a", "createdAt": "2026-09-14T01:26:01.661Z", "updatedAt": "2026-09-14T01:26:01.627Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:vertex-ai", "lane": "cloud.gcp", "appKey": "vertex-ai", "appId": null, "appDisplayName": "Vertex AI", "vendor": "Google", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "audit serviceName aiplatform.googleapis.com" ], "sanctioned": null, "riskScore": 67, "severity": "high", "userCount": 7, "orgWide": false, "users": [ { "id": "chat-backend@contoso-ai.iam.gserviceaccount.com", "upn": "chat-backend@contoso-ai.iam.gserviceaccount.com", "source": "gcp", "department": null, "displayName": "chat-backend (service account)" }, { "id": "contractor.ml@partner.example", "upn": "contractor.ml@partner.example", "source": "gcp", "department": null, "displayName": "contractor.ml@partner.example" }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "gcp", "department": null, "displayName": "dave@contoso.com" }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "gcp", "department": null, "displayName": "frank@contoso.com" }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "gcp", "department": null, "displayName": "grace@contoso.com" }, { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "gcp", "department": null, "displayName": "mia@contoso.com" }, { "id": "scoring-job@contoso-ai.iam.gserviceaccount.com", "upn": "scoring-job@contoso-ai.iam.gserviceaccount.com", "source": "gcp", "department": null, "displayName": "scoring-job (service account)" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "aiplatform.googleapis.com" ], "topMethods": [ { "name": "PredictionService.GenerateContent", "count": 41 }, { "name": "PredictionService.Predict", "count": 10 }, { "name": "EndpointService.DeployModel", "count": 1 }, { "name": "GenAiTuningService.CreateTuningJob", "count": 1 }, { "name": "NotebookService.CreateNotebookRuntime", "count": 1 }, { "name": "ModelService.UploadModel", "count": 1 } ], "dataAccessLogging": true }, "source": "gcp:audit", "summary": "Google Cloud (demo): Vertex AI, 55 audit entries by 7 principals, 3 write, 47 invocations, 5 denied, 4 resources, API enabled in 6 projects in 30 days across 6 projects", "observedAt": "2026-09-13T10:22:00.000Z" }, { "kind": "permission_denied", "detail": { "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent", "project": "contoso-ml-prod" }, "source": "gcp:audit", "summary": "contractor.ml@partner.example was denied GenerateContent in contoso-ml-prod", "observedAt": "2026-09-11T10:06:00.000Z" }, { "kind": "permission_denied", "detail": { "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent", "project": "contoso-ml-prod" }, "source": "gcp:audit", "summary": "contractor.ml@partner.example was denied GenerateContent in contoso-ml-prod", "observedAt": "2026-09-10T10:11:00.000Z" }, { "kind": "permission_denied", "detail": { "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent", "project": "contoso-ml-prod" }, "source": "gcp:audit", "summary": "contractor.ml@partner.example was denied GenerateContent in contoso-ml-prod", "observedAt": "2026-09-09T10:16:00.000Z" }, { "kind": "permission_denied", "detail": { "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent", "project": "contoso-ml-prod" }, "source": "gcp:audit", "summary": "contractor.ml@partner.example was denied GenerateContent in contoso-ml-prod", "observedAt": "2026-09-08T10:21:00.000Z" }, { "kind": "permission_denied", "detail": { "method": "google.cloud.aiplatform.v1.ModelService.UploadModel", "project": "contoso-sandbox" }, "source": "gcp:audit", "summary": "frank@contoso.com was denied UploadModel in contoso-sandbox", "observedAt": "2026-09-10T16:17:00.000Z" }, { "kind": "endpoint", "detail": { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/endpoints/1234", "state": null }, "source": "gcp:assets", "summary": "Endpoint 'churn-endpoint' in contoso-ml-prod (us-central1)", "observedAt": null }, { "kind": "model", "detail": { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/models/5678", "tuned": true, "baseModel": "gemini-1.5-flash" }, "source": "gcp:assets", "summary": "Model 'gemini-hr-tuned' in contoso-ml-prod (us-central1)", "observedAt": null }, { "kind": "tuningjob", "detail": { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/tuningJobs/9012", "state": "JOB_STATE_SUCCEEDED" }, "source": "gcp:assets", "summary": "TuningJob 'hr-policy-tuning' in contoso-ml-prod (us-central1)", "observedAt": null }, { "kind": "notebookruntime", "detail": { "name": "//aiplatform.googleapis.com/projects/contoso-sandbox/locations/us-central1/notebookRuntimes/3456", "state": "RUNNING" }, "source": "gcp:assets", "summary": "NotebookRuntime 'dave-colab' in contoso-sandbox (us-central1)", "observedAt": null }, { "kind": "api_enabled", "detail": { "project": "contoso-ml-prod" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-ml-prod" }, { "kind": "api_enabled", "detail": { "project": "contoso-app-dev" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-app-dev" }, { "kind": "api_enabled", "detail": { "project": "contoso-sandbox" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-sandbox" }, { "kind": "api_enabled", "detail": { "project": "contoso-marketing" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-marketing" }, { "kind": "api_enabled", "detail": { "project": "contoso-data-lake" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-data-lake" }, { "kind": "api_enabled", "detail": { "project": "contoso-legacy-crm" }, "source": "gcp:assets", "summary": "aiplatform.googleapis.com enabled in contoso-legacy-crm" } ], "tags": [ "gcp", "denied-attempts", "builders", "invocations", "service-account-heavy", "tuned-models", "notebooks", "many-projects" ], "recommendations": [ "5 calls were denied by IAM. People are trying to reach Vertex AI; grant it through a reviewed role or add an organization policy restricting the service so the attempts stop.", "Tuned models or custom training jobs exist. Confirm what data trained them, that the source bucket is classified, and that model artifacts are not shared across projects.", "Notebook instances or runtimes exist. Check that they run without external IPs and inside a VPC Service Controls perimeter so datasets loaded into them cannot leave.", "Vertex AI is active in 6 projects. Consolidate AI work into a small set of governed projects with an owner, or use organization policies to restrict which projects may enable it." ], "firstSeen": "2026-08-20T09:33:00.000Z", "lastSeen": "2026-09-13T10:22:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 1 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 2 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 3 }, { "date": "2026-09-04", "count": 3 }, { "date": "2026-09-05", "count": 4 }, { "date": "2026-09-06", "count": 3 }, { "date": "2026-09-07", "count": 3 }, { "date": "2026-09-08", "count": 5 }, { "date": "2026-09-09", "count": 4 }, { "date": "2026-09-10", "count": 5 }, { "date": "2026-09-11", "count": 4 }, { "date": "2026-09-12", "count": 3 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 0 } ], "events": 55, "lastAt": "2026-09-13T10:22:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-20T09:33:00.000Z", "projects": [ { "id": "contoso-ml-prod", "events": 28 }, { "id": "contoso-app-dev", "events": 25 }, { "id": "contoso-sandbox", "events": 2 }, { "id": "contoso-marketing", "events": 0 }, { "id": "contoso-data-lake", "events": 0 }, { "id": "contoso-legacy-crm", "events": 0 } ], "services": [ "aiplatform.googleapis.com" ], "resources": [ { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/endpoints/1234", "type": "aiplatform.googleapis.com/Endpoint", "detail": { "state": null }, "project": "contoso-ml-prod", "location": "us-central1", "displayName": "churn-endpoint" }, { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/models/5678", "type": "aiplatform.googleapis.com/Model", "detail": { "tuned": true, "baseModel": "gemini-1.5-flash" }, "project": "contoso-ml-prod", "location": "us-central1", "displayName": "gemini-hr-tuned" }, { "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/tuningJobs/9012", "type": "aiplatform.googleapis.com/TuningJob", "detail": { "state": "JOB_STATE_SUCCEEDED" }, "project": "contoso-ml-prod", "location": "us-central1", "displayName": "hr-policy-tuning" }, { "name": "//aiplatform.googleapis.com/projects/contoso-sandbox/locations/us-central1/notebookRuntimes/3456", "type": "aiplatform.googleapis.com/NotebookRuntime", "detail": { "state": "RUNNING" }, "project": "contoso-sandbox", "location": "us-central1", "displayName": "dave-colab" } ], "principals": [ { "type": "serviceAccount", "email": "chat-backend@contoso-ai.iam.gserviceaccount.com", "denied": 0, "events": 25 }, { "type": "user", "email": "mia@contoso.com", "denied": 0, "events": 12 }, { "type": "serviceAccount", "email": "scoring-job@contoso-ai.iam.gserviceaccount.com", "denied": 0, "events": 10 }, { "type": "user", "email": "contractor.ml@partner.example", "denied": 4, "events": 4 }, { "type": "user", "email": "dave@contoso.com", "denied": 0, "events": 2 }, { "type": "user", "email": "grace@contoso.com", "denied": 0, "events": 1 }, { "type": "user", "email": "frank@contoso.com", "denied": 1, "events": 1 } ], "topMethods": [ { "name": "PredictionService.GenerateContent", "count": 41 }, { "name": "PredictionService.Predict", "count": 10 }, { "name": "EndpointService.DeployModel", "count": 1 }, { "name": "GenAiTuningService.CreateTuningJob", "count": 1 }, { "name": "NotebookService.CreateNotebookRuntime", "count": 1 }, { "name": "ModelService.UploadModel", "count": 1 } ], "windowDays": 30, "apiKeyCalls": 0, "enabledApis": [ { "project": "contoso-ml-prod", "service": "aiplatform.googleapis.com" }, { "project": "contoso-app-dev", "service": "aiplatform.googleapis.com" }, { "project": "contoso-sandbox", "service": "aiplatform.googleapis.com" }, { "project": "contoso-marketing", "service": "aiplatform.googleapis.com" }, { "project": "contoso-data-lake", "service": "aiplatform.googleapis.com" }, { "project": "contoso-legacy-crm", "service": "aiplatform.googleapis.com" } ], "invocations": 47, "writeEvents": 3, "deniedEvents": 5, "connectionName": "Google Cloud (demo)", "serviceAccounts": 2, "dataAccessLogging": true }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:42.926Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt", "lane": "siem.network", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "fixture host api.openai.com", "fixture host chatgpt.com" ], "sanctioned": null, "riskScore": 66, "severity": "high", "userCount": 3, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "siem", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "siem", "department": null, "displayName": null }, { "id": "svc-datapipeline", "upn": "svc-datapipeline", "source": "siem", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "siem_traffic", "detail": { "hosts": [ { "host": "api.openai.com", "events": 18400, "bytesOut": 429916160 }, { "host": "chatgpt.com", "events": 2607, "bytesOut": 99614720 } ], "bytesIn": 494927872, "bytesOut": 529530880, "topUsers": [ { "user": "svc-datapipeline", "events": 18400 }, { "user": "dave@contoso.com", "events": 1460 }, { "user": "alice@contoso.com", "events": 812 } ], "topSources": [ { "events": 18400, "source": "10.10.1.9" }, { "events": 1460, "source": "10.20.4.52" }, { "events": 812, "source": "10.20.4.17" }, { "events": 240, "source": "10.30.8.201" }, { "events": 95, "source": "10.30.8.77" } ] }, "source": "siem:fixture", "summary": "Splunk (demo): 21007 events to api.openai.com, chatgpt.com from 3 users and 5 sources in 30 days, 505 MB uploaded", "observedAt": "2026-09-14T01:26:01.759Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" } ], "tags": [ "siem", "fixture", "corroborated", "heavy-upload" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "505 MB left for ChatGPT through Splunk (demo) in 30 days. Check the proxy or firewall for file uploads and pair this with a DLP rule for AI destinations.", "Splunk (demo) confirms what Microsoft 365 signals show for ChatGPT. Use the source list here to find the exact devices and network segments involved." ], "firstSeen": "2026-08-16T01:26:01.759Z", "lastSeen": "2026-09-14T01:26:01.759Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": { "hosts": [ { "host": "api.openai.com", "events": 18400, "bytesOut": 429916160 }, { "host": "chatgpt.com", "events": 2607, "bytesOut": 99614720 } ], "users": 3, "events": 21007, "lastAt": "2026-09-14T01:26:01.759Z", "bytesIn": 494927872, "firstAt": "2026-08-16T01:26:01.759Z", "sources": 5, "bytesOut": 529530880, "provider": "fixture", "topUsers": [ { "user": "svc-datapipeline", "events": 18400 }, { "user": "dave@contoso.com", "events": 1460 }, { "user": "alice@contoso.com", "events": 812 } ], "topSources": [ { "events": 18400, "source": "10.10.1.9" }, { "events": 1460, "source": "10.20.4.52" }, { "events": 812, "source": "10.20.4.17" }, { "events": 240, "source": "10.30.8.201" }, { "events": 95, "source": "10.30.8.77" } ], "windowDays": 30, "connectionName": "Splunk (demo)" }, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mail:openai-chatgpt", "pp:shared_openai", "dlp:openai-chatgpt", "mde:openai-chatgpt" ], "status": "open", "lastRunId": "nfYxABKc0lCJE9i9Dkhit", "createdAt": "2026-09-14T01:26:01.856Z", "updatedAt": "2026-09-14T01:26:01.758Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:deepseek", "lane": "siem.network", "appKey": "deepseek", "appId": null, "appDisplayName": "DeepSeek", "vendor": "DeepSeek", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "fixture host chat.deepseek.com" ], "sanctioned": null, "riskScore": 62, "severity": "high", "userCount": 1, "orgWide": false, "users": [ { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "siem", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "siem_traffic", "detail": { "hosts": [ { "host": "chat.deepseek.com", "events": 220, "bytesOut": 146800640 } ], "bytesIn": 20971520, "bytesOut": 146800640, "topUsers": [ { "user": "mia@contoso.com", "events": 220 } ], "topSources": [ { "events": 220, "source": "10.20.4.90" } ] }, "source": "siem:fixture", "summary": "Splunk (demo): 220 events to chat.deepseek.com from 1 user and 1 source in 30 days, 140 MB uploaded", "observedAt": "2026-09-12T01:26:01.759Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:40311" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:40311)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:deepseek" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:deepseek)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:deepseek" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:deepseek)" } ], "tags": [ "siem", "fixture", "corroborated", "heavy-upload" ], "recommendations": [ "DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.", "140 MB left for DeepSeek through Splunk (demo) in 30 days. Check the proxy or firewall for file uploads and pair this with a DLP rule for AI destinations.", "Splunk (demo) confirms what Microsoft 365 signals show for DeepSeek. Use the source list here to find the exact devices and network segments involved." ], "firstSeen": "2026-08-25T01:26:01.759Z", "lastSeen": "2026-09-12T01:26:01.759Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": { "hosts": [ { "host": "chat.deepseek.com", "events": 220, "bytesOut": 146800640 } ], "users": 1, "events": 220, "lastAt": "2026-09-12T01:26:01.759Z", "bytesIn": 20971520, "firstAt": "2026-08-25T01:26:01.759Z", "sources": 1, "bytesOut": 146800640, "provider": "fixture", "topUsers": [ { "user": "mia@contoso.com", "events": 220 } ], "topSources": [ { "events": 220, "source": "10.20.4.90" } ], "windowDays": 30, "connectionName": "Splunk (demo)" }, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:40311", "dlp:deepseek", "mde:deepseek" ], "status": "open", "lastRunId": "nfYxABKc0lCJE9i9Dkhit", "createdAt": "2026-09-14T01:26:01.869Z", "updatedAt": "2026-09-14T01:26:01.758Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "pp:shared_openai", "lane": "cloud.ai_platforms", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT via Power Platform", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "connector shared_openai" ], "sanctioned": null, "riskScore": 60, "severity": "high", "userCount": 3, "orgWide": false, "users": [ { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "platform", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "platform", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "connector_usage", "detail": { "thirdParty": true, "connectorId": "shared_openai", "environments": [ { "name": "Contoso (default)", "type": "Default", "connections": 3 } ] }, "source": "powerplatform:admin", "summary": "OpenAI (Independent Publisher) connector: 3 connections by 3 makers across Contoso (default)", "observedAt": "2026-09-09T01:26:01.342Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0001" }, "source": "powerplatform:admin", "summary": "Connection 'OpenAI - henry' created by henry@contoso.com", "observedAt": "2026-08-05T01:26:01.342Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0002" }, "source": "powerplatform:admin", "summary": "Connection 'OpenAI GPT' created by iris@contoso.com", "observedAt": "2026-08-23T01:26:01.342Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0003" }, "source": "powerplatform:admin", "summary": "Connection 'openai key' created by jack@contoso.com", "observedAt": "2026-09-09T01:26:01.342Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" } ], "tags": [ "power-platform", "third-party-connector", "default-environment", "corroborated" ], "recommendations": [ "ChatGPT via Power Platform trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "OpenAI (Independent Publisher) sends flow and app data to a third-party AI API. Classify the connector as Blocked or Business in a Power Platform DLP policy so it cannot be combined with SharePoint, Dataverse, or Outlook connectors.", "Connections exist in the Default environment, where every licensed user is a maker. Move sanctioned AI work to a managed environment and apply a DLP policy to Default." ], "firstSeen": "2026-08-05T01:26:01.342Z", "lastSeen": "2026-09-09T01:26:01.342Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": { "lastAt": "2026-09-09T01:26:01.342Z", "firstAt": "2026-08-05T01:26:01.342Z", "creators": 3, "thirdParty": true, "connections": 3, "connectorId": "shared_openai", "environments": [ { "name": "Contoso (default)", "type": "Default", "connections": 3 } ], "connectorName": "OpenAI (Independent Publisher)", "defaultEnvironment": true }, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt", "mail:openai-chatgpt" ], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.427Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "dlp:copilot", "lane": "m365.purview_dlp", "appKey": "microsoft-365-copilot", "appId": null, "appDisplayName": "Microsoft 365 Copilot: sensitive data", "vendor": "Microsoft", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "DLP for Microsoft 365 Copilot" ], "sanctioned": null, "riskScore": 60, "severity": "high", "userCount": 2, "orgWide": false, "users": [ { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [ "files" ], "grants": [], "evidence": [ { "kind": "dlp_activity", "detail": { "domains": [], "byAction": { "warn": 0, "audit": 1, "block": 1, "unknown": 0, "override": 0 }, "policies": [ { "name": "DLP for Copilot - Confidential", "count": 1 }, { "name": "DLP for Copilot - Financial", "count": 1 } ], "applications": [], "sensitiveTypes": [ { "name": "Credit Card Number", "count": 1, "matches": 5 }, { "name": "Project Codename (custom)", "count": 1, "matches": 2 } ] }, "source": "graph:security/auditLog", "summary": "2 DLP events for Microsoft 365 Copilot by 2 people in 30 days: 1 blocked, 0 warned, 0 overridden, 1 audit only; types: Credit Card Number, Project Codename (custom)", "observedAt": "2026-09-11T16:33:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [ "DLP for Copilot - Financial" ], "recordId": "ual-0111", "application": null }, "source": "graph:security/auditLog", "summary": "DlpRuleMatch by bob@contoso.com: Credit Card Number ×5 (audit)", "observedAt": "2026-09-11T16:33:00.000Z" }, { "kind": "dlp_block", "detail": { "policies": [ "DLP for Copilot - Confidential" ], "recordId": "ual-0110", "application": null }, "source": "graph:security/auditLog", "summary": "DlpRuleMatch by grace@contoso.com: Project Codename (custom) ×2 (block)", "observedAt": "2026-09-07T10:17:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "ual:copilot:m365" }, "source": "lantern:corroboration", "summary": "Also found by another lane (ual:copilot:m365)" } ], "tags": [ "dlp", "high-impact-data", "not-blocked", "dlp-blocked", "first-party", "corroborated" ], "recommendations": [ "1 of 2 matches were not blocked (Credit Card Number, Project Codename (custom)). Review which rules still run in audit mode and align them with the blocking rules.", "High-impact information types were involved (Credit Card Number, Project Codename (custom)). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved.", "Copilot prompts matched DLP policies. Extend the same sensitivity labels to Copilot with 'exclude from Copilot processing' where the label warrants it, and review oversharing with DSPM for AI." ], "firstSeen": "2026-09-07T10:17:00.000Z", "lastSeen": "2026-09-11T16:33:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 1 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 1 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "files": 0, "users": 2, "events": 2, "lastAt": "2026-09-11T16:33:00.000Z", "domains": [], "firstAt": "2026-09-07T10:17:00.000Z", "byAction": { "warn": 0, "audit": 1, "block": 1, "unknown": 0, "override": 0 }, "policies": [ { "name": "DLP for Copilot - Confidential", "count": 1 }, { "name": "DLP for Copilot - Financial", "count": 1 } ], "windowDays": 30, "byOperation": [ { "count": 2, "operation": "DlpRuleMatch" } ], "applications": [], "sensitiveTypes": [ { "name": "Credit Card Number", "count": 1, "matches": 5 }, { "name": "Project Codename (custom)", "count": 1, "matches": 2 } ] }, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "ual:copilot:m365" ], "status": "open", "lastRunId": "BpsZ3fgKQDtSx3lcAK65a", "createdAt": "2026-09-14T01:26:01.675Z", "updatedAt": "2026-09-14T01:26:01.627Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": "SzsnO_hB42k__UQ77-e98", "findingKey": "vendor:SzsnO_hB42k__UQ77-e98:openai-chatgpt", "lane": "vendor.admin_api", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "openai organization API" ], "sanctioned": true, "riskScore": 59, "severity": "high", "userCount": 11, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "vendor", "department": null, "displayName": "Alice Wu" }, { "id": "consultant@partner.example", "upn": "consultant@partner.example", "source": "vendor", "department": null, "displayName": "Partner consultant" }, { "id": "dave.park.dev@gmail.com", "upn": "dave.park.dev@gmail.com", "source": "vendor", "department": null, "displayName": "dave (personal)" }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "vendor", "department": null, "displayName": "Dave Park" }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "vendor", "department": null, "displayName": "Erin Diaz" }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "vendor", "department": null, "displayName": "Frank Li" }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "vendor", "department": null, "displayName": "Grace Hopper" }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "vendor", "department": null, "displayName": "Iris Kim" }, { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "vendor", "department": null, "displayName": "Mia Chen" }, { "id": "nina@contoso.com", "upn": "nina@contoso.com", "source": "vendor", "department": null, "displayName": "Nina Patel" }, { "id": "oscar@contoso.com", "upn": "oscar@contoso.com", "source": "vendor", "department": null, "displayName": "Oscar Ruiz" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_org", "detail": { "byModel": [ { "model": "gpt-4.1", "tokens": 34800000, "requests": 137520 }, { "model": "gpt-4o-mini", "tokens": 4800000, "requests": 11400 }, { "model": "o3", "tokens": 2000000, "requests": 500 } ], "settings": {}, "warnings": [] }, "source": "vendor:openai", "summary": "OpenAI (demo) (Contoso): 11 members, 5 admin, 3 workspaces, 4 API keys, 149,420 requests, 4,360 USD in 30 days", "observedAt": "2026-09-13T03:20:12.712Z" }, { "kind": "external_member", "detail": { "role": "member" }, "source": "vendor:openai", "summary": "dave.park.dev@gmail.com holds a seat (member) outside the organization's domains", "observedAt": "2026-02-16T03:20:12.712Z" }, { "kind": "external_member", "detail": { "role": "member" }, "source": "vendor:openai", "summary": "consultant@partner.example holds a seat (member) outside the organization's domains", "observedAt": "2026-07-31T03:20:12.712Z" }, { "kind": "stale_key", "detail": { "ownerType": "user", "workspace": "proj_default" }, "source": "vendor:openai", "summary": "API key 'dave-laptop' (dave@contoso.com) last used 2026-04-17", "observedAt": "2026-04-17T03:20:12.712Z" }, { "kind": "stale_key", "detail": { "ownerType": "user", "workspace": "proj_default" }, "source": "vendor:openai", "summary": "API key 'notebook-test' (frank@contoso.com) never used", "observedAt": "2026-06-11T03:20:12.712Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt)" } ], "tags": [ "vendor", "openai", "sanctioned-account", "external-members", "stale-keys", "service-accounts", "admin-heavy", "cost-growth", "corroborated", "sanctioned" ], "recommendations": [ "2 seats belong to addresses outside the company in the OpenAI organization. Remove them or move the account to SSO with domain verification so only directory identities can hold a seat.", "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "2 API keys have not been used in 90 days or never at all. Revoke them; a key that is not used is only a liability.", "5 of 11 members are owners or admins. Keep admin to two or three named people and use workspace roles for everyone else.", "Spend grew 51% to 4,360 USD in 30 days. Set a monthly budget alert on the vendor side and per-workspace limits where the vendor supports them.", "1 key is held by service accounts. Confirm each maps to a production system with an owner, and rotate on a schedule.", "With 11 members, manage seats through SCIM or the directory rather than by hand, and mirror the member list against leavers monthly." ], "firstSeen": "2025-08-10T03:20:12.712Z", "lastSeen": "2026-09-13T03:20:12.712Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": { "plan": "Enterprise", "daily": [ { "date": "2026-08-16", "count": 4316 }, { "date": "2026-08-17", "count": 4364 }, { "date": "2026-08-18", "count": 4412 }, { "date": "2026-08-19", "count": 4460 }, { "date": "2026-08-20", "count": 4508 }, { "date": "2026-08-21", "count": 4556 }, { "date": "2026-08-22", "count": 4604 }, { "date": "2026-08-23", "count": 4677 }, { "date": "2026-08-24", "count": 4725 }, { "date": "2026-08-25", "count": 4773 }, { "date": "2026-08-26", "count": 4821 }, { "date": "2026-08-27", "count": 4869 }, { "date": "2026-08-28", "count": 4917 }, { "date": "2026-08-29", "count": 4965 }, { "date": "2026-08-30", "count": 5013 }, { "date": "2026-08-31", "count": 5061 }, { "date": "2026-09-01", "count": 5109 }, { "date": "2026-09-02", "count": 5157 }, { "date": "2026-09-03", "count": 5205 }, { "date": "2026-09-04", "count": 5253 }, { "date": "2026-09-05", "count": 5301 }, { "date": "2026-09-06", "count": 5349 }, { "date": "2026-09-07", "count": 5397 }, { "date": "2026-09-08", "count": 5445 }, { "date": "2026-09-09", "count": 5493 }, { "date": "2026-09-10", "count": 5541 }, { "date": "2026-09-11", "count": 5589 }, { "date": "2026-09-12", "count": 5612 }, { "date": "2026-09-13", "count": 5660 }, { "date": "2026-09-14", "count": 0 } ], "admins": 5, "lastAt": "2026-09-13T03:20:12.712Z", "apiKeys": 4, "byModel": [ { "model": "gpt-4.1", "tokens": 34800000, "requests": 137520 }, { "model": "gpt-4o-mini", "tokens": 4800000, "requests": 11400 }, { "model": "o3", "tokens": 2000000, "requests": 500 } ], "cost30d": 4359.6, "firstAt": "2025-08-10T03:20:12.712Z", "keyList": [ { "id": "key_1", "name": "support-prod", "owner": "support-svc", "stale": false, "status": "active", "createdAt": "2026-05-27T03:20:12.712Z", "ownerType": "service_account", "workspace": "support-copilot", "lastUsedAt": "2026-09-14T03:20:12.712Z" }, { "id": "key_2", "name": "dave-laptop", "owner": "dave@contoso.com", "stale": true, "status": "active", "createdAt": "2026-02-26T03:20:12.712Z", "ownerType": "user", "workspace": "Default project", "lastUsedAt": "2026-04-17T03:20:12.712Z" }, { "id": "key_3", "name": "notebook-test", "owner": "frank@contoso.com", "stale": true, "status": "active", "createdAt": "2026-06-11T03:20:12.712Z", "ownerType": "user", "workspace": "Default project", "lastUsedAt": null }, { "id": "key_4", "name": "grace-cli", "owner": "grace@contoso.com", "stale": false, "status": "active", "createdAt": "2026-08-15T03:20:12.712Z", "ownerType": "user", "workspace": "Default project", "lastUsedAt": "2026-09-13T03:20:12.712Z" }, { "id": "key_5", "name": "lantern-reader (admin)", "owner": "grace@contoso.com", "stale": false, "status": "admin", "createdAt": "2026-09-12T03:20:12.712Z", "ownerType": "user", "workspace": null, "lastUsedAt": "2026-09-14T03:20:12.712Z" } ], "members": 11, "orgName": "Contoso", "currency": "USD", "provider": "openai", "settings": {}, "warnings": [], "adminKeys": 1, "staleKeys": 1, "costChange": 0.5118601747815246, "memberList": [ { "name": "Grace Hopper", "role": "owner", "email": "grace@contoso.com", "addedAt": "2025-08-10T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-13T03:20:12.712Z" }, { "name": "Dave Park", "role": "owner", "email": "dave@contoso.com", "addedAt": "2025-08-30T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-12T03:20:12.712Z" }, { "name": "Mia Chen", "role": "owner", "email": "mia@contoso.com", "addedAt": "2026-02-26T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-13T03:20:12.712Z" }, { "name": "Alice Wu", "role": "owner", "email": "alice@contoso.com", "addedAt": "2026-04-17T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-11T03:20:12.712Z" }, { "name": "Erin Diaz", "role": "owner", "email": "erin@contoso.com", "addedAt": "2026-05-17T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-09T03:20:12.712Z" }, { "name": "Frank Li", "role": "member", "email": "frank@contoso.com", "addedAt": "2025-11-18T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-12T03:20:12.712Z" }, { "name": "Iris Kim", "role": "member", "email": "iris@contoso.com", "addedAt": "2025-12-28T03:20:12.712Z", "external": false, "lastActiveAt": "2026-09-10T03:20:12.712Z" }, { "name": "Oscar Ruiz", "role": "member", "email": "oscar@contoso.com", "addedAt": "2026-06-16T03:20:12.712Z", "external": false, "lastActiveAt": "2026-08-05T03:20:12.712Z" }, { "name": "Nina Patel", "role": "member", "email": "nina@contoso.com", "addedAt": "2026-07-16T03:20:12.712Z", "external": false, "lastActiveAt": null }, { "name": "dave (personal)", "role": "member", "email": "dave.park.dev@gmail.com", "addedAt": "2026-02-16T03:20:12.712Z", "external": true, "lastActiveAt": "2026-09-08T03:20:12.712Z" }, { "name": "Partner consultant", "role": "member", "email": "consultant@partner.example", "addedAt": "2026-07-31T03:20:12.712Z", "external": true, "lastActiveAt": "2026-09-02T03:20:12.712Z" } ], "unusedKeys": 1, "windowDays": 30, "workspaces": [ { "id": "proj_default", "keys": 3, "name": "Default project", "cost30d": 276, "members": 11, "archived": false, "requests30d": 11900 }, { "id": "proj_support", "keys": 1, "name": "support-copilot", "cost30d": 4083.6, "members": 4, "archived": false, "requests30d": 137520 }, { "id": "proj_old", "keys": 0, "name": "hackathon-2025", "cost30d": 0, "members": 0, "archived": true, "requests30d": 0 } ], "requests30d": 149420, "costPrior30d": 2883.6, "activeUsers30d": 9, "connectionName": "OpenAI (demo)", "inputTokens30d": 31400000, "pendingMembers": 0, "externalMembers": 2, "inactiveMembers": 1, "outputTokens30d": 10200000, "serviceAccountKeys": 1 }, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt", "mail:openai-chatgpt", "pp:shared_openai", "dlp:openai-chatgpt", "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt", "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt", "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt", "idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt" ], "status": "open", "lastRunId": "DxtpN8oUFD5BxfBW1hlIN", "createdAt": "2026-09-14T03:20:14.010Z", "updatedAt": "2026-09-14T03:20:12.712Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mail:openai-chatgpt", "lane": "m365.mail_signals", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "sender tm.openai.com" ], "sanctioned": null, "riskScore": 58, "severity": "high", "userCount": 4, "orgWide": false, "users": [ { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "mail", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "mail", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "mail", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "mail", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_email", "detail": { "byKind": { "login": 2, "other": 0, "signup": 3, "billing": 2 }, "subjects": [ "Verify your OpenAI account", "Welcome to ChatGPT", "Your ChatGPT code is 482913", "Your ChatGPT code is 110372", "Your OpenAI receipt", "Your ChatGPT Plus subscription renewed" ], "senderDomains": [ { "count": 7, "domain": "tm.openai.com" } ] }, "source": "graph:security/collaboration/analyzedEmails", "summary": "7 vendor emails from tm.openai.com to 4 people in 30 days: 3 signup, 2 login, 2 billing", "observedAt": "2026-09-13T08:13:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@tm.openai.com", "messageId": "mail-0001" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Verify your OpenAI account' to henry@contoso.com", "observedAt": "2026-08-19T08:38:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@tm.openai.com", "messageId": "mail-0002" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Welcome to ChatGPT' to henry@contoso.com", "observedAt": "2026-08-19T08:38:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@tm.openai.com", "messageId": "mail-0003" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Verify your OpenAI account' to iris@contoso.com", "observedAt": "2026-08-26T08:07:00.000Z" }, { "kind": "mail_billing", "detail": { "sender": "noreply@tm.openai.com", "messageId": "mail-0006" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Billing: 'Your OpenAI receipt' to dave@contoso.com", "observedAt": "2026-09-02T08:36:00.000Z" }, { "kind": "mail_billing", "detail": { "sender": "noreply@tm.openai.com", "messageId": "mail-0007" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Billing: 'Your ChatGPT Plus subscription renewed' to dave@contoso.com", "observedAt": "2026-09-13T08:13:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" } ], "tags": [ "email-signal", "new-accounts", "paid-on-work-email", "corroborated" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "3 signup emails show people creating ChatGPT accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.", "2 billing emails mean someone is paying for ChatGPT personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated." ], "firstSeen": "2026-08-19T08:38:00.000Z", "lastSeen": "2026-09-13T08:13:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 2 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "byKind": { "login": 2, "other": 0, "signup": 3, "billing": 2 }, "lastAt": "2026-09-13T08:13:00.000Z", "firstAt": "2026-08-19T08:38:00.000Z", "messages": 7, "recipients": 4, "windowDays": 30, "senderDomains": [ { "count": 7, "domain": "tm.openai.com" } ], "sampleSubjects": [ "Verify your OpenAI account", "Welcome to ChatGPT", "Your ChatGPT code is 482913", "Your ChatGPT code is 110372", "Your OpenAI receipt", "Your ChatGPT Plus subscription renewed" ] }, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt" ], "status": "open", "lastRunId": "Dx1SbWZTJwmMo5O3UyHRz", "createdAt": "2026-09-14T01:26:01.193Z", "updatedAt": "2026-09-14T01:26:01.058Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourcegroups/rg-sandbox-dave/providers/microsoft.cognitiveservices/accounts/dave-openai-test", "lane": "cloud.ai_platforms", "appKey": "azure-openai", "appId": null, "appDisplayName": "Azure OpenAI: dave-openai-test", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.cognitiveservices/accounts (OpenAI)" ], "sanctioned": null, "riskScore": 55, "severity": "high", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "OpenAI", "tags": {}, "resourceId": "/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourceGroups/rg-sandbox-dave/providers/Microsoft.CognitiveServices/accounts/dave-openai-test", "deployments": [ { "name": "gpt-4.1", "model": "gpt-4.1", "version": "2025-04-14" } ], "localAuthDisabled": false, "publicNetworkAccess": true }, "source": "azure:resourceGraph", "summary": "Azure OpenAI resource 'dave-openai-test' in rg-sandbox-dave (swedencentral), subscription 5c2e1f4a: 1 deployment, public network access, API key auth enabled" } ], "tags": [ "azure", "first-party", "public-endpoint", "key-auth", "no-owner-tag", "model-deployments" ], "recommendations": [ "'Azure OpenAI: dave-openai-test' accepts traffic from any network. Put it behind a private endpoint or restrict network ACLs to your VNet and office ranges.", "API key authentication is enabled. Disable local auth and use managed identities with Cognitive Services roles so a leaked key cannot be replayed.", "No owner tag. Tag the resource with an owner and cost center so someone answers for its prompts, spend, and content-filter settings.", "1 model deployment (gpt-4.1). Confirm content filtering and abuse monitoring are on, and that logging captures prompts if your policy requires it." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "OpenAI", "tags": {}, "owner": null, "location": "swedencentral", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourceGroups/rg-sandbox-dave/providers/Microsoft.CognitiveServices/accounts/dave-openai-test", "deployments": [ { "name": "gpt-4.1", "model": "gpt-4.1", "version": "2025-04-14" } ], "resourceType": "microsoft.cognitiveservices/accounts", "resourceGroup": "rg-sandbox-dave", "subscriptionId": "5c2e1f4a-2222-4a5b-9c8d-000000000002", "managedIdentity": false, "localAuthDisabled": false, "publicNetworkAccess": true }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.447Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mail:midjourney", "lane": "m365.mail_signals", "appKey": "midjourney", "appId": null, "appDisplayName": "Midjourney", "vendor": "Midjourney", "category": "image_video", "confidence": "confirmed", "matchReasons": [ "sender midjourney.com" ], "sanctioned": null, "riskScore": 55, "severity": "high", "userCount": 1, "orgWide": false, "users": [ { "id": "pat@contoso.com", "upn": "pat@contoso.com", "source": "mail", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_email", "detail": { "byKind": { "login": 0, "other": 0, "signup": 1, "billing": 1 }, "subjects": [ "Welcome to Midjourney: confirm your email", "Your Midjourney subscription invoice" ], "senderDomains": [ { "count": 2, "domain": "midjourney.com" } ] }, "source": "graph:security/collaboration/analyzedEmails", "summary": "2 vendor emails from midjourney.com to 1 person in 30 days: 1 signup, 0 login, 1 billing", "observedAt": "2026-09-06T08:44:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@midjourney.com", "messageId": "mail-0015" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Welcome to Midjourney: confirm your email' to pat@contoso.com", "observedAt": "2026-09-05T08:57:00.000Z" }, { "kind": "mail_billing", "detail": { "sender": "noreply@midjourney.com", "messageId": "mail-0016" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Billing: 'Your Midjourney subscription invoice' to pat@contoso.com", "observedAt": "2026-09-06T08:44:00.000Z" } ], "tags": [ "email-signal", "new-accounts", "paid-on-work-email", "email-only" ], "recommendations": [ "Midjourney trains on customer data. Block the app or move users to a business tier that excludes training.", "1 signup email show people creating Midjourney accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.", "1 billing email mean someone is paying for Midjourney personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated.", "Midjourney appears only in email, not in Entra, on the network, or on managed devices, so it is probably used from personal devices or phones. Conditional Access and endpoint controls will not reach it; policy and coaching will." ], "firstSeen": "2026-09-05T08:57:00.000Z", "lastSeen": "2026-09-06T08:44:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "byKind": { "login": 0, "other": 0, "signup": 1, "billing": 1 }, "lastAt": "2026-09-06T08:44:00.000Z", "firstAt": "2026-09-05T08:57:00.000Z", "messages": 2, "recipients": 1, "windowDays": 30, "senderDomains": [ { "count": 2, "domain": "midjourney.com" } ], "sampleSubjects": [ "Welcome to Midjourney: confirm your email", "Your Midjourney subscription invoice" ] }, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "Dx1SbWZTJwmMo5O3UyHRz", "createdAt": "2026-09-14T01:26:01.206Z", "updatedAt": "2026-09-14T01:26:01.058Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:otter-ai", "lane": "identity.provider", "appKey": "otter-ai", "appId": null, "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "likely", "matchReasons": [ "app name matches /^otter(\\.ai|pilot)?\\b/" ], "sanctioned": null, "riskScore": 55, "severity": "high", "userCount": 3, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [ "calendar.events", "calendar.readonly", "drive.file", "openid", "userinfo.email" ], "permissionTier": "high", "dataClasses": [ "calendar", "files" ], "grants": [], "evidence": [ { "kind": "oauth_grants", "detail": { "appIds": [ "1092837465-otter.apps.googleusercontent.com" ], "scopes": [ { "scope": "openid", "users": 3 }, { "scope": "userinfo.email", "users": 3 }, { "scope": "calendar.readonly", "users": 3 }, { "scope": "calendar.events", "users": 3 }, { "scope": "drive.file", "users": 3 } ], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Otter.ai, 3 OAuth grants (openid, userinfo.email, calendar.readonly) in 90 days", "observedAt": "2026-08-25T09:40:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "1092837465-otter.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "alice@contoso.com authorized Otter.ai: openid, userinfo.email, calendar.readonly, calendar.events, drive.file", "observedAt": "2026-08-25T09:40:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "1092837465-otter.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "bob@contoso.com authorized Otter.ai: openid, userinfo.email, calendar.readonly, calendar.events, drive.file", "observedAt": "2026-07-25T09:27:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "1092837465-otter.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "carol@contoso.com authorized Otter.ai: openid, userinfo.email, calendar.readonly, calendar.events, drive.file", "observedAt": "2026-08-07T09:46:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:25017" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:25017)" }, { "kind": "corroboration", "detail": { "findingKey": "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001)" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0001-0000-4000-8000-000000000001)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:otter-ai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:otter-ai)" }, { "kind": "corroboration", "detail": { "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:otter-ai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (idp:9BKV_xBnZf5pDRMXOQ1jy:otter-ai)" } ], "tags": [ "identity", "googleworkspace", "user-consented", "corroborated", "dormant" ], "recommendations": [ "3 people authorized Otter.ai against their Google account with scopes that expose calendar, files. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.", "Scopes expose calendar, files. Evaluate the vendor's retention and training terms before allowing continued use.", "Otter.ai was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.", "Nobody signed into Otter.ai through Google in 90 days. Unassign or revoke to reduce standing access.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-07-25T09:27:00.000Z", "lastSeen": "2026-08-25T09:40:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "1092837465-otter.apps.googleusercontent.com" ], "lastAt": "2026-08-25T09:40:00.000Z", "scopes": [ { "scope": "openid", "users": 3 }, { "scope": "userinfo.email", "users": 3 }, { "scope": "calendar.readonly", "users": 3 }, { "scope": "calendar.events", "users": 3 }, { "scope": "drive.file", "users": 3 } ], "firstAt": "2026-07-25T09:27:00.000Z", "appNames": [ "Otter.ai" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 0, "oauthGrants": 3, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:25017", "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001", "consent:aaaa0001-0000-4000-8000-000000000001", "mail:otter-ai", "idp:9BKV_xBnZf5pDRMXOQ1jy:otter-ai" ], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.764Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:read-ai", "lane": "identity.provider", "appKey": "read-ai", "appId": null, "appDisplayName": "Read AI", "vendor": "Read AI", "category": "meeting_notes", "confidence": "likely", "matchReasons": [ "app name matches /^read\\s?(\\.)?ai\\b/" ], "sanctioned": null, "riskScore": 55, "severity": "high", "userCount": 2, "orgWide": false, "users": [ { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [ "calendar", "drive", "gmail.readonly", "openid", "userinfo.email" ], "permissionTier": "high", "dataClasses": [ "calendar", "email", "files" ], "grants": [], "evidence": [ { "kind": "oauth_grants", "detail": { "appIds": [ "5566778899-readai.apps.googleusercontent.com" ], "scopes": [ { "scope": "openid", "users": 2 }, { "scope": "userinfo.email", "users": 2 }, { "scope": "calendar", "users": 2 }, { "scope": "gmail.readonly", "users": 2 }, { "scope": "drive", "users": 2 } ], "revoked": 1, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Read AI, 2 OAuth grants (openid, userinfo.email, calendar) in 90 days", "observedAt": "2026-09-02T14:24:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "5566778899-readai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "kim@contoso.com authorized Read AI: openid, userinfo.email, calendar, gmail.readonly, drive", "observedAt": "2026-09-02T14:24:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "5566778899-readai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "liam@contoso.com authorized Read AI: openid, userinfo.email, calendar, gmail.readonly, drive", "observedAt": "2026-08-05T14:20:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "ual:teams:9c1e8a77-readai-4d2b-8f31-000000000042" }, "source": "lantern:corroboration", "summary": "Also found by another lane (ual:teams:9c1e8a77-readai-4d2b-8f31-000000000042)" } ], "tags": [ "identity", "googleworkspace", "user-consented", "corroborated", "dormant" ], "recommendations": [ "2 people authorized Read AI against their Google account with scopes that expose calendar, email, files. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.", "Scopes expose calendar, email, files. Evaluate the vendor's retention and training terms before allowing continued use.", "Read AI was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.", "Nobody signed into Read AI through Google in 90 days. Unassign or revoke to reduce standing access.", "1 grant was revoked in the window; check whether by users or by an admin policy before assuming the exposure is closed.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-08-05T14:20:00.000Z", "lastSeen": "2026-09-02T14:24:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "5566778899-readai.apps.googleusercontent.com" ], "lastAt": "2026-09-02T14:24:00.000Z", "scopes": [ { "scope": "openid", "users": 2 }, { "scope": "userinfo.email", "users": 2 }, { "scope": "calendar", "users": 2 }, { "scope": "gmail.readonly", "users": 2 }, { "scope": "drive", "users": 2 } ], "firstAt": "2026-08-05T14:20:00.000Z", "appNames": [ "Read AI" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 0, "oauthGrants": 2, "assignedUsers": 0, "revokedGrants": 1, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "ual:teams:9c1e8a77-readai-4d2b-8f31-000000000042" ], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.779Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:google-ai-studio", "lane": "cloud.gcp", "appKey": "google-ai-studio", "appId": null, "appDisplayName": "Gemini API (AI Studio)", "vendor": "Google", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "audit serviceName generativelanguage.googleapis.com" ], "sanctioned": null, "riskScore": 53, "severity": "high", "userCount": 1, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "gcp", "department": null, "displayName": "alice@contoso.com" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "generativelanguage.googleapis.com" ], "topMethods": [ { "name": "GenerativeService.GenerateContent", "count": 38 } ], "dataAccessLogging": true }, "source": "gcp:audit", "summary": "Google Cloud (demo): Gemini API (AI Studio), 38 audit entries by 2 principals, 38 invocations, API enabled in 2 projects in 30 days across 2 projects", "observedAt": "2026-09-13T12:28:00.000Z" }, { "kind": "api_enabled", "detail": { "project": "frank-side-project" }, "source": "gcp:assets", "summary": "generativelanguage.googleapis.com enabled in frank-side-project" }, { "kind": "api_enabled", "detail": { "project": "contoso-sandbox" }, "source": "gcp:assets", "summary": "generativelanguage.googleapis.com enabled in contoso-sandbox" } ], "tags": [ "gcp", "invocations", "api-keys" ], "recommendations": [ "30 calls to Gemini API (AI Studio) used an API key rather than an identity. Restrict or delete those keys and require service accounts, so every prompt has an owner and can be revoked.", "Gemini API (AI Studio) trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "The Gemini API is being called directly rather than through Vertex AI. AI Studio keys sit outside VPC Service Controls and CMEK; move production use to Vertex AI and confirm the paid tier so prompts are not used to improve Google models." ], "firstSeen": "2026-08-15T12:53:00.000Z", "lastSeen": "2026-09-13T12:28:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 1 }, { "date": "2026-08-17", "count": 1 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 1 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 1 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 2 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 2 }, { "date": "2026-09-09", "count": 2 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "events": 38, "lastAt": "2026-09-13T12:28:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-15T12:53:00.000Z", "projects": [ { "id": "frank-side-project", "events": 30 }, { "id": "contoso-sandbox", "events": 8 } ], "services": [ "generativelanguage.googleapis.com" ], "resources": [], "principals": [ { "type": "apiKey", "email": "api-key", "denied": 0, "events": 30 }, { "type": "user", "email": "alice@contoso.com", "denied": 0, "events": 8 } ], "topMethods": [ { "name": "GenerativeService.GenerateContent", "count": 38 } ], "windowDays": 30, "apiKeyCalls": 30, "enabledApis": [ { "project": "frank-side-project", "service": "generativelanguage.googleapis.com" }, { "project": "contoso-sandbox", "service": "generativelanguage.googleapis.com" } ], "invocations": 38, "writeEvents": 0, "deniedEvents": 0, "connectionName": "Google Cloud (demo)", "serviceAccounts": 0, "dataAccessLogging": true }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:42.980Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:vertex-ai-agent-builder", "lane": "cloud.gcp", "appKey": "vertex-ai-agent-builder", "appId": null, "appDisplayName": "Vertex AI Search and Agent Builder", "vendor": "Google", "category": "agent_platform", "confidence": "confirmed", "matchReasons": [ "audit serviceName discoveryengine.googleapis.com" ], "sanctioned": null, "riskScore": 52, "severity": "high", "userCount": 2, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "gcp", "department": null, "displayName": "grace@contoso.com" }, { "id": "intranet-search@contoso-ai.iam.gserviceaccount.com", "upn": "intranet-search@contoso-ai.iam.gserviceaccount.com", "source": "gcp", "department": null, "displayName": "intranet-search (service account)" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "discoveryengine.googleapis.com" ], "topMethods": [ { "name": "SearchService.Search", "count": 30 }, { "name": "DataStoreService.CreateDataStore", "count": 1 }, { "name": "DocumentService.ImportDocuments", "count": 1 } ], "dataAccessLogging": true }, "source": "gcp:audit", "summary": "Google Cloud (demo): Vertex AI Search and Agent Builder, 32 audit entries by 2 principals, 2 write, 30 invocations, 2 resources, API enabled in 1 project in 30 days across 1 project", "observedAt": "2026-09-13T09:45:00.000Z" }, { "kind": "datastore", "detail": { "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/dataStores/intranet", "contentConfig": "CONTENT_REQUIRED" }, "source": "gcp:assets", "summary": "DataStore 'intranet-drive-export' in contoso-knowledge (global)", "observedAt": null }, { "kind": "engine", "detail": { "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/engines/askcontoso", "solutionType": "SOLUTION_TYPE_CHAT" }, "source": "gcp:assets", "summary": "Engine 'Ask Contoso' in contoso-knowledge (global)", "observedAt": null }, { "kind": "api_enabled", "detail": { "project": "contoso-knowledge" }, "source": "gcp:assets", "summary": "discoveryengine.googleapis.com enabled in contoso-knowledge" } ], "tags": [ "gcp", "builders", "invocations", "service-account-heavy", "agents" ], "recommendations": [ "Data stores, engines, or agents are configured. Review which buckets, sites, and databases they index; an indexed data store is a standing grant of that content to whoever can query the agent." ], "firstSeen": "2026-08-15T09:10:00.000Z", "lastSeen": "2026-09-13T09:45:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 1 }, { "date": "2026-08-17", "count": 1 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 1 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 1 }, { "date": "2026-08-23", "count": 2 }, { "date": "2026-08-24", "count": 2 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 1 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 1 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 1 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "events": 32, "lastAt": "2026-09-13T09:45:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-15T09:10:00.000Z", "projects": [ { "id": "contoso-knowledge", "events": 32 } ], "services": [ "discoveryengine.googleapis.com" ], "resources": [ { "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/dataStores/intranet", "type": "discoveryengine.googleapis.com/DataStore", "detail": { "contentConfig": "CONTENT_REQUIRED" }, "project": "contoso-knowledge", "location": "global", "displayName": "intranet-drive-export" }, { "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/engines/askcontoso", "type": "discoveryengine.googleapis.com/Engine", "detail": { "solutionType": "SOLUTION_TYPE_CHAT" }, "project": "contoso-knowledge", "location": "global", "displayName": "Ask Contoso" } ], "principals": [ { "type": "serviceAccount", "email": "intranet-search@contoso-ai.iam.gserviceaccount.com", "denied": 0, "events": 30 }, { "type": "user", "email": "grace@contoso.com", "denied": 0, "events": 2 } ], "topMethods": [ { "name": "SearchService.Search", "count": 30 }, { "name": "DataStoreService.CreateDataStore", "count": 1 }, { "name": "DocumentService.ImportDocuments", "count": 1 } ], "windowDays": 30, "apiKeyCalls": 0, "enabledApis": [ { "project": "contoso-knowledge", "service": "discoveryengine.googleapis.com" } ], "invocations": 30, "writeEvents": 2, "deniedEvents": 0, "connectionName": "Google Cloud (demo)", "serviceAccounts": 1, "dataAccessLogging": true }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:42.998Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mdca:11114", "lane": "m365.cloud_app_discovery", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "domain chatgpt.com" ], "sanctioned": null, "riskScore": 51, "severity": "high", "userCount": 11, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "quinn@contoso.com", "upn": "quinn@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "rae@contoso.com", "upn": "rae@contoso.com", "source": "network", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "network_discovery", "detail": { "domains": [ "chatgpt.com", "chat.openai.com", "oaiusercontent.com" ], "category": "generativeAi", "mdcaAppId": "11114", "riskScore": 7, "ipAddresses": 6, "downloadBytes": 188743680 }, "source": "graph:security/dataDiscovery/cloudAppDiscovery", "summary": "Seen on the network via Defender for Endpoint, Palo Alto log collector: 11 users, 5110 transactions, 50 MB uploaded in 30 days", "observedAt": "2026-09-14T01:25:59.427Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:consent", "summary": "Also holds an Entra consent grant (consent:aaaa0002-0000-4000-8000-000000000002)" } ], "tags": [ "network", "corroborated" ], "recommendations": [ "50 MB uploaded to ChatGPT in 30 days from 11 people. Check what data is leaving with Defender's file and session policies.", "ChatGPT is corroborated by an Entra consent grant. Review both findings together; the consent finding shows what data the app can read.", "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access." ], "firstSeen": null, "lastSeen": "2026-09-14T01:25:59.427Z", "usage": null, "network": { "domains": [ "chatgpt.com", "chat.openai.com", "oaiusercontent.com" ], "streams": [ "Defender for Endpoint", "Palo Alto log collector" ], "mdcaTags": [ "Generative AI" ], "mdcaAppId": "11114", "userCount": 11, "lastSeenAt": "2026-09-14T01:25:59.427Z", "periodDays": 30, "uploadBytes": 52428800, "mdcaCategory": "generativeAi", "transactions": 5110, "downloadBytes": 188743680, "mdcaRiskScore": 7, "ipAddressCount": 6 }, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002" ], "status": "open", "lastRunId": "V3q69yhE6ynFkRBaAe9xg", "createdAt": "2026-09-14T01:25:59.655Z", "updatedAt": "2026-09-14T01:25:59.422Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:dialogflow", "lane": "cloud.gcp", "appKey": "dialogflow", "appId": null, "appDisplayName": "Dialogflow", "vendor": "Google", "category": "agent_platform", "confidence": "confirmed", "matchReasons": [ "audit serviceName dialogflow.googleapis.com" ], "sanctioned": null, "riskScore": 51, "severity": "high", "userCount": 1, "orgWide": false, "users": [ { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "gcp", "department": null, "displayName": "iris@contoso.com" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "dialogflow.googleapis.com" ], "topMethods": [ { "name": "Flows.UpdateFlow", "count": 5 }, { "name": "Agents.CreateAgent", "count": 1 } ], "dataAccessLogging": false }, "source": "gcp:audit", "summary": "Google Cloud (demo): Dialogflow, 6 audit entries by 1 principal, 6 write, 1 resource, API enabled in 1 project in 30 days across 1 project", "observedAt": "2026-09-12T10:07:00.000Z" }, { "kind": "agent", "detail": { "name": "//dialogflow.googleapis.com/projects/contoso-support/locations/us-central1/agents/abcd" }, "source": "gcp:assets", "summary": "Agent 'support-bot' in contoso-support (us-central1)", "observedAt": null }, { "kind": "api_enabled", "detail": { "project": "contoso-support" }, "source": "gcp:assets", "summary": "dialogflow.googleapis.com enabled in contoso-support" } ], "tags": [ "gcp", "builders", "agents", "invocations-unlogged" ], "recommendations": [ "Only Admin Activity logs were visible for Dialogflow. Enable Data Access audit logs for dialogflow.googleapis.com at the organization level so model calls (GenerateContent, Predict) are recorded and Lantern can count who sends prompts.", "Data stores, engines, or agents are configured. Review which buckets, sites, and databases they index; an indexed data store is a standing grant of that content to whoever can query the agent." ], "firstSeen": "2026-08-30T10:56:00.000Z", "lastSeen": "2026-09-12T10:07:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 1 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 1 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "events": 6, "lastAt": "2026-09-12T10:07:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-30T10:56:00.000Z", "projects": [ { "id": "contoso-support", "events": 6 } ], "services": [ "dialogflow.googleapis.com" ], "resources": [ { "name": "//dialogflow.googleapis.com/projects/contoso-support/locations/us-central1/agents/abcd", "type": "dialogflow.googleapis.com/Agent", "detail": {}, "project": "contoso-support", "location": "us-central1", "displayName": "support-bot" } ], "principals": [ { "type": "user", "email": "iris@contoso.com", "denied": 0, "events": 6 } ], "topMethods": [ { "name": "Flows.UpdateFlow", "count": 5 }, { "name": "Agents.CreateAgent", "count": 1 } ], "windowDays": 30, "apiKeyCalls": 0, "enabledApis": [ { "project": "contoso-support", "service": "dialogflow.googleapis.com" } ], "invocations": 0, "writeEvents": 6, "deniedEvents": 0, "connectionName": "Google Cloud (demo)", "serviceAccounts": 0, "dataAccessLogging": false }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:43.032Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "ual:copilot:m365", "lane": "m365.audit_log", "appKey": "microsoft-365-copilot", "appId": null, "appDisplayName": "Microsoft 365 Copilot", "vendor": "Microsoft", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "CopilotInteraction records" ], "sanctioned": null, "riskScore": 50, "severity": "high", "userCount": 12, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [ "files" ], "grants": [], "evidence": [ { "kind": "copilot_interaction", "detail": { "hosts": [ { "host": "Word", "count": 15 }, { "host": "PowerPoint", "count": 14 }, { "host": "Excel", "count": 12 }, { "host": "BizChat", "count": 11 }, { "host": "Teams", "count": 11 }, { "host": "Outlook", "count": 7 } ], "teams": [], "plugins": [ { "count": 4, "plugin": "BingWebSearch" } ], "operations": [ { "count": 70, "operation": "CopilotInteraction" } ], "labelledResources": 4 }, "source": "graph:security/auditLog", "summary": "Audit log: Microsoft 365 Copilot, 70 events, 12 people, in Word, PowerPoint, Excel, BizChat, Teams, Outlook, 12 resources accessed (4 labeled) in 30 days", "observedAt": "2026-09-14T01:24:58.721Z" } ], "tags": [ "audit-log", "first-party", "labeled-content" ], "recommendations": [ "Microsoft 365 Copilot is in use by 12 people across Word, PowerPoint, Excel, BizChat, Teams, Outlook. It respects existing permissions, so oversharing in SharePoint becomes AI-discoverable content. Run a permissions review with Restricted SharePoint Search or SharePoint Advanced Management.", "Copilot surfaced 4 labeled resources. Confirm your sensitivity labels carry the Copilot exclusion where they should, and review Purview DSPM for AI.", "Plugins in use: BingWebSearch. Web search and third-party plugins send prompts outside the tenant boundary; disable them in the Copilot admin settings if that is not intended.", "Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access." ], "firstSeen": "2026-08-16T15:19:00.000Z", "lastSeen": "2026-09-14T01:24:58.721Z", "usage": null, "network": null, "endpoint": null, "audit": { "kind": "copilot", "daily": [ { "date": "2026-08-16", "count": 1 }, { "date": "2026-08-17", "count": 3 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 4 }, { "date": "2026-08-20", "count": 2 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 3 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 2 }, { "date": "2026-08-26", "count": 3 }, { "date": "2026-08-27", "count": 4 }, { "date": "2026-08-28", "count": 4 }, { "date": "2026-08-29", "count": 3 }, { "date": "2026-08-30", "count": 4 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 2 }, { "date": "2026-09-02", "count": 3 }, { "date": "2026-09-03", "count": 3 }, { "date": "2026-09-04", "count": 2 }, { "date": "2026-09-05", "count": 2 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 1 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 2 }, { "date": "2026-09-10", "count": 5 }, { "date": "2026-09-11", "count": 3 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 5 }, { "date": "2026-09-14", "count": 2 } ], "teams": [], "users": 12, "byHost": [ { "host": "Word", "count": 15 }, { "host": "PowerPoint", "count": 14 }, { "host": "Excel", "count": 12 }, { "host": "BizChat", "count": 11 }, { "host": "Teams", "count": 11 }, { "host": "Outlook", "count": 7 } ], "events": 70, "lastAt": "2026-09-14T01:24:58.721Z", "firstAt": "2026-08-16T15:19:00.000Z", "plugins": [ { "count": 4, "plugin": "BingWebSearch" } ], "windowDays": 30, "byOperation": [ { "count": 70, "operation": "CopilotInteraction" } ], "labelledResources": 4, "resourcesAccessed": 12 }, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "MmBhrcmcT4gc22ZPoDXBp", "createdAt": "2026-09-14T01:26:00.916Z", "updatedAt": "2026-09-14T01:26:00.127Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mail:otter-ai", "lane": "m365.mail_signals", "appKey": "otter-ai", "appId": null, "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "confirmed", "matchReasons": [ "sender otter.ai" ], "sanctioned": null, "riskScore": 50, "severity": "high", "userCount": 1, "orgWide": false, "users": [ { "id": "olivia@contoso.com", "upn": "olivia@contoso.com", "source": "mail", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_email", "detail": { "byKind": { "login": 0, "other": 0, "signup": 1, "billing": 1 }, "subjects": [ "Welcome to Otter.ai! Get started with OtterPilot", "Your Otter.ai Pro receipt" ], "senderDomains": [ { "count": 2, "domain": "otter.ai" } ] }, "source": "graph:security/collaboration/analyzedEmails", "summary": "2 vendor emails from otter.ai to 1 person in 30 days: 1 signup, 0 login, 1 billing", "observedAt": "2026-08-18T08:51:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "support@otter.ai", "messageId": "mail-0013" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Welcome to Otter.ai! Get started with OtterPilot' to olivia@contoso.com", "observedAt": "2026-08-17T08:04:00.000Z" }, { "kind": "mail_billing", "detail": { "sender": "support@otter.ai", "messageId": "mail-0014" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Billing: 'Your Otter.ai Pro receipt' to olivia@contoso.com", "observedAt": "2026-08-18T08:51:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0001-0000-4000-8000-000000000001)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:25017" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:25017)" }, { "kind": "corroboration", "detail": { "findingKey": "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001)" } ], "tags": [ "email-signal", "new-accounts", "paid-on-work-email", "corroborated" ], "recommendations": [ "1 signup email show people creating Otter.ai accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.", "1 billing email mean someone is paying for Otter.ai personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-08-17T08:04:00.000Z", "lastSeen": "2026-08-18T08:51:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 1 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "byKind": { "login": 0, "other": 0, "signup": 1, "billing": 1 }, "lastAt": "2026-08-18T08:51:00.000Z", "firstAt": "2026-08-17T08:04:00.000Z", "messages": 2, "recipients": 1, "windowDays": 30, "senderDomains": [ { "count": 2, "domain": "otter.ai" } ], "sampleSubjects": [ "Welcome to Otter.ai! Get started with OtterPilot", "Your Otter.ai Pro receipt" ] }, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0001-0000-4000-8000-000000000001", "mdca:25017", "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001" ], "status": "open", "lastRunId": "Dx1SbWZTJwmMo5O3UyHRz", "createdAt": "2026-09-14T01:26:01.220Z", "updatedAt": "2026-09-14T01:26:01.058Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": "NLwFfSGzxGEdHZB7FsTmq", "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "aws:NLwFfSGzxGEdHZB7FsTmq:amazon-sagemaker", "lane": "cloud.aws", "appKey": "amazon-sagemaker", "appId": null, "appDisplayName": "Amazon SageMaker", "vendor": "Amazon Web Services", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "CloudTrail eventSource sagemaker.amazonaws.com" ], "sanctioned": null, "riskScore": 49, "severity": "medium", "userCount": 3, "orgWide": false, "users": [ { "id": "arn:aws:iam::123456789012:user/dave", "upn": "dave", "source": "aws", "department": null, "displayName": "dave" }, { "id": "arn:aws:sts::123456789012:assumed-role/Developers/erin@contoso.com", "upn": "erin@contoso.com", "source": "aws", "department": null, "displayName": "erin@contoso.com via Developers" }, { "id": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "upn": "grace@contoso.com", "source": "aws", "department": null, "displayName": "grace@contoso.com via PlatformEngineer" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "cloudtrail_activity", "detail": { "services": [ "sagemaker.amazonaws.com" ], "topActions": [ { "name": "StartNotebookInstance", "count": 6 }, { "name": "DescribeEndpoint", "count": 4 }, { "name": "CreateNotebookInstance", "count": 1 }, { "name": "CreateEndpoint", "count": 1 }, { "name": "CreateTrainingJob", "count": 1 } ], "invocationLogging": null }, "source": "aws:cloudtrail", "summary": "AWS (demo) (123456789012): Amazon SageMaker, 13 CloudTrail events by 3 identities, 9 write, 2 resources in 90 days across us-east-1", "observedAt": "2026-09-13T09:28:00.000Z" }, { "kind": "sagemaker:endpoint", "detail": { "arn": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/churn-model-prod", "status": "InService" }, "source": "aws:inventory", "summary": "endpoint 'churn-model-prod' in us-east-1", "observedAt": null }, { "kind": "sagemaker:notebook", "detail": { "arn": "arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/dave-experiments", "status": "InService", "instanceType": "ml.t3.large", "directInternetAccess": true }, "source": "aws:inventory", "summary": "notebook 'dave-experiments' in us-east-1", "observedAt": null } ], "tags": [ "aws", "account:123456789012", "builders", "notebook-internet" ], "recommendations": [ "A SageMaker notebook has direct internet access. Data loaded into it can be sent anywhere; disable direct internet access and route through a VPC with egress controls." ], "firstSeen": "2026-08-20T10:49:00.000Z", "lastSeen": "2026-09-13T09:28:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 1 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "events": 13, "lastAt": "2026-09-13T09:28:00.000Z", "firstAt": "2026-08-20T10:49:00.000Z", "regions": [ "us-east-1" ], "rootUsed": false, "services": [ "sagemaker.amazonaws.com" ], "accountId": "123456789012", "resources": [ { "arn": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/churn-model-prod", "name": "churn-model-prod", "type": "sagemaker:endpoint", "detail": { "status": "InService" }, "region": "us-east-1" }, { "arn": "arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/dave-experiments", "name": "dave-experiments", "type": "sagemaker:notebook", "detail": { "status": "InService", "instanceType": "ml.t3.large", "directInternetAccess": true }, "region": "us-east-1" } ], "identities": [ { "arn": "arn:aws:iam::123456789012:user/dave", "name": "dave", "type": "IAMUser", "denied": 0, "events": 8 }, { "arn": "arn:aws:sts::123456789012:assumed-role/Developers/erin@contoso.com", "name": "erin@contoso.com", "type": "AssumedRole", "denied": 0, "events": 4 }, { "arn": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "name": "grace@contoso.com", "type": "AssumedRole", "denied": 0, "events": 1 } ], "topActions": [ { "name": "StartNotebookInstance", "count": 6 }, { "name": "DescribeEndpoint", "count": 4 }, { "name": "CreateNotebookInstance", "count": 1 }, { "name": "CreateEndpoint", "count": 1 }, { "name": "CreateTrainingJob", "count": 1 } ], "windowDays": 90, "invocations": 0, "writeEvents": 9, "deniedEvents": 0, "connectionName": "AWS (demo)", "invocationLogging": null }, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "tPH00sX_Cba9etj7T4St8", "createdAt": "2026-09-14T02:32:42.400Z", "updatedAt": "2026-09-14T02:32:41.973Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": "NLwFfSGzxGEdHZB7FsTmq", "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "aws:NLwFfSGzxGEdHZB7FsTmq:aws-ai-services", "lane": "cloud.aws", "appKey": "aws-ai-services", "appId": null, "appDisplayName": "AWS AI Services", "vendor": "Amazon Web Services", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "CloudTrail eventSource comprehend.amazonaws.com" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "arn:aws:iam::123456789012:user/contractor-ml", "upn": "contractor-ml", "source": "aws", "department": null, "displayName": "contractor-ml" }, { "id": "arn:aws:sts::123456789012:assumed-role/AppServiceRole/i-0a1b2c3d", "upn": "i-0a1b2c3d", "source": "aws", "department": null, "displayName": "i-0a1b2c3d via AppServiceRole" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "cloudtrail_activity", "detail": { "services": [ "comprehend.amazonaws.com", "textract.amazonaws.com", "transcribe.amazonaws.com" ], "topActions": [ { "name": "DetectPiiEntities", "count": 20 }, { "name": "AnalyzeDocument", "count": 12 }, { "name": "StartTranscriptionJob", "count": 3 } ], "invocationLogging": null }, "source": "aws:cloudtrail", "summary": "AWS (demo) (123456789012): AWS AI Services, 35 CloudTrail events by 2 identities, 3 write in 90 days across us-east-1", "observedAt": "2026-09-13T09:12:00.000Z" } ], "tags": [ "aws", "account:123456789012", "builders" ], "recommendations": [ "AWS AI Services trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Set the AI services opt-out policy in AWS Organizations so AWS AI Services cannot use your content to improve the service, then confirm Q Developer users are on Pro rather than the free tier." ], "firstSeen": "2026-08-25T09:25:00.000Z", "lastSeen": "2026-09-13T09:12:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 2 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 2 }, { "date": "2026-09-04", "count": 2 }, { "date": "2026-09-05", "count": 2 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 2 }, { "date": "2026-09-09", "count": 3 }, { "date": "2026-09-10", "count": 3 }, { "date": "2026-09-11", "count": 3 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "events": 35, "lastAt": "2026-09-13T09:12:00.000Z", "firstAt": "2026-08-25T09:25:00.000Z", "regions": [ "us-east-1" ], "rootUsed": false, "services": [ "comprehend.amazonaws.com", "textract.amazonaws.com", "transcribe.amazonaws.com" ], "accountId": "123456789012", "resources": [], "identities": [ { "arn": "arn:aws:sts::123456789012:assumed-role/AppServiceRole/i-0a1b2c3d", "name": "i-0a1b2c3d", "type": "AssumedRole", "denied": 0, "events": 20 }, { "arn": "arn:aws:iam::123456789012:user/contractor-ml", "name": "contractor-ml", "type": "IAMUser", "denied": 0, "events": 15 } ], "topActions": [ { "name": "DetectPiiEntities", "count": 20 }, { "name": "AnalyzeDocument", "count": 12 }, { "name": "StartTranscriptionJob", "count": 3 } ], "windowDays": 90, "invocations": 0, "writeEvents": 3, "deniedEvents": 0, "connectionName": "AWS (demo)", "invocationLogging": null }, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "tPH00sX_Cba9etj7T4St8", "createdAt": "2026-09-14T02:32:42.429Z", "updatedAt": "2026-09-14T02:32:41.973Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": "NLwFfSGzxGEdHZB7FsTmq", "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "aws:NLwFfSGzxGEdHZB7FsTmq:amazon-q", "lane": "cloud.aws", "appKey": "amazon-q", "appId": null, "appDisplayName": "Amazon Q", "vendor": "Amazon Web Services", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "CloudTrail eventSource codewhisperer.amazonaws.com" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 5, "orgWide": false, "users": [ { "id": "arn:aws:sts::123456789012:assumed-role/Developers/alice@contoso.com", "upn": "alice@contoso.com", "source": "aws", "department": null, "displayName": "alice@contoso.com via Developers" }, { "id": "arn:aws:sso::123456789012:user/erin@contoso.com", "upn": "erin@contoso.com", "source": "aws", "department": null, "displayName": "erin@contoso.com" }, { "id": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "upn": "grace@contoso.com", "source": "aws", "department": null, "displayName": "grace@contoso.com via PlatformEngineer" }, { "id": "arn:aws:sso::123456789012:user/iris@contoso.com", "upn": "iris@contoso.com", "source": "aws", "department": null, "displayName": "iris@contoso.com" }, { "id": "arn:aws:sts::123456789012:assumed-role/Developers/mia@contoso.com", "upn": "mia@contoso.com", "source": "aws", "department": null, "displayName": "mia@contoso.com via Developers" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "cloudtrail_activity", "detail": { "services": [ "codewhisperer.amazonaws.com", "qbusiness.amazonaws.com" ], "topActions": [ { "name": "GenerateRecommendations", "count": 16 }, { "name": "ChatSync", "count": 12 }, { "name": "CreateApplication", "count": 1 }, { "name": "CreateDataSource", "count": 1 } ], "invocationLogging": null }, "source": "aws:cloudtrail", "summary": "AWS (demo) (123456789012): Amazon Q, 30 CloudTrail events by 5 identities, 14 write, 28 invocations, 1 resource in 90 days across us-east-1", "observedAt": "2026-09-13T16:59:00.000Z" }, { "kind": "qbusiness:application", "detail": { "arn": "arn:aws:qbusiness:us-east-1:123456789012:application/QAPP001", "status": "ACTIVE" }, "source": "aws:inventory", "summary": "application 'Contoso Knowledge Assistant' in us-east-1", "observedAt": null } ], "tags": [ "aws", "account:123456789012", "builders", "invocations" ], "recommendations": [ "Amazon Q trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Set the AI services opt-out policy in AWS Organizations so Amazon Q cannot use your content to improve the service, then confirm Q Developer users are on Pro rather than the free tier." ], "firstSeen": "2026-08-15T10:54:00.000Z", "lastSeen": "2026-09-13T16:59:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 1 }, { "date": "2026-08-16", "count": 1 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 4 }, { "date": "2026-09-09", "count": 4 }, { "date": "2026-09-10", "count": 4 }, { "date": "2026-09-11", "count": 4 }, { "date": "2026-09-12", "count": 4 }, { "date": "2026-09-13", "count": 3 }, { "date": "2026-09-14", "count": 0 } ], "events": 30, "lastAt": "2026-09-13T16:59:00.000Z", "firstAt": "2026-08-15T10:54:00.000Z", "regions": [ "us-east-1" ], "rootUsed": false, "services": [ "codewhisperer.amazonaws.com", "qbusiness.amazonaws.com" ], "accountId": "123456789012", "resources": [ { "arn": "arn:aws:qbusiness:us-east-1:123456789012:application/QAPP001", "name": "Contoso Knowledge Assistant", "type": "qbusiness:application", "detail": { "status": "ACTIVE" }, "region": "us-east-1" } ], "identities": [ { "arn": "arn:aws:sts::123456789012:assumed-role/Developers/alice@contoso.com", "name": "alice@contoso.com", "type": "AssumedRole", "denied": 0, "events": 10 }, { "arn": "arn:aws:sso::123456789012:user/iris@contoso.com", "name": "iris@contoso.com", "type": "IdentityCenterUser", "denied": 0, "events": 7 }, { "arn": "arn:aws:sts::123456789012:assumed-role/Developers/mia@contoso.com", "name": "mia@contoso.com", "type": "AssumedRole", "denied": 0, "events": 6 }, { "arn": "arn:aws:sso::123456789012:user/erin@contoso.com", "name": "erin@contoso.com", "type": "IdentityCenterUser", "denied": 0, "events": 5 }, { "arn": "arn:aws:sts::123456789012:assumed-role/PlatformEngineer/grace@contoso.com", "name": "grace@contoso.com", "type": "AssumedRole", "denied": 0, "events": 2 } ], "topActions": [ { "name": "GenerateRecommendations", "count": 16 }, { "name": "ChatSync", "count": 12 }, { "name": "CreateApplication", "count": 1 }, { "name": "CreateDataSource", "count": 1 } ], "windowDays": 90, "invocations": 28, "writeEvents": 14, "deniedEvents": 0, "connectionName": "AWS (demo)", "invocationLogging": null }, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "tPH00sX_Cba9etj7T4St8", "createdAt": "2026-09-14T02:32:42.415Z", "updatedAt": "2026-09-14T02:32:41.973Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:openai-chatgpt", "lane": "m365.advanced_hunting", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "network: chatgpt.com", "network: api.openai.com", "process: ChatGPT.exe", "software: ChatGPT" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "endpoint", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [ { "host": "chatgpt.com", "count": 2 }, { "host": "api.openai.com", "count": 1 } ], "signals": { "network": 3, "process": 1, "software": 1, "extension": 0, "model_file": 0, "local_server": 0 }, "software": [ { "name": "ChatGPT", "devices": 1, "version": "1.2026.240" } ], "processes": [ { "name": "ChatGPT.exe", "count": 1 } ], "extensions": [], "deviceNames": [ "LT-ALICE", "LT-DAVE" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw ChatGPT on 2 devices (2 accounts) in 30 days: 1 process observation; installed on 1 devices; device connections to chatgpt.com, api.openai.com", "observedAt": "2026-09-13T23:01:58.721Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" } ], "tags": [ "endpoint", "corroborated" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "ChatGPT is installed as a desktop app on 2 devices. If it is not approved, block it with App Control for Business or an attack surface reduction rule, and deploy the sanctioned alternative through Intune.", "Device telemetry names the exact machines and accounts reaching chatgpt.com, api.openai.com. Use it to target coaching rather than blanket blocks." ], "firstSeen": "2026-08-16T01:25:58.721Z", "lastSeen": "2026-09-13T23:01:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 2, "domains": [ { "host": "chatgpt.com", "count": 2 }, { "host": "api.openai.com", "count": 1 } ], "signals": { "network": 3, "process": 1, "software": 1, "extension": 0, "model_file": 0, "local_server": 0 }, "accounts": 2, "lastSeen": "2026-09-13T23:01:58.721Z", "software": [ { "name": "ChatGPT", "devices": 1, "version": "1.2026.240" } ], "firstSeen": "2026-08-16T01:25:58.721Z", "processes": [ { "name": "ChatGPT.exe", "count": 1 } ], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-ALICE", "LT-DAVE" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114" ], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:25:59.967Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:cursor", "lane": "m365.advanced_hunting", "appKey": "cursor", "appId": null, "appDisplayName": "Cursor", "vendor": "Anysphere", "category": "coding", "confidence": "confirmed", "matchReasons": [ "network: api2.cursor.sh", "process: Cursor.exe", "software: Cursor" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "endpoint", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [ { "host": "api2.cursor.sh", "count": 2 } ], "signals": { "network": 2, "process": 2, "software": 2, "extension": 0, "model_file": 0, "local_server": 0 }, "software": [ { "name": "Cursor", "devices": 2, "version": "1.6.27" } ], "processes": [ { "name": "Cursor.exe", "count": 2 } ], "extensions": [], "deviceNames": [ "LT-FRANK", "LT-LIAM" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw Cursor on 2 devices (2 accounts) in 30 days: 2 process observations; installed on 2 devices; device connections to api2.cursor.sh", "observedAt": "2026-09-13T18:13:58.721Z" } ], "tags": [ "endpoint" ], "recommendations": [ "Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Cursor is installed as a desktop app on 2 devices. If it is not approved, block it with App Control for Business or an attack surface reduction rule, and deploy the sanctioned alternative through Intune.", "Device telemetry names the exact machines and accounts reaching api2.cursor.sh. Use it to target coaching rather than blanket blocks.", "Cursor was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps." ], "firstSeen": "2026-08-18T01:25:58.721Z", "lastSeen": "2026-09-13T18:13:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 2, "domains": [ { "host": "api2.cursor.sh", "count": 2 } ], "signals": { "network": 2, "process": 2, "software": 2, "extension": 0, "model_file": 0, "local_server": 0 }, "accounts": 2, "lastSeen": "2026-09-13T18:13:58.721Z", "software": [ { "name": "Cursor", "devices": 2, "version": "1.6.27" } ], "firstSeen": "2026-08-18T01:25:58.721Z", "processes": [ { "name": "Cursor.exe", "count": 2 } ], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-FRANK", "LT-LIAM" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:25:59.982Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:model-files", "lane": "m365.advanced_hunting", "appKey": null, "appId": null, "appDisplayName": "Local model files", "vendor": null, "category": "local_runtime", "confidence": "confirmed", "matchReasons": [ "model_file: C:\\\\Users\\\\grace\\\\.ollama\\\\models\\\\blobs", "model_file: C:\\\\Users\\\\frank\\\\.ollama\\\\models\\\\blobs", "model_file: C:\\\\Users\\\\grace\\\\.cache\\\\lm-studio\\\\models" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "endpoint", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [], "signals": { "network": 0, "process": 0, "software": 0, "extension": 0, "model_file": 3, "local_server": 0 }, "software": [], "processes": [], "extensions": [], "deviceNames": [ "LT-FRANK", "WS-RESEARCH-01" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw local model files on 2 devices (2 accounts) in 30 days: 12 model files (44441 MB) written", "observedAt": "2026-09-13T01:25:58.721Z" } ], "tags": [ "endpoint", "local-inference" ], "recommendations": [ "Local inference keeps prompts on the device but sits outside every SaaS control: no DLP, no audit trail, and models of unknown provenance. Confirm these devices are managed and decide whether local AI is allowed at all." ], "firstSeen": "2026-08-16T01:25:58.721Z", "lastSeen": "2026-09-13T01:25:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 2, "domains": [], "signals": { "network": 0, "process": 0, "software": 0, "extension": 0, "model_file": 3, "local_server": 0 }, "accounts": 2, "lastSeen": "2026-09-13T01:25:58.721Z", "software": [], "firstSeen": "2026-08-16T01:25:58.721Z", "processes": [], "extensions": [], "modelFiles": { "bytes": 46600000000, "count": 12 }, "windowDays": 30, "deviceNames": [ "LT-FRANK", "WS-RESEARCH-01" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.011Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:ollama", "lane": "m365.advanced_hunting", "appKey": "ollama", "appId": null, "appDisplayName": "Ollama", "vendor": "Ollama", "category": "local_runtime", "confidence": "confirmed", "matchReasons": [ "process: ollama.exe", "software: Ollama", "local_server: 11434" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "endpoint", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [], "signals": { "network": 0, "process": 2, "software": 2, "extension": 0, "model_file": 0, "local_server": 2 }, "software": [ { "name": "Ollama", "devices": 2, "version": "0.12.2" } ], "processes": [ { "name": "ollama.exe", "count": 2 } ], "extensions": [], "deviceNames": [ "LT-FRANK", "WS-RESEARCH-01" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw Ollama on 2 devices (2 accounts) in 30 days: 2 process observations; installed on 2 devices; local inference server on port 11434", "observedAt": "2026-09-13T23:01:58.721Z" } ], "tags": [ "endpoint", "local-inference" ], "recommendations": [ "Local inference keeps prompts on the device but sits outside every SaaS control: no DLP, no audit trail, and models of unknown provenance. Confirm these devices are managed and decide whether local AI is allowed at all." ], "firstSeen": "2026-08-16T01:25:58.721Z", "lastSeen": "2026-09-13T23:01:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 2, "domains": [], "signals": { "network": 0, "process": 2, "software": 2, "extension": 0, "model_file": 0, "local_server": 2 }, "accounts": 2, "lastSeen": "2026-09-13T23:01:58.721Z", "software": [ { "name": "Ollama", "devices": 2, "version": "0.12.2" } ], "firstSeen": "2026-08-16T01:25:58.721Z", "processes": [ { "name": "ollama.exe", "count": 2 } ], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-FRANK", "WS-RESEARCH-01" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:25:59.997Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mdca:25017", "lane": "m365.cloud_app_discovery", "appKey": "otter-ai", "appId": null, "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "confirmed", "matchReasons": [ "domain otter.ai" ], "sanctioned": null, "riskScore": 48, "severity": "medium", "userCount": 4, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "olivia@contoso.com", "upn": "olivia@contoso.com", "source": "network", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "network_discovery", "detail": { "domains": [ "otter.ai" ], "category": "productivity", "mdcaAppId": "25017", "riskScore": 6, "ipAddresses": 4, "downloadBytes": 12582912 }, "source": "graph:security/dataDiscovery/cloudAppDiscovery", "summary": "Seen on the network via Defender for Endpoint: 4 users, 512 transactions, 90 MB uploaded in 30 days", "observedAt": "2026-09-14T01:25:59.427Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001" }, "source": "lantern:consent", "summary": "Also holds an Entra consent grant (consent:aaaa0001-0000-4000-8000-000000000001)" } ], "tags": [ "network", "corroborated" ], "recommendations": [ "90 MB uploaded to Otter.ai in 30 days from 4 people. Check what data is leaving with Defender's file and session policies.", "Otter.ai is corroborated by an Entra consent grant. Review both findings together; the consent finding shows what data the app can read.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": null, "lastSeen": "2026-09-14T01:25:59.427Z", "usage": null, "network": { "domains": [ "otter.ai" ], "streams": [ "Defender for Endpoint" ], "mdcaTags": [], "mdcaAppId": "25017", "userCount": 4, "lastSeenAt": "2026-09-14T01:25:59.427Z", "periodDays": 30, "uploadBytes": 94371840, "mdcaCategory": "productivity", "transactions": 512, "downloadBytes": 12582912, "mdcaRiskScore": 6, "ipAddressCount": 4 }, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0001-0000-4000-8000-000000000001" ], "status": "open", "lastRunId": "V3q69yhE6ynFkRBaAe9xg", "createdAt": "2026-09-14T01:25:59.668Z", "updatedAt": "2026-09-14T01:25:59.422Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "ual:agent:cr4f2-hr-assistant", "lane": "m365.audit_log", "appKey": null, "appId": null, "appDisplayName": "Contoso HR Assistant", "vendor": "Microsoft", "category": "agent_platform", "confidence": "confirmed", "matchReasons": [ "AppIdentity Copilot.Studio.cr4f2-hr-assistant" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 7, "orgWide": false, "users": [ { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "copilot_interaction", "detail": { "hosts": [ { "host": "Copilot Studio", "count": 18 } ], "teams": [], "plugins": [], "operations": [ { "count": 18, "operation": "CopilotInteraction" } ], "labelledResources": 0 }, "source": "graph:security/auditLog", "summary": "Audit log: Contoso HR Assistant, 18 events, 7 people, in Copilot Studio, 18 resources accessed (0 labeled) in 30 days", "observedAt": "2026-09-14T01:24:58.721Z" } ], "tags": [ "audit-log", "custom-agent" ], "recommendations": [ "Contoso HR Assistant is a custom agent with 18 interactions. Open it in Copilot Studio or SharePoint to check its knowledge sources and who can publish changes; agents inherit the author's access and are the fastest-growing shadow AI surface in Microsoft 365." ], "firstSeen": "2026-08-24T13:51:00.000Z", "lastSeen": "2026-09-14T01:24:58.721Z", "usage": null, "network": null, "endpoint": null, "audit": { "kind": "agent", "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 2 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 1 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 3 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 2 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 3 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 1 } ], "teams": [], "users": 7, "byHost": [ { "host": "Copilot Studio", "count": 18 } ], "events": 18, "lastAt": "2026-09-14T01:24:58.721Z", "firstAt": "2026-08-24T13:51:00.000Z", "plugins": [], "windowDays": 30, "byOperation": [ { "count": 18, "operation": "CopilotInteraction" } ], "labelledResources": 0, "resourcesAccessed": 18 }, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "MmBhrcmcT4gc22ZPoDXBp", "createdAt": "2026-09-14T01:26:00.931Z", "updatedAt": "2026-09-14T01:26:00.127Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:google-gemini", "lane": "siem.network", "appKey": "google-gemini", "appId": null, "appDisplayName": "Gemini", "vendor": "Google", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "fixture host gemini.google.com" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "siem", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "siem", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "siem_traffic", "detail": { "hosts": [ { "host": "gemini.google.com", "events": 560, "bytesOut": 7340032 } ], "bytesIn": 25165824, "bytesOut": 7340032, "topUsers": [ { "user": "erin@contoso.com", "events": 410 }, { "user": "jack@contoso.com", "events": 150 } ], "topSources": [ { "events": 410, "source": "10.20.5.14" }, { "events": 150, "source": "10.20.5.60" } ] }, "source": "siem:fixture", "summary": "Splunk (demo): 560 events to gemini.google.com from 2 users and 2 sources in 30 days, 7 MB uploaded", "observedAt": "2026-09-14T01:26:01.759Z" } ], "tags": [ "siem", "fixture", "siem-only" ], "recommendations": [ "Gemini trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Gemini appears only in Splunk (demo) logs, not in Microsoft 365 signals, so it is reaching the network from devices or accounts Microsoft does not see. Block or coach at the gateway, and check which sources are unmanaged." ], "firstSeen": "2026-08-27T01:26:01.759Z", "lastSeen": "2026-09-14T01:26:01.759Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": { "hosts": [ { "host": "gemini.google.com", "events": 560, "bytesOut": 7340032 } ], "users": 2, "events": 560, "lastAt": "2026-09-14T01:26:01.759Z", "bytesIn": 25165824, "firstAt": "2026-08-27T01:26:01.759Z", "sources": 2, "bytesOut": 7340032, "provider": "fixture", "topUsers": [ { "user": "erin@contoso.com", "events": 410 }, { "user": "jack@contoso.com", "events": 150 } ], "topSources": [ { "events": 410, "source": "10.20.5.14" }, { "events": 150, "source": "10.20.5.60" } ], "windowDays": 30, "connectionName": "Splunk (demo)" }, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "nfYxABKc0lCJE9i9Dkhit", "createdAt": "2026-09-14T01:26:01.883Z", "updatedAt": "2026-09-14T01:26:01.758Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:grammarly", "lane": "m365.advanced_hunting", "appKey": "grammarly", "appId": null, "appDisplayName": "Grammarly", "vendor": "Grammarly", "category": "writing", "confidence": "confirmed", "matchReasons": [ "software: Grammarly for Windows", "extension: kbfnbcaeplbcioakkpcpgfkobkghlhen" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [], "signals": { "network": 0, "process": 0, "software": 2, "extension": 3, "model_file": 0, "local_server": 0 }, "software": [ { "name": "Grammarly for Windows", "devices": 2, "version": "1.100" } ], "processes": [], "extensions": [ { "id": "kbfnbcaeplbcioakkpcpgfkobkghlhen", "name": "Grammarly: AI Writing Assistant", "browser": "Edge", "devices": 3 } ], "deviceNames": [ "LT-HENRY", "LT-IRIS", "LT-JACK" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw Grammarly on 3 devices (0 accounts) in 30 days: installed on 2 devices; 1 browser extension", "observedAt": null } ], "tags": [ "endpoint", "browser-extension" ], "recommendations": [ "Grammarly runs as a browser extension on 3 devices and can read every page those users open, including webmail and internal apps. Manage it with the browser's ExtensionInstallBlocklist or allowlist policy.", "Grammarly was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": { "devices": 3, "domains": [], "signals": { "network": 0, "process": 0, "software": 2, "extension": 3, "model_file": 0, "local_server": 0 }, "accounts": 0, "lastSeen": null, "software": [ { "name": "Grammarly for Windows", "devices": 2, "version": "1.100" } ], "firstSeen": null, "processes": [], "extensions": [ { "id": "kbfnbcaeplbcioakkpcpgfkobkghlhen", "name": "Grammarly: AI Writing Assistant", "browser": "Edge", "devices": 3 } ], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-HENRY", "LT-IRIS", "LT-JACK" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.026Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:grammarly", "lane": "identity.provider", "appKey": "grammarly", "appId": null, "appDisplayName": "Grammarly", "vendor": "Grammarly", "category": "writing", "confidence": "likely", "matchReasons": [ "app name matches /^grammarly/" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [ "documents", "drive.readonly", "openid", "userinfo.email" ], "permissionTier": "high", "dataClasses": [ "files" ], "grants": [], "evidence": [ { "kind": "oauth_grants", "detail": { "appIds": [ "2233445566-grammarly.apps.googleusercontent.com" ], "scopes": [ { "scope": "openid", "users": 1 }, { "scope": "userinfo.email", "users": 1 }, { "scope": "documents", "users": 1 }, { "scope": "drive.readonly", "users": 1 } ], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Grammarly, 1 OAuth grant (openid, userinfo.email, documents) in 90 days", "observedAt": "2026-08-12T10:21:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "2233445566-grammarly.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "henry@contoso.com authorized Grammarly: openid, userinfo.email, documents, drive.readonly", "observedAt": "2026-08-12T10:21:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:grammarly" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:grammarly)" } ], "tags": [ "identity", "googleworkspace", "user-consented", "corroborated", "dormant" ], "recommendations": [ "1 person authorized Grammarly against their Google account with scopes that expose files. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.", "Scopes expose files. Evaluate the vendor's retention and training terms before allowing continued use.", "Grammarly was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.", "Nobody signed into Grammarly through Google in 90 days. Unassign or revoke to reduce standing access." ], "firstSeen": "2026-08-12T10:21:00.000Z", "lastSeen": "2026-08-12T10:21:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "2233445566-grammarly.apps.googleusercontent.com" ], "lastAt": "2026-08-12T10:21:00.000Z", "scopes": [ { "scope": "openid", "users": 1 }, { "scope": "userinfo.email", "users": 1 }, { "scope": "documents", "users": 1 }, { "scope": "drive.readonly", "users": 1 } ], "firstAt": "2026-08-12T10:21:00.000Z", "appNames": [ "Grammarly" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 0, "oauthGrants": 1, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:grammarly" ], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.796Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "consent:aaaa0004-0000-4000-8000-000000000004", "lane": "m365.oauth_consent", "appKey": null, "appId": "aaaa0004-0000-4000-8000-000000000004", "appDisplayName": "MeetingMind Notetaker", "vendor": "MeetingMind Ltd", "category": null, "confidence": "suspected", "matchReasons": [ "name keyword /note ?taker/" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "u2", "upn": "bob@contoso.com", "source": "both", "signIns": 3, "department": "Finance", "displayName": "Bob Okafor", "lastSignInAt": "2026-08-30T08:45:00.000Z" } ], "permissions": [ "Calendars.Read", "OnlineMeetings.Read" ], "permissionTier": "high", "dataClasses": [ "calendar", "meetings" ], "grants": [ { "grantId": "g-mm-1", "consentType": "Principal", "permissions": [ "Calendars.Read", "OnlineMeetings.Read" ], "principalId": "u2", "principalUpn": "bob@contoso.com", "resourceDisplayName": null, "principalDisplayName": "Bob Okafor" } ], "evidence": [ { "kind": "service_principal", "detail": { "appId": "aaaa0004-0000-4000-8000-000000000004", "homepage": "https://meetingmind.example", "objectId": "sp-meetingmind", "publisherName": "MeetingMind Ltd", "accountEnabled": true, "verifiedPublisher": null }, "source": "graph:servicePrincipals", "summary": "Service principal 'MeetingMind Notetaker' present in tenant (publisher: MeetingMind Ltd)", "observedAt": "2026-08-15T14:00:00.000Z" }, { "kind": "delegated_grant", "detail": { "grantId": "g-mm-1", "resourceId": "sp-graph", "consentType": "Principal", "principalId": "u2" }, "source": "graph:oauth2PermissionGrants", "summary": "bob@contoso.com granted Calendars.Read, OnlineMeetings.Read" }, { "kind": "sign_in_activity", "detail": { "clients": [ { "count": 2, "client": "Browser" }, { "count": 1, "client": "Mobile Apps and Desktop clients" } ], "countries": [ { "count": 3, "country": "US" } ], "windowDays": 30, "activeUsers7d": 0 }, "source": "graph:auditLogs/signIns", "summary": "3 successful sign-ins by 1 person in the last 30 days", "observedAt": "2026-08-30T08:45:00.000Z" }, { "kind": "consent_event", "detail": { "scopes": [ "OnlineMeetings.Read", "Calendars.Read" ], "recordId": "ual-0096", "isAdminConsent": false }, "source": "graph:security/auditLog", "summary": "Consent to application. by bob@contoso.com: OnlineMeetings.Read, Calendars.Read", "observedAt": "2026-08-18T10:57:00.000Z" } ], "tags": [ "unverified-publisher" ], "recommendations": [ "Confirm whether MeetingMind Notetaker is an AI service, then sanction, block, or ignore it.", "Scopes expose calendar, meetings. Evaluate the vendor's retention and training terms before allowing continued use." ], "firstSeen": "2026-08-15T14:00:00.000Z", "lastSeen": "2026-08-30T08:45:00.000Z", "usage": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 2 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "clients": [ { "count": 2, "client": "Browser" }, { "count": 1, "client": "Mobile Apps and Desktop clients" } ], "signIns": 3, "countries": [ { "count": 3, "country": "US" } ], "windowDays": 30, "activeUsers": 1, "lastSignInAt": "2026-08-30T08:45:00.000Z", "activeUsers7d": 0, "failedSignIns": 0 }, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "JdSTO2zAdYnh8U-RtZevh", "createdAt": "2026-09-14T01:25:59.386Z", "updatedAt": "2026-09-14T01:26:01.023Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "dlp:perplexity", "lane": "m365.purview_dlp", "appKey": "perplexity", "appId": null, "appDisplayName": "Perplexity: sensitive data", "vendor": "Perplexity AI", "category": "search", "confidence": "confirmed", "matchReasons": [ "DLP target perplexity.ai" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "dlp_activity", "detail": { "domains": [ { "count": 1, "domain": "perplexity.ai" } ], "byAction": { "warn": 0, "audit": 1, "block": 0, "unknown": 0, "override": 0 }, "policies": [], "applications": [], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 6 } ] }, "source": "graph:security/auditLog", "summary": "1 DLP event for Perplexity by 1 person in 30 days: 0 blocked, 0 warned, 0 overridden, 1 audit only; types: All Full Names", "observedAt": "2026-09-13T15:11:00.000Z" }, { "kind": "dlp_audit", "detail": { "policies": [], "recordId": "ual-0109", "application": null }, "source": "graph:security/auditLog", "summary": "AIAppInteraction to perplexity.ai by kim@contoso.com: All Full Names ×6 (audit)", "observedAt": "2026-09-13T15:11:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:perplexity)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:perplexity)" } ], "tags": [ "dlp", "not-blocked", "corroborated" ], "recommendations": [ "Perplexity trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Every DLP match for Perplexity was audit or warn only (All Full Names). The policy sees the data leaving and lets it go. Move the rule to Block for these information types, at least for uploads and pastes to unsanctioned AI sites." ], "firstSeen": "2026-09-13T15:11:00.000Z", "lastSeen": "2026-09-13T15:11:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 1 }, { "date": "2026-09-14", "count": 0 } ], "files": 0, "users": 1, "events": 1, "lastAt": "2026-09-13T15:11:00.000Z", "domains": [ { "count": 1, "domain": "perplexity.ai" } ], "firstAt": "2026-09-13T15:11:00.000Z", "byAction": { "warn": 0, "audit": 1, "block": 0, "unknown": 0, "override": 0 }, "policies": [], "windowDays": 30, "byOperation": [ { "count": 1, "operation": "AIAppInteraction" } ], "applications": [], "sensitiveTypes": [ { "name": "All Full Names", "count": 1, "matches": 6 } ] }, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:perplexity", "mail:perplexity" ], "status": "open", "lastRunId": "BpsZ3fgKQDtSx3lcAK65a", "createdAt": "2026-09-14T01:26:01.689Z", "updatedAt": "2026-09-14T01:26:01.627Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:zoom-ai-companion", "lane": "identity.provider", "appKey": "zoom-ai-companion", "appId": null, "appDisplayName": "Zoom AI Companion", "vendor": "Zoom", "category": "embedded_feature", "confidence": "likely", "matchReasons": [ "app name matches /^zoom\\b/" ], "sanctioned": null, "riskScore": 45, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [ "calendar", "openid" ], "permissionTier": "high", "dataClasses": [ "calendar" ], "grants": [], "evidence": [ { "kind": "oauth_grants", "detail": { "appIds": [ "9988776655-zoom.apps.googleusercontent.com" ], "scopes": [ { "scope": "openid", "users": 1 }, { "scope": "calendar", "users": 1 } ], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Zoom AI Companion, 1 OAuth grant (openid, calendar) in 90 days", "observedAt": "2026-09-06T10:16:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "9988776655-zoom.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "grace@contoso.com authorized Zoom: openid, calendar", "observedAt": "2026-09-06T10:16:00.000Z" } ], "tags": [ "identity", "googleworkspace", "user-consented", "dormant" ], "recommendations": [ "1 person authorized Zoom AI Companion against their Google account with scopes that expose calendar. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.", "Scopes expose calendar. Evaluate the vendor's retention and training terms before allowing continued use.", "Zoom AI Companion was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.", "Nobody signed into Zoom AI Companion through Google in 90 days. Unassign or revoke to reduce standing access." ], "firstSeen": "2026-09-06T10:16:00.000Z", "lastSeen": "2026-09-06T10:16:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "9988776655-zoom.apps.googleusercontent.com" ], "lastAt": "2026-09-06T10:16:00.000Z", "scopes": [ { "scope": "openid", "users": 1 }, { "scope": "calendar", "users": 1 } ], "firstAt": "2026-09-06T10:16:00.000Z", "appNames": [ "Zoom" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 0, "oauthGrants": 1, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.811Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mail:anthropic-claude", "lane": "m365.mail_signals", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "sender mail.anthropic.com" ], "sanctioned": null, "riskScore": 43, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "mail", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_email", "detail": { "byKind": { "login": 1, "other": 0, "signup": 2, "billing": 0 }, "subjects": [ "Verify your email address for Claude", "Welcome to Claude", "Your login code for Claude" ], "senderDomains": [ { "count": 3, "domain": "mail.anthropic.com" } ] }, "source": "graph:security/collaboration/analyzedEmails", "summary": "3 vendor emails from mail.anthropic.com to 1 person in 30 days: 2 signup, 1 login, 0 billing", "observedAt": "2026-09-07T08:31:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@mail.anthropic.com", "messageId": "mail-0008" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Verify your email address for Claude' to carol@contoso.com", "observedAt": "2026-08-22T08:59:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "noreply@mail.anthropic.com", "messageId": "mail-0009" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Welcome to Claude' to carol@contoso.com", "observedAt": "2026-08-22T08:59:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:34211" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:34211)" } ], "tags": [ "email-signal", "new-accounts", "corroborated" ], "recommendations": [ "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "2 signup emails show people creating Claude accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team." ], "firstSeen": "2026-08-22T08:59:00.000Z", "lastSeen": "2026-09-07T08:31:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 2 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 1 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "byKind": { "login": 1, "other": 0, "signup": 2, "billing": 0 }, "lastAt": "2026-09-07T08:31:00.000Z", "firstAt": "2026-08-22T08:59:00.000Z", "messages": 3, "recipients": 1, "windowDays": 30, "senderDomains": [ { "count": 3, "domain": "mail.anthropic.com" } ], "sampleSubjects": [ "Verify your email address for Claude", "Welcome to Claude", "Your login code for Claude" ] }, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:34211" ], "status": "open", "lastRunId": "Dx1SbWZTJwmMo5O3UyHRz", "createdAt": "2026-09-14T01:26:01.233Z", "updatedAt": "2026-09-14T01:26:01.058Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourcegroups/rg-datasci/providers/microsoft.machinelearningservices/workspaces/aml-research", "lane": "cloud.ai_platforms", "appKey": "azure-ml", "appId": null, "appDisplayName": "Azure Machine Learning: aml-research", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.machinelearningservices/workspaces (Default)" ], "sanctioned": null, "riskScore": 42, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "Default", "tags": {}, "resourceId": "/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourceGroups/rg-datasci/providers/Microsoft.MachineLearningServices/workspaces/aml-research", "deployments": [], "localAuthDisabled": null, "publicNetworkAccess": true }, "source": "azure:resourceGraph", "summary": "Azure Machine Learning resource 'aml-research' in rg-datasci (westus2), subscription 5c2e1f4a: 0 deployments, public network access" } ], "tags": [ "azure", "first-party", "public-endpoint", "no-owner-tag" ], "recommendations": [ "'Azure Machine Learning: aml-research' accepts traffic from any network. Put it behind a private endpoint or restrict network ACLs to your VNet and office ranges.", "No owner tag. Tag the resource with an owner and cost center so someone answers for its prompts, spend, and content-filter settings." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "Default", "tags": {}, "owner": null, "location": "westus2", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourceGroups/rg-datasci/providers/Microsoft.MachineLearningServices/workspaces/aml-research", "deployments": [], "resourceType": "microsoft.machinelearningservices/workspaces", "resourceGroup": "rg-datasci", "subscriptionId": "5c2e1f4a-2222-4a5b-9c8d-000000000002", "managedIdentity": true, "localAuthDisabled": null, "publicNetworkAccess": true }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.461Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "ual:teams:9c1e8a77-readai-4d2b-8f31-000000000042", "lane": "m365.audit_log", "appKey": "read-ai", "appId": null, "appDisplayName": "Read AI", "vendor": "Read AI", "category": "meeting_notes", "confidence": "likely", "matchReasons": [ "app name matches /^read\\s?(\\.)?ai\\b/" ], "sanctioned": null, "riskScore": 42, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "audit", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "teams_app_install", "detail": { "hosts": [], "teams": [ { "team": "Product", "count": 1 }, { "team": "Engineering", "count": 1 } ], "plugins": [], "operations": [ { "count": 2, "operation": "BotAddedToTeam" }, { "count": 1, "operation": "AppInstalled" } ], "labelledResources": 0 }, "source": "graph:security/auditLog", "summary": "Audit log: Read AI, 3 events, 2 people, teams: Product, Engineering in 30 days", "observedAt": "2026-09-05T10:39:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0091", "addOnGuid": "9c1e8a77-readai-4d2b-8f31-000000000042", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "AppInstalled: Read AI by kim@contoso.com", "observedAt": "2026-09-03T10:01:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0092", "addOnGuid": "9c1e8a77-readai-4d2b-8f31-000000000042", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "BotAddedToTeam: Read AI in team 'Product' by kim@contoso.com", "observedAt": "2026-09-04T10:50:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0093", "addOnGuid": "9c1e8a77-readai-4d2b-8f31-000000000042", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "BotAddedToTeam: Read AI in team 'Engineering' by liam@contoso.com", "observedAt": "2026-09-05T10:39:00.000Z" } ], "tags": [ "audit-log", "teams-app", "bot-in-team" ], "recommendations": [ "Read AI was added as a bot to Product, Engineering. Bots in a team receive every channel message. Review with the Teams admin center app permission policies.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-09-03T10:01:00.000Z", "lastSeen": "2026-09-05T10:39:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": { "kind": "teams_app", "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "teams": [ { "team": "Product", "count": 1 }, { "team": "Engineering", "count": 1 } ], "users": 2, "byHost": [], "events": 3, "lastAt": "2026-09-05T10:39:00.000Z", "firstAt": "2026-09-03T10:01:00.000Z", "plugins": [], "windowDays": 30, "byOperation": [ { "count": 2, "operation": "BotAddedToTeam" }, { "count": 1, "operation": "AppInstalled" } ], "labelledResources": 0, "resourcesAccessed": 0 }, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "MmBhrcmcT4gc22ZPoDXBp", "createdAt": "2026-09-14T01:26:00.945Z", "updatedAt": "2026-09-14T01:26:00.127Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:anthropic-claude", "lane": "code.repositories", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: anthropic", "endpoint: api.anthropic.com" ], "sanctioned": null, "riskScore": 41, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline", "contoso/go-gateway" ], "configs": [], "packages": [ { "name": "anthropic", "repos": 1, "ecosystem": "pypi" } ], "endpoints": [ { "host": "api.anthropic.com", "repos": 1 } ] }, "source": "repos:fixture", "summary": "Claude in 2 repositories via GitHub (demo): packages anthropic; direct calls to api.anthropic.com", "observedAt": "2026-09-12T01:26:01.958Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:34211" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:34211)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude)" } ], "tags": [ "source-code", "fixture", "corroborated" ], "recommendations": [ "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Claude SDKs appear in 2 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.", "Direct HTTP calls to api.anthropic.com bypass any SDK-level controls. Add the hosts to egress policy and prefer the sanctioned client library." ], "firstSeen": null, "lastSeen": "2026-09-12T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "package" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/go-gateway", "name": "contoso/go-gateway", "signals": [ "endpoint" ], "pushedAt": "2026-09-12T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 1, "endpoint": 1, "model_file": 0 }, "packages": [ { "name": "anthropic", "repos": 1, "ecosystem": "pypi" } ], "provider": "fixture", "endpoints": [ { "host": "api.anthropic.com", "repos": 1 } ], "lastPushAt": "2026-09-12T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:34211", "mail:anthropic-claude", "dlp:anthropic-claude", "siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.193Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude", "lane": "siem.network", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "fixture host claude.ai" ], "sanctioned": null, "riskScore": 40, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "siem", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "siem_traffic", "detail": { "hosts": [ { "host": "claude.ai", "events": 320, "bytesOut": 7340032 } ], "bytesIn": 26214400, "bytesOut": 7340032, "topUsers": [ { "user": "carol@contoso.com", "events": 320 } ], "topSources": [ { "events": 320, "source": "10.20.4.31" } ] }, "source": "siem:fixture", "summary": "Splunk (demo): 320 events to claude.ai from 1 user and 1 source in 30 days, 7 MB uploaded", "observedAt": "2026-09-13T01:26:01.759Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:34211" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:34211)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:anthropic-claude)" } ], "tags": [ "siem", "fixture", "corroborated" ], "recommendations": [ "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Splunk (demo) confirms what Microsoft 365 signals show for Claude. Use the source list here to find the exact devices and network segments involved." ], "firstSeen": "2026-08-23T01:26:01.759Z", "lastSeen": "2026-09-13T01:26:01.759Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": { "hosts": [ { "host": "claude.ai", "events": 320, "bytesOut": 7340032 } ], "users": 1, "events": 320, "lastAt": "2026-09-13T01:26:01.759Z", "bytesIn": 26214400, "firstAt": "2026-08-23T01:26:01.759Z", "sources": 1, "bytesOut": 7340032, "provider": "fixture", "topUsers": [ { "user": "carol@contoso.com", "events": 320 } ], "topSources": [ { "events": 320, "source": "10.20.4.31" } ], "windowDays": 30, "connectionName": "Splunk (demo)" }, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:34211", "mail:anthropic-claude", "dlp:anthropic-claude" ], "status": "open", "lastRunId": "nfYxABKc0lCJE9i9Dkhit", "createdAt": "2026-09-14T01:26:01.896Z", "updatedAt": "2026-09-14T01:26:01.758Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:deepseek", "lane": "m365.advanced_hunting", "appKey": "deepseek", "appId": null, "appDisplayName": "DeepSeek", "vendor": "DeepSeek", "category": "assistant", "confidence": "likely", "matchReasons": [ "network: chat.deepseek.com" ], "sanctioned": null, "riskScore": 40, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "endpoint", "department": null, "displayName": null }, { "id": "noah@contoso.com", "upn": "noah@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [ { "host": "chat.deepseek.com", "count": 2 } ], "signals": { "network": 2, "process": 0, "software": 0, "extension": 0, "model_file": 0, "local_server": 0 }, "software": [], "processes": [], "extensions": [], "deviceNames": [ "LT-MIA", "LT-NOAH" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw DeepSeek on 2 devices (2 accounts) in 30 days: device connections to chat.deepseek.com", "observedAt": "2026-09-12T01:25:58.721Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:40311" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:40311)" } ], "tags": [ "endpoint", "corroborated" ], "recommendations": [ "DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.", "Device telemetry names the exact machines and accounts reaching chat.deepseek.com. Use it to target coaching rather than blanket blocks." ], "firstSeen": "2026-08-25T01:25:58.721Z", "lastSeen": "2026-09-12T01:25:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 2, "domains": [ { "host": "chat.deepseek.com", "count": 2 } ], "signals": { "network": 2, "process": 0, "software": 0, "extension": 0, "model_file": 0, "local_server": 0 }, "accounts": 2, "lastSeen": "2026-09-12T01:25:58.721Z", "software": [], "firstSeen": "2026-08-25T01:25:58.721Z", "processes": [], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-MIA", "LT-NOAH" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:40311" ], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.048Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "pp:shared_geminiai", "lane": "cloud.ai_platforms", "appKey": null, "appId": null, "appDisplayName": "Gemini AI (custom)", "vendor": null, "category": "cloud_ai", "confidence": "suspected", "matchReasons": [ "connector shared_geminiai" ], "sanctioned": null, "riskScore": 40, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "connector_usage", "detail": { "thirdParty": true, "connectorId": "shared_geminiai", "environments": [ { "name": "Contoso (default)", "type": "Default", "connections": 1 } ] }, "source": "powerplatform:admin", "summary": "Gemini AI (custom) connector: 1 connection by 1 maker across Contoso (default)", "observedAt": "2026-09-02T01:26:01.342Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0006" }, "source": "powerplatform:admin", "summary": "Connection 'Gemini AI (custom)' created by kim@contoso.com", "observedAt": "2026-09-02T01:26:01.342Z" } ], "tags": [ "power-platform", "third-party-connector", "default-environment" ], "recommendations": [ "Confirm whether Gemini AI (custom) is an AI service, then sanction, block, or ignore it.", "Gemini AI (custom) sends flow and app data to a third-party AI API. Classify the connector as Blocked or Business in a Power Platform DLP policy so it cannot be combined with SharePoint, Dataverse, or Outlook connectors.", "A connection exists in the Default environment, where every licensed user is a maker. Move sanctioned AI work to a managed environment and apply a DLP policy to Default." ], "firstSeen": "2026-09-02T01:26:01.342Z", "lastSeen": "2026-09-02T01:26:01.342Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": { "lastAt": "2026-09-02T01:26:01.342Z", "firstAt": "2026-09-02T01:26:01.342Z", "creators": 1, "thirdParty": true, "connections": 1, "connectorId": "shared_geminiai", "environments": [ { "name": "Contoso (default)", "type": "Default", "connections": 1 } ], "connectorName": "Gemini AI (custom)", "defaultEnvironment": true }, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.474Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mail:perplexity", "lane": "m365.mail_signals", "appKey": "perplexity", "appId": null, "appDisplayName": "Perplexity", "vendor": "Perplexity AI", "category": "search", "confidence": "confirmed", "matchReasons": [ "sender mail.perplexity.ai" ], "sanctioned": null, "riskScore": 40, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "mail", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_email", "detail": { "byKind": { "login": 0, "other": 0, "signup": 2, "billing": 0 }, "subjects": [ "Welcome to Perplexity", "Confirm your email" ], "senderDomains": [ { "count": 2, "domain": "mail.perplexity.ai" } ] }, "source": "graph:security/collaboration/analyzedEmails", "summary": "2 vendor emails from mail.perplexity.ai to 1 person in 30 days: 2 signup, 0 login, 0 billing", "observedAt": "2026-08-31T08:02:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "team@mail.perplexity.ai", "messageId": "mail-0011" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Welcome to Perplexity' to kim@contoso.com", "observedAt": "2026-08-31T08:02:00.000Z" }, { "kind": "mail_signup", "detail": { "sender": "team@mail.perplexity.ai", "messageId": "mail-0012" }, "source": "graph:security/collaboration/analyzedEmails", "summary": "Signup: 'Confirm your email' to kim@contoso.com", "observedAt": "2026-08-31T08:02:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:perplexity)" } ], "tags": [ "email-signal", "new-accounts", "corroborated" ], "recommendations": [ "Perplexity trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "2 signup emails show people creating Perplexity accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team." ], "firstSeen": "2026-08-31T08:02:00.000Z", "lastSeen": "2026-08-31T08:02:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 2 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "byKind": { "login": 0, "other": 0, "signup": 2, "billing": 0 }, "lastAt": "2026-08-31T08:02:00.000Z", "firstAt": "2026-08-31T08:02:00.000Z", "messages": 2, "recipients": 1, "windowDays": 30, "senderDomains": [ { "count": 2, "domain": "mail.perplexity.ai" } ], "sampleSubjects": [ "Welcome to Perplexity", "Confirm your email" ] }, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:perplexity" ], "status": "open", "lastRunId": "Dx1SbWZTJwmMo5O3UyHRz", "createdAt": "2026-09-14T01:26:01.247Z", "updatedAt": "2026-09-14T01:26:01.058Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:perplexity", "lane": "m365.advanced_hunting", "appKey": "perplexity", "appId": null, "appDisplayName": "Perplexity", "vendor": "Perplexity AI", "category": "search", "confidence": "confirmed", "matchReasons": [ "extension: bmnlcjabgnpnenekpadlanbbkooimhnj" ], "sanctioned": null, "riskScore": 40, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [], "signals": { "network": 0, "process": 0, "software": 0, "extension": 1, "model_file": 0, "local_server": 0 }, "software": [], "processes": [], "extensions": [ { "id": "bmnlcjabgnpnenekpadlanbbkooimhnj", "name": "Perplexity - AI Search", "browser": "Chrome", "devices": 1 } ], "deviceNames": [ "LT-MIA" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw Perplexity on 1 device (0 accounts) in 30 days: 1 browser extension", "observedAt": null } ], "tags": [ "endpoint", "browser-extension" ], "recommendations": [ "Perplexity trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Perplexity runs as a browser extension on 1 device and can read every page those users open, including webmail and internal apps. Manage it with the browser's ExtensionInstallBlocklist or allowlist policy.", "Perplexity was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": { "devices": 1, "domains": [], "signals": { "network": 0, "process": 0, "software": 0, "extension": 1, "model_file": 0, "local_server": 0 }, "accounts": 0, "lastSeen": null, "software": [], "firstSeen": null, "processes": [], "extensions": [ { "id": "bmnlcjabgnpnenekpadlanbbkooimhnj", "name": "Perplexity - AI Search", "browser": "Chrome", "devices": 1 } ], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-MIA" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.061Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:gemini-cloud-assist", "lane": "cloud.gcp", "appKey": "gemini-cloud-assist", "appId": null, "appDisplayName": "Gemini for Google Cloud", "vendor": "Google", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "audit serviceName cloudaicompanion.googleapis.com" ], "sanctioned": null, "riskScore": 39, "severity": "medium", "userCount": 3, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "gcp", "department": null, "displayName": "alice@contoso.com" }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "gcp", "department": null, "displayName": "erin@contoso.com" }, { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "gcp", "department": null, "displayName": "mia@contoso.com" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "cloudaicompanion.googleapis.com" ], "topMethods": [ { "name": "CodeAssist.CompleteCode", "count": 24 }, { "name": "CloudAssist.Chat", "count": 6 } ], "dataAccessLogging": true }, "source": "gcp:audit", "summary": "Google Cloud (demo): Gemini for Google Cloud, 30 audit entries by 3 principals, 30 invocations, API enabled in 1 project in 30 days across 1 project", "observedAt": "2026-09-13T15:01:00.000Z" }, { "kind": "api_enabled", "detail": { "project": "contoso-app-dev" }, "source": "gcp:assets", "summary": "cloudaicompanion.googleapis.com enabled in contoso-app-dev" } ], "tags": [ "gcp", "invocations" ], "recommendations": [ "Gemini for Google Cloud is in use. Review its admin settings for prompt and code data sharing, and whether Code Assist is licensed for everyone using it." ], "firstSeen": "2026-08-30T11:00:00.000Z", "lastSeen": "2026-09-13T15:01:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 2 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 3 }, { "date": "2026-09-08", "count": 3 }, { "date": "2026-09-09", "count": 3 }, { "date": "2026-09-10", "count": 3 }, { "date": "2026-09-11", "count": 3 }, { "date": "2026-09-12", "count": 3 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 0 } ], "events": 30, "lastAt": "2026-09-13T15:01:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-30T11:00:00.000Z", "projects": [ { "id": "contoso-app-dev", "events": 30 } ], "services": [ "cloudaicompanion.googleapis.com" ], "resources": [], "principals": [ { "type": "user", "email": "alice@contoso.com", "denied": 0, "events": 15 }, { "type": "user", "email": "mia@contoso.com", "denied": 0, "events": 9 }, { "type": "user", "email": "erin@contoso.com", "denied": 0, "events": 6 } ], "topMethods": [ { "name": "CodeAssist.CompleteCode", "count": 24 }, { "name": "CloudAssist.Chat", "count": 6 } ], "windowDays": 30, "apiKeyCalls": 0, "enabledApis": [ { "project": "contoso-app-dev", "service": "cloudaicompanion.googleapis.com" } ], "invocations": 30, "writeEvents": 0, "deniedEvents": 0, "connectionName": "Google Cloud (demo)", "serviceAccounts": 0, "dataAccessLogging": true }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:43.057Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:github-copilot", "lane": "code.repositories", "appKey": "github-copilot", "appId": null, "appDisplayName": "GitHub Copilot", "vendor": "GitHub (Microsoft)", "category": "coding", "confidence": "confirmed", "matchReasons": [ "config: Copilot instructions", "config: VS Code MCP servers" ], "sanctioned": null, "riskScore": 39, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/customer-portal", "contoso/helpdesk-bot" ], "configs": [ { "path": "Copilot instructions", "repos": 1 }, { "path": "VS Code MCP servers", "repos": 1 } ], "packages": [], "endpoints": [] }, "source": "repos:fixture", "summary": "GitHub Copilot in 2 repositories via GitHub (demo): Copilot instructions, VS Code MCP servers", "observedAt": "2026-09-13T01:26:01.958Z" } ], "tags": [ "source-code", "fixture", "mcp-servers", "coding-assistant" ], "recommendations": [ "MCP server configuration is committed in 1 repositories. Review which servers agents can reach; a tool server with write access is an agent with write access.", "GitHub Copilot is configured for this codebase. Set a policy on AI coding tools: which are approved, whether repository context may leave the company, and whether generated code needs review flags." ], "firstSeen": null, "lastSeen": "2026-09-13T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/customer-portal", "name": "contoso/customer-portal", "signals": [ "config" ], "pushedAt": "2026-09-13T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/helpdesk-bot", "name": "contoso/helpdesk-bot", "signals": [ "config" ], "pushedAt": "2026-09-08T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [ { "path": "Copilot instructions", "repos": 1 }, { "path": "VS Code MCP servers", "repos": 1 } ], "secrets": 0, "signals": { "alert": 0, "config": 2, "secret": 0, "package": 0, "endpoint": 0, "model_file": 0 }, "packages": [], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-13T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.207Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": "lKadrWUTe2_8vyK2nzVTc", "vendorConnectionId": null, "findingKey": "gcp:lKadrWUTe2_8vyK2nzVTc:gcp-ai-apis", "lane": "cloud.gcp", "appKey": "gcp-ai-apis", "appId": null, "appDisplayName": "Google Cloud AI APIs", "vendor": "Google", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "audit serviceName documentai.googleapis.com" ], "sanctioned": null, "riskScore": 39, "severity": "medium", "userCount": 2, "orgWide": false, "users": [ { "id": "chat-backend@contoso-ai.iam.gserviceaccount.com", "upn": "chat-backend@contoso-ai.iam.gserviceaccount.com", "source": "gcp", "department": null, "displayName": "chat-backend (service account)" }, { "id": "invoice-ocr@contoso-ai.iam.gserviceaccount.com", "upn": "invoice-ocr@contoso-ai.iam.gserviceaccount.com", "source": "gcp", "department": null, "displayName": "invoice-ocr (service account)" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "audit_activity", "detail": { "scopes": [ "organizations/123456789012" ], "services": [ "documentai.googleapis.com", "translate.googleapis.com" ], "topMethods": [ { "name": "DocumentProcessorService.ProcessDocument", "count": 18 }, { "name": "TranslationService.TranslateText", "count": 12 } ], "dataAccessLogging": true }, "source": "gcp:audit", "summary": "Google Cloud (demo): Google Cloud AI APIs, 30 audit entries by 2 principals, 30 invocations, 1 resource, API enabled in 2 projects in 30 days across 2 projects", "observedAt": "2026-09-13T09:29:00.000Z" }, { "kind": "processor", "detail": { "name": "//documentai.googleapis.com/projects/contoso-finance/locations/us/processors/inv1", "type": "INVOICE_PROCESSOR" }, "source": "gcp:assets", "summary": "Processor 'invoice-parser' in contoso-finance (us)", "observedAt": null }, { "kind": "api_enabled", "detail": { "project": "contoso-finance" }, "source": "gcp:assets", "summary": "documentai.googleapis.com enabled in contoso-finance" }, { "kind": "api_enabled", "detail": { "project": "contoso-app-dev" }, "source": "gcp:assets", "summary": "translate.googleapis.com enabled in contoso-app-dev" } ], "tags": [ "gcp", "invocations", "service-account-heavy" ], "recommendations": [ "Google Cloud AI APIs looks well governed. Keep it in the AI inventory with an owner and re-check who can invoke it quarterly." ], "firstSeen": "2026-08-27T08:43:00.000Z", "lastSeen": "2026-09-13T09:29:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 1 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 2 }, { "date": "2026-09-04", "count": 2 }, { "date": "2026-09-05", "count": 2 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 2 }, { "date": "2026-09-09", "count": 2 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 0 } ], "events": 30, "lastAt": "2026-09-13T09:29:00.000Z", "scopes": [ "organizations/123456789012" ], "firstAt": "2026-08-27T08:43:00.000Z", "projects": [ { "id": "contoso-finance", "events": 18 }, { "id": "contoso-app-dev", "events": 12 } ], "services": [ "documentai.googleapis.com", "translate.googleapis.com" ], "resources": [ { "name": "//documentai.googleapis.com/projects/contoso-finance/locations/us/processors/inv1", "type": "documentai.googleapis.com/Processor", "detail": { "type": "INVOICE_PROCESSOR" }, "project": "contoso-finance", "location": "us", "displayName": "invoice-parser" } ], "principals": [ { "type": "serviceAccount", "email": "invoice-ocr@contoso-ai.iam.gserviceaccount.com", "denied": 0, "events": 18 }, { "type": "serviceAccount", "email": "chat-backend@contoso-ai.iam.gserviceaccount.com", "denied": 0, "events": 12 } ], "topMethods": [ { "name": "DocumentProcessorService.ProcessDocument", "count": 18 }, { "name": "TranslationService.TranslateText", "count": 12 } ], "windowDays": 30, "apiKeyCalls": 0, "enabledApis": [ { "project": "contoso-finance", "service": "documentai.googleapis.com" }, { "project": "contoso-app-dev", "service": "translate.googleapis.com" } ], "invocations": 30, "writeEvents": 0, "deniedEvents": 0, "connectionName": "Google Cloud (demo)", "serviceAccounts": 2, "dataAccessLogging": true }, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "ibnqhlLv0iLb6mNoPR9xx", "createdAt": "2026-09-14T02:32:43.076Z", "updatedAt": "2026-09-14T02:32:42.477Z" }, { "repoConnectionId": null, "idpConnectionId": "9BKV_xBnZf5pDRMXOQ1jy", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt", "lane": "identity.provider", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "likely", "matchReasons": [ "app name matches /^chatgpt/" ], "sanctioned": null, "riskScore": 38, "severity": "medium", "userCount": 10, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "0oa1chatgpt" ], "scopes": [], "revoked": 0, "assignedUsers": 10 }, "source": "idp:fixture-okta", "summary": "Okta (demo): ChatGPT, 10 assigned, 60 sign-ins by 10 in 30 days", "observedAt": "2026-09-14T01:45:16.912Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:openai-chatgpt)" } ], "tags": [ "identity", "okta", "admin-managed", "corroborated" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "ChatGPT is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.", "Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access." ], "firstSeen": "2026-08-16T09:13:00.000Z", "lastSeen": "2026-09-14T01:45:16.912Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-08-16", "count": 2 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 2 }, { "date": "2026-08-19", "count": 2 }, { "date": "2026-08-20", "count": 4 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 1 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 2 }, { "date": "2026-08-25", "count": 3 }, { "date": "2026-08-26", "count": 2 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 3 }, { "date": "2026-08-29", "count": 2 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 1 }, { "date": "2026-09-01", "count": 4 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 3 }, { "date": "2026-09-04", "count": 4 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 2 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 4 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 2 }, { "date": "2026-09-13", "count": 3 }, { "date": "2026-09-14", "count": 4 } ], "appIds": [ "0oa1chatgpt" ], "lastAt": "2026-09-14T01:45:16.912Z", "scopes": [], "firstAt": "2026-08-16T09:13:00.000Z", "appNames": [ "ChatGPT Enterprise" ], "provider": "fixture-okta", "ssoEvents": 60, "windowDays": 30, "activeUsers": 10, "oauthGrants": 0, "assignedUsers": 10, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Okta (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt", "mail:openai-chatgpt", "pp:shared_openai", "dlp:openai-chatgpt", "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt", "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt" ], "status": "open", "lastRunId": "TGX1hqy79lxOJaLlZW_nz", "createdAt": "2026-09-14T01:46:17.402Z", "updatedAt": "2026-09-14T01:46:16.817Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mdca:34211", "lane": "m365.cloud_app_discovery", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "domain claude.ai" ], "sanctioned": null, "riskScore": 38, "severity": "medium", "userCount": 3, "orgWide": false, "users": [ { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "network", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "network", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "network_discovery", "detail": { "domains": [ "claude.ai", "anthropic.com" ], "category": "generativeAi", "mdcaAppId": "34211", "riskScore": 8, "ipAddresses": 3, "downloadBytes": 23068672 }, "source": "graph:security/dataDiscovery/cloudAppDiscovery", "summary": "Seen on the network via Defender for Endpoint: 3 users, 860 transactions, 6 MB uploaded in 30 days", "observedAt": "2026-09-13T01:25:59.427Z" } ], "tags": [ "network", "no-entra-footprint" ], "recommendations": [ "Claude shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.", "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on." ], "firstSeen": null, "lastSeen": "2026-09-13T01:25:59.427Z", "usage": null, "network": { "domains": [ "claude.ai", "anthropic.com" ], "streams": [ "Defender for Endpoint" ], "mdcaTags": [ "Generative AI" ], "mdcaAppId": "34211", "userCount": 3, "lastSeenAt": "2026-09-13T01:25:59.427Z", "periodDays": 30, "uploadBytes": 6291456, "mdcaCategory": "generativeAi", "transactions": 860, "downloadBytes": 23068672, "mdcaRiskScore": 8, "ipAddressCount": 3 }, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "V3q69yhE6ynFkRBaAe9xg", "createdAt": "2026-09-14T01:25:59.682Z", "updatedAt": "2026-09-14T01:25:59.422Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:lm-studio", "lane": "m365.advanced_hunting", "appKey": "lm-studio", "appId": null, "appDisplayName": "LM Studio", "vendor": "Element Labs", "category": "local_runtime", "confidence": "confirmed", "matchReasons": [ "process: LM Studio.exe", "software: LM Studio", "local_server: 1234" ], "sanctioned": null, "riskScore": 38, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [], "signals": { "network": 0, "process": 1, "software": 1, "extension": 0, "model_file": 0, "local_server": 1 }, "software": [ { "name": "LM Studio", "devices": 1, "version": "0.3.24" } ], "processes": [ { "name": "LM Studio.exe", "count": 1 } ], "extensions": [], "deviceNames": [ "WS-RESEARCH-01" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw LM Studio on 1 device (1 account) in 30 days: 1 process observation; installed on 1 devices; local inference server on port 1234", "observedAt": "2026-09-11T01:25:58.721Z" } ], "tags": [ "endpoint", "local-inference" ], "recommendations": [ "Local inference keeps prompts on the device but sits outside every SaaS control: no DLP, no audit trail, and models of unknown provenance. Confirm these device is managed and decide whether local AI is allowed at all." ], "firstSeen": "2026-08-30T01:25:58.721Z", "lastSeen": "2026-09-11T01:25:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 1, "domains": [], "signals": { "network": 0, "process": 1, "software": 1, "extension": 0, "model_file": 0, "local_server": 1 }, "accounts": 1, "lastSeen": "2026-09-11T01:25:58.721Z", "software": [ { "name": "LM Studio", "devices": 1, "version": "0.3.24" } ], "firstSeen": "2026-08-30T01:25:58.721Z", "processes": [ { "name": "LM Studio.exe", "count": 1 } ], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "WS-RESEARCH-01" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.076Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.cognitiveservices/accounts/ais-multiservice", "lane": "cloud.ai_platforms", "appKey": "azure-ai-services", "appId": null, "appDisplayName": "Azure AI Services: ais-multiservice", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.cognitiveservices/accounts (AIServices)" ], "sanctioned": null, "riskScore": 37, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "AIServices", "tags": { "owner": "grace@contoso.com" }, "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.CognitiveServices/accounts/ais-multiservice", "deployments": [], "localAuthDisabled": true, "publicNetworkAccess": true }, "source": "azure:resourceGraph", "summary": "Azure AI Services resource 'ais-multiservice' in rg-ai-prod (eastus), subscription 5c2e1f4a: 0 deployments, public network access" } ], "tags": [ "azure", "first-party", "public-endpoint" ], "recommendations": [ "'Azure AI Services: ais-multiservice' accepts traffic from any network. Put it behind a private endpoint or restrict network ACLs to your VNet and office ranges." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "AIServices", "tags": { "owner": "grace@contoso.com" }, "owner": "grace@contoso.com", "location": "eastus", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.CognitiveServices/accounts/ais-multiservice", "deployments": [], "resourceType": "microsoft.cognitiveservices/accounts", "resourceGroup": "rg-ai-prod", "subscriptionId": "5c2e1f4a-1111-4a5b-9c8d-000000000001", "managedIdentity": true, "localAuthDisabled": true, "publicNetworkAccess": true }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.488Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-bots/providers/microsoft.botservice/botservices/contoso-helpdesk-bot", "lane": "cloud.ai_platforms", "appKey": "azure-bot-service", "appId": null, "appDisplayName": "Azure Bot Service: contoso-helpdesk-bot", "vendor": "Microsoft", "category": "agent_platform", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.botservice/botservices (azurebot)" ], "sanctioned": null, "riskScore": 37, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "azurebot", "tags": { "owner": "henry@contoso.com" }, "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-bots/providers/Microsoft.BotService/botServices/contoso-helpdesk-bot", "deployments": [], "localAuthDisabled": null, "publicNetworkAccess": true }, "source": "azure:resourceGraph", "summary": "Azure Bot Service resource 'contoso-helpdesk-bot' in rg-bots (global), subscription 5c2e1f4a: 0 deployments, public network access" } ], "tags": [ "azure", "first-party", "public-endpoint" ], "recommendations": [ "'Azure Bot Service: contoso-helpdesk-bot' accepts traffic from any network. Put it behind a private endpoint or restrict network ACLs to your VNet and office ranges." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "azurebot", "tags": { "owner": "henry@contoso.com" }, "owner": "henry@contoso.com", "location": "global", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-bots/providers/Microsoft.BotService/botServices/contoso-helpdesk-bot", "deployments": [], "resourceType": "microsoft.botservice/botservices", "resourceGroup": "rg-bots", "subscriptionId": "5c2e1f4a-1111-4a5b-9c8d-000000000001", "managedIdentity": false, "localAuthDisabled": null, "publicNetworkAccess": true }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.501Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001", "lane": "m365.audit_log", "appKey": "otter-ai", "appId": null, "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "likely", "matchReasons": [ "app name matches /^otter(\\.ai|pilot)?\\b/" ], "sanctioned": null, "riskScore": 37, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "teams_app_install", "detail": { "hosts": [], "teams": [ { "team": "Sales Leadership", "count": 1 } ], "plugins": [], "operations": [ { "count": 1, "operation": "AppInstalled" }, { "count": 1, "operation": "BotAddedToTeam" } ], "labelledResources": 0 }, "source": "graph:security/auditLog", "summary": "Audit log: Otter.ai, 2 events, 1 person, teams: Sales Leadership in 30 days", "observedAt": "2026-08-24T10:51:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0089", "addOnGuid": "f2f5d4b1-1c2a-4e7b-9a10-otterteams001", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "AppInstalled: Otter.ai by alice@contoso.com", "observedAt": "2026-08-23T10:02:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0090", "addOnGuid": "f2f5d4b1-1c2a-4e7b-9a10-otterteams001", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "BotAddedToTeam: Otter.ai in team 'Sales Leadership' by alice@contoso.com", "observedAt": "2026-08-24T10:51:00.000Z" } ], "tags": [ "audit-log", "teams-app", "bot-in-team" ], "recommendations": [ "Otter.ai was added as a bot to Sales Leadership. Bots in a team receive every channel message. Review with the Teams admin center app permission policies.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-08-23T10:02:00.000Z", "lastSeen": "2026-08-24T10:51:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": { "kind": "teams_app", "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "teams": [ { "team": "Sales Leadership", "count": 1 } ], "users": 1, "byHost": [], "events": 2, "lastAt": "2026-08-24T10:51:00.000Z", "firstAt": "2026-08-23T10:02:00.000Z", "plugins": [], "windowDays": 30, "byOperation": [ { "count": 1, "operation": "AppInstalled" }, { "count": 1, "operation": "BotAddedToTeam" } ], "labelledResources": 0, "resourcesAccessed": 0 }, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "MmBhrcmcT4gc22ZPoDXBp", "createdAt": "2026-09-14T01:26:00.959Z", "updatedAt": "2026-09-14T01:26:00.127Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:claude-code", "lane": "code.repositories", "appKey": "claude-code", "appId": null, "appDisplayName": "Claude Code", "vendor": "Anthropic", "category": "coding", "confidence": "confirmed", "matchReasons": [ "config: Claude Code instructions", "config: Claude Code MCP servers" ], "sanctioned": null, "riskScore": 34, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline" ], "configs": [ { "path": "Claude Code instructions", "repos": 1 }, { "path": "Claude Code MCP servers", "repos": 1 } ], "packages": [], "endpoints": [] }, "source": "repos:fixture", "summary": "Claude Code in 1 repository via GitHub (demo): Claude Code instructions, Claude Code MCP servers", "observedAt": "2026-09-11T01:26:01.958Z" } ], "tags": [ "source-code", "fixture", "mcp-servers", "coding-assistant" ], "recommendations": [ "MCP server configuration is committed in 1 repository. Review which servers agents can reach; a tool server with write access is an agent with write access.", "Claude Code is configured for this codebase. Set a policy on AI coding tools: which are approved, whether repository context may leave the company, and whether generated code needs review flags." ], "firstSeen": null, "lastSeen": "2026-09-11T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "config" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [ { "path": "Claude Code instructions", "repos": 1 }, { "path": "Claude Code MCP servers", "repos": 1 } ], "secrets": 0, "signals": { "alert": 0, "config": 2, "secret": 0, "package": 0, "endpoint": 0, "model_file": 0 }, "packages": [], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-11T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.221Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": "9BKV_xBnZf5pDRMXOQ1jy", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:glean", "lane": "identity.provider", "appKey": "glean", "appId": null, "appDisplayName": "Glean", "vendor": "Glean Technologies", "category": "search", "confidence": "likely", "matchReasons": [ "app name matches /^glean\\b/" ], "sanctioned": null, "riskScore": 33, "severity": "medium", "userCount": 12, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "jack@contoso.com", "upn": "jack@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "kim@contoso.com", "upn": "kim@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "0oa3glean" ], "scopes": [], "revoked": 0, "assignedUsers": 12 }, "source": "idp:fixture-okta", "summary": "Okta (demo): Glean, 12 assigned, 90 sign-ins by 12 in 30 days", "observedAt": "2026-09-14T01:45:16.912Z" } ], "tags": [ "identity", "okta", "admin-managed" ], "recommendations": [ "Glean is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.", "Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access." ], "firstSeen": "2026-08-16T09:13:00.000Z", "lastSeen": "2026-09-14T01:45:16.912Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-08-16", "count": 2 }, { "date": "2026-08-17", "count": 2 }, { "date": "2026-08-18", "count": 2 }, { "date": "2026-08-19", "count": 3 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 3 }, { "date": "2026-08-22", "count": 3 }, { "date": "2026-08-23", "count": 6 }, { "date": "2026-08-24", "count": 3 }, { "date": "2026-08-25", "count": 2 }, { "date": "2026-08-26", "count": 3 }, { "date": "2026-08-27", "count": 2 }, { "date": "2026-08-28", "count": 1 }, { "date": "2026-08-29", "count": 6 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 2 }, { "date": "2026-09-01", "count": 2 }, { "date": "2026-09-02", "count": 8 }, { "date": "2026-09-03", "count": 3 }, { "date": "2026-09-04", "count": 6 }, { "date": "2026-09-05", "count": 4 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 4 }, { "date": "2026-09-08", "count": 3 }, { "date": "2026-09-09", "count": 4 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 3 }, { "date": "2026-09-12", "count": 5 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 1 } ], "appIds": [ "0oa3glean" ], "lastAt": "2026-09-14T01:45:16.912Z", "scopes": [], "firstAt": "2026-08-16T09:13:00.000Z", "appNames": [ "Glean" ], "provider": "fixture-okta", "ssoEvents": 90, "windowDays": 30, "activeUsers": 12, "oauthGrants": 0, "assignedUsers": 12, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Okta (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "TGX1hqy79lxOJaLlZW_nz", "createdAt": "2026-09-14T01:46:17.427Z", "updatedAt": "2026-09-14T01:46:16.817Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:local-models", "lane": "code.repositories", "appKey": null, "appId": null, "appDisplayName": "Local models", "vendor": "Local models", "category": "assistant", "confidence": "likely", "matchReasons": [ "model_file: classifier.onnx", "model_file: tiny-llama.gguf" ], "sanctioned": null, "riskScore": 32, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline", "contoso/research-notebooks" ], "configs": [], "packages": [], "endpoints": [] }, "source": "repos:fixture", "summary": "Local models in 2 repositories via GitHub (demo): 2 model files", "observedAt": "2026-09-11T01:26:01.958Z" } ], "tags": [ "source-code", "fixture" ], "recommendations": [ "2 model files are committed. Confirm provenance and license, and keep weights out of Git with an artifact store." ], "firstSeen": null, "lastSeen": "2026-09-11T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "model_file" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/research-notebooks", "name": "contoso/research-notebooks", "signals": [ "model_file" ], "pushedAt": "2026-09-02T01:26:01.958Z", "isPrivate": false } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 0, "endpoint": 0, "model_file": 2 }, "packages": [], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-11T01:26:01.958Z", "modelFiles": 2, "publicRepos": 1, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.236Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:cursor", "lane": "code.repositories", "appKey": "cursor", "appId": null, "appDisplayName": "Cursor", "vendor": "Anysphere", "category": "coding", "confidence": "confirmed", "matchReasons": [ "config: Cursor rules" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/customer-portal" ], "configs": [ { "path": "Cursor rules", "repos": 1 } ], "packages": [], "endpoints": [] }, "source": "repos:fixture", "summary": "Cursor in 1 repository via GitHub (demo): Cursor rules", "observedAt": "2026-09-13T01:26:01.958Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:cursor" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:cursor)" } ], "tags": [ "source-code", "fixture", "coding-assistant", "corroborated" ], "recommendations": [ "Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Cursor is configured for this codebase. Set a policy on AI coding tools: which are approved, whether repository context may leave the company, and whether generated code needs review flags." ], "firstSeen": null, "lastSeen": "2026-09-13T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/customer-portal", "name": "contoso/customer-portal", "signals": [ "config" ], "pushedAt": "2026-09-13T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [ { "path": "Cursor rules", "repos": 1 } ], "secrets": 0, "signals": { "alert": 0, "config": 1, "secret": 0, "package": 0, "endpoint": 0, "model_file": 0 }, "packages": [], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-13T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:cursor" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.250Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": "JiIPl4VlFl0O3Rg6C5UOK", "findingKey": "vendor:JiIPl4VlFl0O3Rg6C5UOK:cursor", "lane": "vendor.admin_api", "appKey": "cursor", "appId": null, "appDisplayName": "Cursor", "vendor": "Anysphere", "category": "coding", "confidence": "confirmed", "matchReasons": [ "cursor organization API" ], "sanctioned": true, "riskScore": 31, "severity": "medium", "userCount": 6, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "vendor", "department": null, "displayName": "Alice Wu" }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "vendor", "department": null, "displayName": "Erin Diaz" }, { "id": "frank.li.codes@gmail.com", "upn": "frank.li.codes@gmail.com", "source": "vendor", "department": null, "displayName": "frank (personal)" }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "vendor", "department": null, "displayName": "Frank Li" }, { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "vendor", "department": null, "displayName": "Mia Chen" }, { "id": "oscar@contoso.com", "upn": "oscar@contoso.com", "source": "vendor", "department": null, "displayName": "Oscar Ruiz" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_org", "detail": { "byModel": [ { "model": "claude-sonnet-4-5", "tokens": 50600, "requests": 13633 }, { "model": "gpt-5", "tokens": 11400, "requests": 2850 } ], "settings": {}, "warnings": [] }, "source": "vendor:cursor", "summary": "Cursor (demo) (Contoso Engineering): 6 members, 1 admin, 16,483 requests, 246 USD in 30 days", "observedAt": "2026-09-14T03:20:15.511Z" }, { "kind": "external_member", "detail": { "role": "member" }, "source": "vendor:cursor", "summary": "frank.li.codes@gmail.com holds a seat (member) outside the organization's domains", "observedAt": null }, { "kind": "corroboration", "detail": { "findingKey": "mde:cursor" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:cursor)" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:cursor" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:cursor)" } ], "tags": [ "vendor", "cursor", "sanctioned-account", "external-members", "corroborated", "sanctioned" ], "recommendations": [ "1 seat belongs to addresses outside the company in Cursor. Remove them or move the account to SSO with domain verification so only directory identities can hold a seat.", "Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on." ], "firstSeen": "2026-08-15T00:00:00.000Z", "lastSeen": "2026-09-14T03:20:15.511Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": { "plan": "business", "daily": [ { "date": "2026-08-16", "count": 452 }, { "date": "2026-08-17", "count": 456 }, { "date": "2026-08-18", "count": 459 }, { "date": "2026-08-19", "count": 522 }, { "date": "2026-08-20", "count": 526 }, { "date": "2026-08-21", "count": 530 }, { "date": "2026-08-22", "count": 533 }, { "date": "2026-08-23", "count": 536 }, { "date": "2026-08-24", "count": 540 }, { "date": "2026-08-25", "count": 544 }, { "date": "2026-08-26", "count": 547 }, { "date": "2026-08-27", "count": 551 }, { "date": "2026-08-28", "count": 554 }, { "date": "2026-08-29", "count": 558 }, { "date": "2026-08-30", "count": 561 }, { "date": "2026-08-31", "count": 565 }, { "date": "2026-09-01", "count": 568 }, { "date": "2026-09-02", "count": 572 }, { "date": "2026-09-03", "count": 575 }, { "date": "2026-09-04", "count": 579 }, { "date": "2026-09-05", "count": 582 }, { "date": "2026-09-06", "count": 586 }, { "date": "2026-09-07", "count": 589 }, { "date": "2026-09-08", "count": 593 }, { "date": "2026-09-09", "count": 596 }, { "date": "2026-09-10", "count": 600 }, { "date": "2026-09-11", "count": 603 }, { "date": "2026-09-12", "count": 607 }, { "date": "2026-09-13", "count": 550 }, { "date": "2026-09-14", "count": 0 } ], "admins": 1, "lastAt": "2026-09-14T03:20:15.511Z", "apiKeys": 0, "byModel": [ { "model": "claude-sonnet-4-5", "tokens": 50600, "requests": 13633 }, { "model": "gpt-5", "tokens": 11400, "requests": 2850 } ], "cost30d": 246, "firstAt": "2026-08-15", "keyList": [], "members": 6, "orgName": "Contoso Engineering", "currency": "USD", "provider": "cursor", "settings": {}, "warnings": [], "adminKeys": 0, "staleKeys": 0, "costChange": null, "memberList": [ { "name": "Alice Wu", "role": "member", "email": "alice@contoso.com", "addedAt": null, "external": false, "lastActiveAt": "2026-09-14T03:20:15.511Z" }, { "name": "Mia Chen", "role": "member", "email": "mia@contoso.com", "addedAt": null, "external": false, "lastActiveAt": "2026-09-13T03:20:15.511Z" }, { "name": "Frank Li", "role": "member", "email": "frank@contoso.com", "addedAt": null, "external": false, "lastActiveAt": "2026-09-14T03:20:15.511Z" }, { "name": "Erin Diaz", "role": "owner", "email": "erin@contoso.com", "addedAt": null, "external": false, "lastActiveAt": "2026-09-12T03:20:15.511Z" }, { "name": "Oscar Ruiz", "role": "member", "email": "oscar@contoso.com", "addedAt": null, "external": false, "lastActiveAt": "2026-08-25T03:20:15.511Z" }, { "name": "frank (personal)", "role": "member", "email": "frank.li.codes@gmail.com", "addedAt": null, "external": true, "lastActiveAt": "2026-09-11T03:20:15.511Z" } ], "unusedKeys": 0, "windowDays": 30, "workspaces": [], "requests30d": 16483, "costPrior30d": 0, "activeUsers30d": 6, "connectionName": "Cursor (demo)", "inputTokens30d": 0, "pendingMembers": 0, "externalMembers": 1, "inactiveMembers": 0, "outputTokens30d": 62000, "serviceAccountKeys": 0 }, "relatedKeys": [ "mde:cursor", "repo:giypXj7r_Gc5tatesErdR:cursor" ], "status": "open", "lastRunId": "59OQbPmKxYOj20-KgbITK", "createdAt": "2026-09-14T03:20:15.997Z", "updatedAt": "2026-09-14T03:20:15.511Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": "W8Km0jZDrEPSTugZ6azsA", "findingKey": "vendor:W8Km0jZDrEPSTugZ6azsA:github-copilot", "lane": "vendor.admin_api", "appKey": "github-copilot", "appId": null, "appDisplayName": "GitHub Copilot", "vendor": "GitHub (Microsoft)", "category": "coding", "confidence": "confirmed", "matchReasons": [ "github-copilot organization API" ], "sanctioned": true, "riskScore": 31, "severity": "medium", "userCount": 12, "orgWide": false, "users": [ { "id": "alice-wu", "upn": "alice-wu", "source": "vendor", "department": null, "displayName": "alice-wu" }, { "id": "erin-diaz", "upn": "erin-diaz", "source": "vendor", "department": null, "displayName": "erin-diaz" }, { "id": "frank-li", "upn": "frank-li", "source": "vendor", "department": null, "displayName": "frank-li" }, { "id": "grace-h", "upn": "grace-h", "source": "vendor", "department": null, "displayName": "grace-h" }, { "id": "jo-m", "upn": "jo-m", "source": "vendor", "department": null, "displayName": "jo-m" }, { "id": "kai-t", "upn": "kai-t", "source": "vendor", "department": null, "displayName": "kai-t" }, { "id": "lee-q", "upn": "lee-q", "source": "vendor", "department": null, "displayName": "lee-q" }, { "id": "mia-chen", "upn": "mia-chen", "source": "vendor", "department": null, "displayName": "mia-chen" }, { "id": "nina-p", "upn": "nina-p", "source": "vendor", "department": null, "displayName": "nina-p" }, { "id": "oscar-r", "upn": "oscar-r", "source": "vendor", "department": null, "displayName": "oscar-r" }, { "id": "sam-k", "upn": "sam-k", "source": "vendor", "department": null, "displayName": "sam-k" }, { "id": "tom-b", "upn": "tom-b", "source": "vendor", "department": null, "displayName": "tom-b" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_org", "detail": { "byModel": [ { "model": "default", "tokens": 14140, "requests": 47600 }, { "model": "gpt-4o", "tokens": 0, "requests": 6160 } ], "settings": { "ideChat": "enabled", "seatManagement": "assign_selected", "inactiveThisCycle": 4, "pendingInvitations": 2, "publicCodeSuggestions": "allow" }, "warnings": [] }, "source": "vendor:github-copilot", "summary": "GitHub Copilot (demo) (contoso): 12 members, 53,760 requests in 30 days", "observedAt": "2026-09-14T03:20:15.127Z" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:github-copilot" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:github-copilot)" } ], "tags": [ "vendor", "github-copilot", "sanctioned-account", "pending-invites", "idle-seats", "public-code-allowed", "corroborated", "sanctioned" ], "recommendations": [ "4 seats have no activity in 30 days. Reclaim them; on per-seat plans that is money, on usage plans it is standing access.", "Copilot is allowed to suggest code matching public repositories. Turn public code suggestions off unless legal has accepted the license exposure.", "2 invitations are pending. Expire invitations that were not accepted within a week." ], "firstSeen": "2025-11-18T03:20:15.127Z", "lastSeen": "2026-09-14T03:20:15.127Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": { "plan": "business", "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 1920 }, { "date": "2026-08-18", "count": 1920 }, { "date": "2026-08-19", "count": 1920 }, { "date": "2026-08-20", "count": 1920 }, { "date": "2026-08-21", "count": 1920 }, { "date": "2026-08-22", "count": 1920 }, { "date": "2026-08-23", "count": 1920 }, { "date": "2026-08-24", "count": 1920 }, { "date": "2026-08-25", "count": 1920 }, { "date": "2026-08-26", "count": 1920 }, { "date": "2026-08-27", "count": 1920 }, { "date": "2026-08-28", "count": 1920 }, { "date": "2026-08-29", "count": 1920 }, { "date": "2026-08-30", "count": 1920 }, { "date": "2026-08-31", "count": 1920 }, { "date": "2026-09-01", "count": 1920 }, { "date": "2026-09-02", "count": 1920 }, { "date": "2026-09-03", "count": 1920 }, { "date": "2026-09-04", "count": 1920 }, { "date": "2026-09-05", "count": 1920 }, { "date": "2026-09-06", "count": 1920 }, { "date": "2026-09-07", "count": 1920 }, { "date": "2026-09-08", "count": 1920 }, { "date": "2026-09-09", "count": 1920 }, { "date": "2026-09-10", "count": 1920 }, { "date": "2026-09-11", "count": 1920 }, { "date": "2026-09-12", "count": 1920 }, { "date": "2026-09-13", "count": 1920 }, { "date": "2026-09-14", "count": 0 } ], "admins": 0, "lastAt": "2026-09-14T03:20:15.127Z", "apiKeys": 0, "byModel": [ { "model": "default", "tokens": 14140, "requests": 47600 }, { "model": "gpt-4o", "tokens": 0, "requests": 6160 } ], "cost30d": 0, "firstAt": "2025-11-18T03:20:15.127Z", "keyList": [], "members": 12, "orgName": "contoso", "currency": "USD", "provider": "github-copilot", "settings": { "ideChat": "enabled", "seatManagement": "assign_selected", "inactiveThisCycle": 4, "pendingInvitations": 2, "publicCodeSuggestions": "allow" }, "warnings": [], "adminKeys": 0, "staleKeys": 0, "costChange": null, "memberList": [ { "name": "alice-wu", "role": "business", "email": null, "addedAt": "2025-11-18T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-14T03:20:15.127Z" }, { "name": "mia-chen", "role": "business", "email": null, "addedAt": "2025-11-18T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-13T03:20:15.127Z" }, { "name": "frank-li", "role": "business", "email": null, "addedAt": "2026-01-07T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-12T03:20:15.127Z" }, { "name": "erin-diaz", "role": "business", "email": null, "addedAt": "2026-02-26T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-13T03:20:15.127Z" }, { "name": "oscar-r", "role": "business", "email": null, "addedAt": "2026-02-26T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-14T03:20:15.127Z" }, { "name": "grace-h", "role": "business", "email": null, "addedAt": "2025-11-18T03:20:15.127Z", "external": false, "lastActiveAt": "2026-09-11T03:20:15.127Z" }, { "name": "nina-p", "role": "business", "email": null, "addedAt": "2026-06-06T03:20:15.127Z", "external": false, "lastActiveAt": "2026-07-31T03:20:15.127Z" }, { "name": "tom-b", "role": "business", "email": null, "addedAt": "2026-05-17T03:20:15.127Z", "external": false, "lastActiveAt": "2026-07-16T03:20:15.127Z" }, { "name": "sam-k", "role": "business", "email": null, "addedAt": "2026-06-16T03:20:15.127Z", "external": false, "lastActiveAt": null }, { "name": "lee-q", "role": "business", "email": null, "addedAt": "2026-08-15T03:20:15.127Z", "external": false, "lastActiveAt": null }, { "name": "jo-m", "role": "business", "email": null, "addedAt": "2026-02-26T03:20:15.127Z", "external": false, "lastActiveAt": "2026-08-10T03:20:15.127Z" }, { "name": "kai-t", "role": "business", "email": null, "addedAt": "2026-02-26T03:20:15.127Z", "external": false, "lastActiveAt": "2026-07-26T03:20:15.127Z" } ], "unusedKeys": 0, "windowDays": 30, "workspaces": [], "requests30d": 53760, "costPrior30d": 0, "activeUsers30d": 0, "connectionName": "GitHub Copilot (demo)", "inputTokens30d": 0, "pendingMembers": 2, "externalMembers": 0, "inactiveMembers": 4, "outputTokens30d": 14140, "serviceAccountKeys": 0 }, "relatedKeys": [ "repo:giypXj7r_Gc5tatesErdR:github-copilot" ], "status": "open", "lastRunId": "ioyINfdCnitbfGfGRvR9B", "createdAt": "2026-09-14T03:20:15.485Z", "updatedAt": "2026-09-14T03:20:15.127Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:huggingface", "lane": "siem.network", "appKey": "huggingface", "appId": null, "appDisplayName": "Hugging Face", "vendor": "Hugging Face", "category": "model_hub", "confidence": "confirmed", "matchReasons": [ "fixture host cdn-lfs-us-1.huggingface.co" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "siem", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "siem_traffic", "detail": { "hosts": [ { "host": "cdn-lfs-us-1.huggingface.co", "events": 60, "bytesOut": 1048576 } ], "bytesIn": 2147483647, "bytesOut": 1048576, "topUsers": [ { "user": "frank@contoso.com", "events": 60 } ], "topSources": [ { "events": 60, "source": "10.20.6.8" } ] }, "source": "siem:fixture", "summary": "Splunk (demo): 60 events to cdn-lfs-us-1.huggingface.co from 1 user and 1 source in 30 days, 1 MB uploaded", "observedAt": "2026-09-08T01:26:01.759Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:huggingface" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:huggingface)" } ], "tags": [ "siem", "fixture", "corroborated" ], "recommendations": [ "Splunk (demo) confirms what Microsoft 365 signals show for Hugging Face. Use the source list here to find the exact devices and network segments involved." ], "firstSeen": "2026-09-08T01:26:01.759Z", "lastSeen": "2026-09-08T01:26:01.759Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": { "hosts": [ { "host": "cdn-lfs-us-1.huggingface.co", "events": 60, "bytesOut": 1048576 } ], "users": 1, "events": 60, "lastAt": "2026-09-08T01:26:01.759Z", "bytesIn": 2147483647, "firstAt": "2026-09-08T01:26:01.759Z", "sources": 1, "bytesOut": 1048576, "provider": "fixture", "topUsers": [ { "user": "frank@contoso.com", "events": 60 } ], "topSources": [ { "events": 60, "source": "10.20.6.8" } ], "windowDays": 30, "connectionName": "Splunk (demo)" }, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:huggingface" ], "status": "open", "lastRunId": "nfYxABKc0lCJE9i9Dkhit", "createdAt": "2026-09-14T01:26:01.909Z", "updatedAt": "2026-09-14T01:26:01.758Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:huggingface", "lane": "code.repositories", "appKey": "huggingface", "appId": null, "appDisplayName": "Hugging Face", "vendor": "Hugging Face", "category": "model_hub", "confidence": "confirmed", "matchReasons": [ "package: sentence-transformers", "package: transformers", "package: huggingface-hub" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline", "contoso/research-notebooks" ], "configs": [], "packages": [ { "name": "sentence-transformers", "repos": 1, "ecosystem": "pypi" }, { "name": "transformers", "repos": 1, "ecosystem": "pypi" }, { "name": "huggingface-hub", "repos": 1, "ecosystem": "pypi" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "Hugging Face in 2 repositories via GitHub (demo): packages sentence-transformers, transformers, huggingface-hub", "observedAt": "2026-09-11T01:26:01.958Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:huggingface" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:huggingface)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:huggingface" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:huggingface)" } ], "tags": [ "source-code", "fixture", "corroborated" ], "recommendations": [ "Hugging Face SDKs appear in 2 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-11T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "package" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true }, { "url": "https://github.com/contoso/research-notebooks", "name": "contoso/research-notebooks", "signals": [ "package" ], "pushedAt": "2026-09-02T01:26:01.958Z", "isPrivate": false } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 3, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "sentence-transformers", "repos": 1, "ecosystem": "pypi" }, { "name": "transformers", "repos": 1, "ecosystem": "pypi" }, { "name": "huggingface-hub", "repos": 1, "ecosystem": "pypi" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-11T01:26:01.958Z", "modelFiles": 0, "publicRepos": 1, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:huggingface", "siem:P3xsUoa63aFWUE_YRNuUJ:huggingface" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.292Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:langchain", "lane": "code.repositories", "appKey": null, "appId": null, "appDisplayName": "LangChain", "vendor": "LangChain", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: langchain" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline" ], "configs": [], "packages": [ { "name": "langchain", "repos": 1, "ecosystem": "pypi" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "LangChain in 1 repository via GitHub (demo): packages langchain", "observedAt": "2026-09-11T01:26:01.958Z" } ], "tags": [ "source-code", "fixture" ], "recommendations": [ "LangChain SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-11T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "package" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 1, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "langchain", "repos": 1, "ecosystem": "pypi" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-11T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.278Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:litellm", "lane": "code.repositories", "appKey": null, "appId": null, "appDisplayName": "LiteLLM", "vendor": "LiteLLM", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: litellm" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/data-pipeline" ], "configs": [], "packages": [ { "name": "litellm", "repos": 1, "ecosystem": "pypi" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "LiteLLM in 1 repository via GitHub (demo): packages litellm", "observedAt": "2026-09-11T01:26:01.958Z" } ], "tags": [ "source-code", "fixture" ], "recommendations": [ "LiteLLM SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-11T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/data-pipeline", "name": "contoso/data-pipeline", "signals": [ "package" ], "pushedAt": "2026-09-11T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 1, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "litellm", "repos": 1, "ecosystem": "pypi" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-11T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.306Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:microsoft", "lane": "code.repositories", "appKey": null, "appId": null, "appDisplayName": "Microsoft", "vendor": "Microsoft", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: Microsoft.SemanticKernel" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/helpdesk-bot" ], "configs": [], "packages": [ { "name": "Microsoft.SemanticKernel", "repos": 1, "ecosystem": "nuget" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "Microsoft in 1 repository via GitHub (demo): packages Microsoft.SemanticKernel", "observedAt": "2026-09-08T01:26:01.958Z" } ], "tags": [ "source-code", "fixture" ], "recommendations": [ "Microsoft SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-08T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/helpdesk-bot", "name": "contoso/helpdesk-bot", "signals": [ "package" ], "pushedAt": "2026-09-08T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 1, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "Microsoft.SemanticKernel", "repos": 1, "ecosystem": "nuget" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-08T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.319Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:vercel", "lane": "code.repositories", "appKey": null, "appId": null, "appDisplayName": "Vercel", "vendor": "Vercel", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "package: ai", "package: @ai-sdk/openai" ], "sanctioned": null, "riskScore": 31, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/customer-portal" ], "configs": [], "packages": [ { "name": "ai", "repos": 1, "ecosystem": "npm" }, { "name": "@ai-sdk/openai", "repos": 1, "ecosystem": "npm" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "Vercel in 1 repository via GitHub (demo): packages ai, @ai-sdk/openai", "observedAt": "2026-09-13T01:26:01.958Z" } ], "tags": [ "source-code", "fixture" ], "recommendations": [ "Vercel SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-13T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/customer-portal", "name": "contoso/customer-portal", "signals": [ "package" ], "pushedAt": "2026-09-13T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 2, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "ai", "repos": 1, "ecosystem": "npm" }, { "name": "@ai-sdk/openai", "repos": 1, "ecosystem": "npm" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-13T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.264Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.machinelearningservices/workspaces/proj-support-agent", "lane": "cloud.ai_platforms", "appKey": "azure-ai-foundry", "appId": null, "appDisplayName": "Azure AI Foundry: proj-support-agent", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.machinelearningservices/workspaces (Project)" ], "sanctioned": null, "riskScore": 30, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "Project", "tags": {}, "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.MachineLearningServices/workspaces/proj-support-agent", "deployments": [], "localAuthDisabled": null, "publicNetworkAccess": false }, "source": "azure:resourceGraph", "summary": "Azure AI Foundry resource 'proj-support-agent' in rg-ai-prod (eastus), subscription 5c2e1f4a: 0 deployments" } ], "tags": [ "azure", "first-party", "no-owner-tag" ], "recommendations": [ "No owner tag. Tag the resource with an owner and cost center so someone answers for its prompts, spend, and content-filter settings." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "Project", "tags": {}, "owner": null, "location": "eastus", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.MachineLearningServices/workspaces/proj-support-agent", "deployments": [], "resourceType": "microsoft.machinelearningservices/workspaces", "resourceGroup": "rg-ai-prod", "subscriptionId": "5c2e1f4a-1111-4a5b-9c8d-000000000001", "managedIdentity": true, "localAuthDisabled": null, "publicNetworkAccess": false }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.529Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "pp:shared_azureopenai", "lane": "cloud.ai_platforms", "appKey": "azure-openai", "appId": null, "appDisplayName": "Azure OpenAI via Power Platform", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "connector shared_azureopenai" ], "sanctioned": null, "riskScore": 30, "severity": "medium", "userCount": 3, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "platform", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "platform", "department": null, "displayName": null }, { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "connector_usage", "detail": { "thirdParty": false, "connectorId": "shared_azureopenai", "environments": [ { "name": "Contoso Prod", "type": "Production", "connections": 2 }, { "name": "Contoso Dev", "type": "Sandbox", "connections": 1 } ] }, "source": "powerplatform:admin", "summary": "Azure OpenAI connector: 3 connections by 3 makers across Contoso Prod, Contoso Dev", "observedAt": "2026-08-30T01:26:01.408Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0101" }, "source": "powerplatform:admin", "summary": "Connection 'Azure OpenAI prod' created by grace@contoso.com", "observedAt": "2026-05-17T01:26:01.384Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0102" }, "source": "powerplatform:admin", "summary": "Connection 'Azure OpenAI summariser' created by frank@contoso.com", "observedAt": "2026-07-16T01:26:01.384Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0202" }, "source": "powerplatform:admin", "summary": "Connection 'Azure OpenAI dev' created by liam@contoso.com", "observedAt": "2026-08-30T01:26:01.408Z" } ], "tags": [ "power-platform" ], "recommendations": [ "Azure OpenAI keeps data inside Microsoft, so the question is governance: confirm the 3 makers are expected and the flows are owned by a team, not an individual." ], "firstSeen": "2026-05-17T01:26:01.384Z", "lastSeen": "2026-08-30T01:26:01.408Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": { "lastAt": "2026-08-30T01:26:01.408Z", "firstAt": "2026-05-17T01:26:01.384Z", "creators": 3, "thirdParty": false, "connections": 3, "connectorId": "shared_azureopenai", "environments": [ { "name": "Contoso Prod", "type": "Production", "connections": 2 }, { "name": "Contoso Dev", "type": "Sandbox", "connections": 1 } ], "connectorName": "Azure OpenAI", "defaultEnvironment": false }, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.543Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.cognitiveservices/accounts/aoai-prod-eastus", "lane": "cloud.ai_platforms", "appKey": "azure-openai", "appId": null, "appDisplayName": "Azure OpenAI: aoai-prod-eastus", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.cognitiveservices/accounts (OpenAI)" ], "sanctioned": null, "riskScore": 30, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "OpenAI", "tags": { "owner": "grace@contoso.com", "costcenter": "R&D" }, "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.CognitiveServices/accounts/aoai-prod-eastus", "deployments": [ { "name": "gpt-4o", "model": "gpt-4o", "version": "2024-11-20" }, { "name": "text-embedding-3-large", "model": "text-embedding-3-large", "version": "1" } ], "localAuthDisabled": true, "publicNetworkAccess": false }, "source": "azure:resourceGraph", "summary": "Azure OpenAI resource 'aoai-prod-eastus' in rg-ai-prod (eastus), subscription 5c2e1f4a: 2 deployments" } ], "tags": [ "azure", "first-party", "model-deployments" ], "recommendations": [ "2 model deployments (gpt-4o, text-embedding-3-large). Confirm content filtering and abuse monitoring are on, and that logging captures prompts if your policy requires it." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "OpenAI", "tags": { "owner": "grace@contoso.com", "costcenter": "R&D" }, "owner": "grace@contoso.com", "location": "eastus", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.CognitiveServices/accounts/aoai-prod-eastus", "deployments": [ { "name": "gpt-4o", "model": "gpt-4o", "version": "2024-11-20" }, { "name": "text-embedding-3-large", "model": "text-embedding-3-large", "version": "1" } ], "resourceType": "microsoft.cognitiveservices/accounts", "resourceGroup": "rg-ai-prod", "subscriptionId": "5c2e1f4a-1111-4a5b-9c8d-000000000001", "managedIdentity": true, "localAuthDisabled": true, "publicNetworkAccess": false }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.515Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt", "lane": "identity.provider", "appKey": "openai-chatgpt", "appId": null, "appDisplayName": "ChatGPT", "vendor": "OpenAI", "category": "assistant", "confidence": "likely", "matchReasons": [ "app name matches /^chatgpt/" ], "sanctioned": null, "riskScore": 30, "severity": "medium", "userCount": 5, "orgWide": false, "users": [ { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [ "openid", "userinfo.email", "userinfo.profile" ], "permissionTier": "low", "dataClasses": [], "grants": [], "evidence": [ { "kind": "oauth_grants", "detail": { "appIds": [ "407408718192-openai.apps.googleusercontent.com" ], "scopes": [ { "scope": "openid", "users": 5 }, { "scope": "userinfo.email", "users": 5 }, { "scope": "userinfo.profile", "users": 5 } ], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): ChatGPT, 5 OAuth grants (openid, userinfo.email, userinfo.profile) in 90 days", "observedAt": "2026-08-16T11:13:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "407408718192-openai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "dave@contoso.com authorized ChatGPT: openid, userinfo.email, userinfo.profile", "observedAt": "2026-07-19T11:09:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "407408718192-openai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "erin@contoso.com authorized ChatGPT: openid, userinfo.email, userinfo.profile", "observedAt": "2026-08-15T11:30:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "407408718192-openai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "frank@contoso.com authorized ChatGPT: openid, userinfo.email, userinfo.profile", "observedAt": "2026-08-16T11:13:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "407408718192-openai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "henry@contoso.com authorized ChatGPT: openid, userinfo.email, userinfo.profile", "observedAt": "2026-07-04T11:24:00.000Z" }, { "kind": "oauth_grant", "detail": { "clientId": "407408718192-openai.apps.googleusercontent.com" }, "source": "idp:fixture-google", "summary": "iris@contoso.com authorized ChatGPT: openid, userinfo.email, userinfo.profile", "observedAt": "2026-07-17T11:43:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:11114" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:11114)" }, { "kind": "corroboration", "detail": { "findingKey": "mde:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_openai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_openai)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:openai-chatgpt)" }, { "kind": "corroboration", "detail": { "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt" }, "source": "lantern:corroboration", "summary": "Also found by another lane (idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt)" } ], "tags": [ "identity", "googleworkspace", "user-consented", "corroborated", "dormant" ], "recommendations": [ "ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "ChatGPT holds low-scope OAuth grants from 5 people (sign-in only). Low exposure, but decide whether \"Sign in with Google\" to AI apps is allowed at all.", "ChatGPT was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.", "Nobody signed into ChatGPT through Google in 90 days. Unassign or revoke to reduce standing access." ], "firstSeen": "2026-07-04T11:24:00.000Z", "lastSeen": "2026-08-16T11:13:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "407408718192-openai.apps.googleusercontent.com" ], "lastAt": "2026-08-16T11:13:00.000Z", "scopes": [ { "scope": "openid", "users": 5 }, { "scope": "userinfo.email", "users": 5 }, { "scope": "userinfo.profile", "users": 5 } ], "firstAt": "2026-07-04T11:24:00.000Z", "appNames": [ "ChatGPT" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 0, "oauthGrants": 5, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "consent:aaaa0002-0000-4000-8000-000000000002", "mdca:11114", "mde:openai-chatgpt", "mail:openai-chatgpt", "pp:shared_openai", "dlp:openai-chatgpt", "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt", "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt", "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt" ], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.827Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "ual:teams:1a2b3c4d-mmind-4e5f-8a9b-000000000077", "lane": "m365.audit_log", "appKey": null, "appId": null, "appDisplayName": "MeetingMind Notetaker", "vendor": null, "category": "meeting_notes", "confidence": "suspected", "matchReasons": [ "name keyword /note ?taker/" ], "sanctioned": null, "riskScore": 30, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "teams_app_install", "detail": { "hosts": [], "teams": [], "plugins": [], "operations": [ { "count": 1, "operation": "AppInstalled" } ], "labelledResources": 0 }, "source": "graph:security/auditLog", "summary": "Audit log: MeetingMind Notetaker, 1 event, 1 person in 30 days", "observedAt": "2026-09-08T10:06:00.000Z" }, { "kind": "teams_app_event", "detail": { "recordId": "ual-0094", "addOnGuid": "1a2b3c4d-mmind-4e5f-8a9b-000000000077", "addOnType": "Bot" }, "source": "graph:security/auditLog", "summary": "AppInstalled: MeetingMind Notetaker by bob@contoso.com", "observedAt": "2026-09-08T10:06:00.000Z" } ], "tags": [ "audit-log", "teams-app", "bot-in-team" ], "recommendations": [ "Confirm whether MeetingMind Notetaker is an AI service, then sanction, block, or ignore it.", "MeetingMind Notetaker was added as a bot to a team. Bots in a team receive every channel message. Review with the Teams admin center app permission policies." ], "firstSeen": "2026-09-08T10:06:00.000Z", "lastSeen": "2026-09-08T10:06:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": { "kind": "teams_app", "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 1 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "teams": [], "users": 1, "byHost": [], "events": 1, "lastAt": "2026-09-08T10:06:00.000Z", "firstAt": "2026-09-08T10:06:00.000Z", "plugins": [], "windowDays": 30, "byOperation": [ { "count": 1, "operation": "AppInstalled" } ], "labelledResources": 0, "resourcesAccessed": 0 }, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "MmBhrcmcT4gc22ZPoDXBp", "createdAt": "2026-09-14T01:26:00.973Z", "updatedAt": "2026-09-14T01:26:00.127Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:gemini-workspace", "lane": "identity.provider", "appKey": "gemini-workspace", "appId": null, "appDisplayName": "Gemini for Workspace", "vendor": "Google", "category": "embedded_feature", "confidence": "likely", "matchReasons": [ "app name matches /^gemini\\s+(for|in)\\s+workspace/" ], "sanctioned": null, "riskScore": 29, "severity": "medium", "userCount": 8, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "provider_usage", "detail": { "appIds": [ "usage:gemini-for-workspace" ], "scopes": [], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Gemini for Workspace, 48 usage events in 90 days", "observedAt": "2026-09-14T01:45:17.534Z" } ], "tags": [ "identity", "googleworkspace", "first-party" ], "recommendations": [ "Gemini for Workspace is in use by 8 people. Review the Gemini admin settings for which apps and data sources it can reach, and whether it is licensed for everyone using it." ], "firstSeen": "2026-08-16T09:13:00.000Z", "lastSeen": "2026-09-14T01:45:17.534Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 3 }, { "date": "2026-08-17", "count": 1 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 3 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 2 }, { "date": "2026-08-25", "count": 3 }, { "date": "2026-08-26", "count": 3 }, { "date": "2026-08-27", "count": 2 }, { "date": "2026-08-28", "count": 2 }, { "date": "2026-08-29", "count": 2 }, { "date": "2026-08-30", "count": 2 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 1 }, { "date": "2026-09-02", "count": 2 }, { "date": "2026-09-03", "count": 1 }, { "date": "2026-09-04", "count": 1 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 1 }, { "date": "2026-09-08", "count": 3 }, { "date": "2026-09-09", "count": 3 }, { "date": "2026-09-10", "count": 1 }, { "date": "2026-09-11", "count": 1 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 2 }, { "date": "2026-09-14", "count": 3 } ], "appIds": [ "usage:gemini-for-workspace" ], "lastAt": "2026-09-14T01:45:17.534Z", "scopes": [], "firstAt": "2026-08-16T09:13:00.000Z", "appNames": [ "Gemini for Workspace" ], "provider": "fixture-google", "ssoEvents": 0, "windowDays": 90, "activeUsers": 8, "oauthGrants": 0, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": false, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.860Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": "9BKV_xBnZf5pDRMXOQ1jy", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:otter-ai", "lane": "identity.provider", "appKey": "otter-ai", "appId": null, "appDisplayName": "Otter.ai", "vendor": "Otter.ai (AISense)", "category": "meeting_notes", "confidence": "likely", "matchReasons": [ "app name matches /^otter(\\.ai|pilot)?\\b/" ], "sanctioned": null, "riskScore": 29, "severity": "medium", "userCount": 4, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "0oa2otter" ], "scopes": [], "revoked": 0, "assignedUsers": 4 }, "source": "idp:fixture-okta", "summary": "Okta (demo): Otter.ai, 4 assigned, 14 sign-ins by 4 in 30 days", "observedAt": "2026-09-14T01:45:16.912Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:25017" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:25017)" }, { "kind": "corroboration", "detail": { "findingKey": "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001)" }, { "kind": "corroboration", "detail": { "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001" }, "source": "lantern:corroboration", "summary": "Also found by another lane (consent:aaaa0001-0000-4000-8000-000000000001)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:otter-ai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:otter-ai)" } ], "tags": [ "identity", "okta", "admin-managed", "corroborated" ], "recommendations": [ "Otter.ai is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.", "Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it." ], "firstSeen": "2026-08-18T09:39:00.000Z", "lastSeen": "2026-09-14T01:45:16.912Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 1 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 1 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 1 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 1 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 2 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 1 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 1 } ], "appIds": [ "0oa2otter" ], "lastAt": "2026-09-14T01:45:16.912Z", "scopes": [], "firstAt": "2026-08-18T09:39:00.000Z", "appNames": [ "Otter.ai" ], "provider": "fixture-okta", "ssoEvents": 14, "windowDays": 30, "activeUsers": 4, "oauthGrants": 0, "assignedUsers": 4, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Okta (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:25017", "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001", "consent:aaaa0001-0000-4000-8000-000000000001", "mail:otter-ai" ], "status": "open", "lastRunId": "TGX1hqy79lxOJaLlZW_nz", "createdAt": "2026-09-14T01:46:17.444Z", "updatedAt": "2026-09-14T01:46:16.817Z" }, { "repoConnectionId": null, "idpConnectionId": "EuOZkNxsuTloBalkqeoRT", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:perplexity", "lane": "identity.provider", "appKey": "perplexity", "appId": null, "appDisplayName": "Perplexity", "vendor": "Perplexity AI", "category": "search", "confidence": "likely", "matchReasons": [ "app name matches /^perplexity/" ], "sanctioned": null, "riskScore": 29, "severity": "medium", "userCount": 5, "orgWide": false, "users": [ { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "henry@contoso.com", "upn": "henry@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "iris@contoso.com", "upn": "iris@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "saml:Perplexity Enterprise" ], "scopes": [], "revoked": 0, "assignedUsers": 0 }, "source": "idp:fixture-google", "summary": "Google Workspace (demo): Perplexity, 22 sign-ins by 5 in 90 days", "observedAt": "2026-09-11T10:51:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mde:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mde:perplexity)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:perplexity)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:perplexity" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:perplexity)" } ], "tags": [ "identity", "googleworkspace", "admin-managed", "corroborated" ], "recommendations": [ "Perplexity trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Perplexity is assigned through Google Workspace, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is." ], "firstSeen": "2026-08-20T10:05:00.000Z", "lastSeen": "2026-09-11T10:51:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-06-17", "count": 0 }, { "date": "2026-06-18", "count": 0 }, { "date": "2026-06-19", "count": 0 }, { "date": "2026-06-20", "count": 0 }, { "date": "2026-06-21", "count": 0 }, { "date": "2026-06-22", "count": 0 }, { "date": "2026-06-23", "count": 0 }, { "date": "2026-06-24", "count": 0 }, { "date": "2026-06-25", "count": 0 }, { "date": "2026-06-26", "count": 0 }, { "date": "2026-06-27", "count": 0 }, { "date": "2026-06-28", "count": 0 }, { "date": "2026-06-29", "count": 0 }, { "date": "2026-06-30", "count": 0 }, { "date": "2026-07-01", "count": 0 }, { "date": "2026-07-02", "count": 0 }, { "date": "2026-07-03", "count": 0 }, { "date": "2026-07-04", "count": 0 }, { "date": "2026-07-05", "count": 0 }, { "date": "2026-07-06", "count": 0 }, { "date": "2026-07-07", "count": 0 }, { "date": "2026-07-08", "count": 0 }, { "date": "2026-07-09", "count": 0 }, { "date": "2026-07-10", "count": 0 }, { "date": "2026-07-11", "count": 0 }, { "date": "2026-07-12", "count": 0 }, { "date": "2026-07-13", "count": 0 }, { "date": "2026-07-14", "count": 0 }, { "date": "2026-07-15", "count": 0 }, { "date": "2026-07-16", "count": 0 }, { "date": "2026-07-17", "count": 0 }, { "date": "2026-07-18", "count": 0 }, { "date": "2026-07-19", "count": 0 }, { "date": "2026-07-20", "count": 0 }, { "date": "2026-07-21", "count": 0 }, { "date": "2026-07-22", "count": 0 }, { "date": "2026-07-23", "count": 0 }, { "date": "2026-07-24", "count": 0 }, { "date": "2026-07-25", "count": 0 }, { "date": "2026-07-26", "count": 0 }, { "date": "2026-07-27", "count": 0 }, { "date": "2026-07-28", "count": 0 }, { "date": "2026-07-29", "count": 0 }, { "date": "2026-07-30", "count": 0 }, { "date": "2026-07-31", "count": 0 }, { "date": "2026-08-01", "count": 0 }, { "date": "2026-08-02", "count": 0 }, { "date": "2026-08-03", "count": 0 }, { "date": "2026-08-04", "count": 0 }, { "date": "2026-08-05", "count": 0 }, { "date": "2026-08-06", "count": 0 }, { "date": "2026-08-07", "count": 0 }, { "date": "2026-08-08", "count": 0 }, { "date": "2026-08-09", "count": 0 }, { "date": "2026-08-10", "count": 0 }, { "date": "2026-08-11", "count": 0 }, { "date": "2026-08-12", "count": 0 }, { "date": "2026-08-13", "count": 0 }, { "date": "2026-08-14", "count": 0 }, { "date": "2026-08-15", "count": 0 }, { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 1 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 1 }, { "date": "2026-08-25", "count": 1 }, { "date": "2026-08-26", "count": 2 }, { "date": "2026-08-27", "count": 1 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 2 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 3 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 1 }, { "date": "2026-09-06", "count": 2 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 3 }, { "date": "2026-09-10", "count": 3 }, { "date": "2026-09-11", "count": 2 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "saml:Perplexity Enterprise" ], "lastAt": "2026-09-11T10:51:00.000Z", "scopes": [], "firstAt": "2026-08-20T10:05:00.000Z", "appNames": [ "Perplexity Enterprise" ], "provider": "fixture-google", "ssoEvents": 22, "windowDays": 90, "activeUsers": 5, "oauthGrants": 0, "assignedUsers": 0, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Google Workspace (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mde:perplexity", "mail:perplexity", "dlp:perplexity" ], "status": "open", "lastRunId": "T5zPkxmiHtOXOOvbGYk9v", "createdAt": "2026-09-14T01:46:17.843Z", "updatedAt": "2026-09-14T01:46:17.533Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mdca:48822", "lane": "m365.cloud_app_discovery", "appKey": null, "appId": null, "appDisplayName": "Chatsonic", "vendor": null, "category": "assistant", "confidence": "suspected", "matchReasons": [ "Defender category 'generativeAi'" ], "sanctioned": null, "riskScore": 28, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "pat@contoso.com", "upn": "pat@contoso.com", "source": "network", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "network_discovery", "detail": { "domains": [ "writesonic.com" ], "category": "generativeAi", "mdcaAppId": "48822", "riskScore": 4, "ipAddresses": 1, "downloadBytes": 3145728 }, "source": "graph:security/dataDiscovery/cloudAppDiscovery", "summary": "Seen on the network via Defender for Endpoint: 1 user, 44 transactions, 1 MB uploaded in 30 days", "observedAt": "2026-09-05T01:25:59.427Z" } ], "tags": [ "network", "no-entra-footprint", "low-defender-score" ], "recommendations": [ "Confirm whether Chatsonic is an AI service, then sanction, block, or ignore it.", "Chatsonic shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.", "Defender rates Chatsonic 4/10 on security, compliance, and legal criteria. Treat it as unsuitable for work data unless the vendor closes those gaps." ], "firstSeen": null, "lastSeen": "2026-09-05T01:25:59.427Z", "usage": null, "network": { "domains": [ "writesonic.com" ], "streams": [ "Defender for Endpoint" ], "mdcaTags": [ "Generative AI" ], "mdcaAppId": "48822", "userCount": 1, "lastSeenAt": "2026-09-05T01:25:59.427Z", "periodDays": 30, "uploadBytes": 1048576, "mdcaCategory": "generativeAi", "transactions": 44, "downloadBytes": 3145728, "mdcaRiskScore": 4, "ipAddressCount": 1 }, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "V3q69yhE6ynFkRBaAe9xg", "createdAt": "2026-09-14T01:25:59.696Z", "updatedAt": "2026-09-14T01:25:59.422Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": "5Cq_prHLB2FrmydTlcpt2", "findingKey": "vendor:5Cq_prHLB2FrmydTlcpt2:anthropic-claude", "lane": "vendor.admin_api", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "anthropic organization API" ], "sanctioned": true, "riskScore": 27, "severity": "medium", "userCount": 5, "orgWide": false, "users": [ { "id": "alice@contoso.com", "upn": "alice@contoso.com", "source": "vendor", "department": null, "displayName": "Alice Wu" }, { "id": "erin@contoso.com", "upn": "erin@contoso.com", "source": "vendor", "department": null, "displayName": "Erin Diaz" }, { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "vendor", "department": null, "displayName": "Grace Hopper" }, { "id": "mia@contoso.com", "upn": "mia@contoso.com", "source": "vendor", "department": null, "displayName": "Mia Chen" }, { "id": "oscar@contoso.com", "upn": "oscar@contoso.com", "source": "vendor", "department": null, "displayName": "Oscar Ruiz" } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "vendor_org", "detail": { "byModel": [ { "model": "claude-sonnet-4-5", "tokens": 108300000, "requests": 0 }, { "model": "claude-haiku-4-5", "tokens": 26700000, "requests": 0 } ], "settings": {}, "warnings": [] }, "source": "vendor:anthropic", "summary": "Anthropic (demo) (Contoso): 5 members, 1 admin, 2 workspaces, 3 API keys, 1,963 USD in 30 days", "observedAt": "2026-09-13T03:20:14.092Z" }, { "kind": "stale_key", "detail": { "ownerType": "user", "workspace": "ws_agents" }, "source": "vendor:anthropic", "summary": "API key 'agents-prod' (mia@contoso.com) never used", "observedAt": "2026-07-01T03:20:14.092Z" }, { "kind": "stale_key", "detail": { "ownerType": "user", "workspace": "ws_default" }, "source": "vendor:anthropic", "summary": "API key 'alice-dev' (alice@contoso.com) never used", "observedAt": "2026-04-27T03:20:14.092Z" }, { "kind": "stale_key", "detail": { "ownerType": "user", "workspace": "ws_default" }, "source": "vendor:anthropic", "summary": "API key 'old-eval' (grace@contoso.com) never used", "observedAt": "2026-03-08T03:20:14.092Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:34211" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:34211)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "dlp:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (dlp:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude)" }, { "kind": "corroboration", "detail": { "findingKey": "repo:giypXj7r_Gc5tatesErdR:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (repo:giypXj7r_Gc5tatesErdR:anthropic-claude)" } ], "tags": [ "vendor", "anthropic", "sanctioned-account", "stale-keys", "corroborated", "sanctioned" ], "recommendations": [ "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "3 API keys have not been used in 90 days or never at all. Revoke them; a key that is not used is only a liability." ], "firstSeen": "2026-02-26T03:20:14.092Z", "lastSeen": "2026-09-13T03:20:14.092Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": { "plan": null, "daily": [ { "date": "2026-08-16", "count": 500000 }, { "date": "2026-08-17", "count": 500000 }, { "date": "2026-08-18", "count": 500000 }, { "date": "2026-08-19", "count": 500000 }, { "date": "2026-08-20", "count": 500000 }, { "date": "2026-08-21", "count": 500000 }, { "date": "2026-08-22", "count": 500000 }, { "date": "2026-08-23", "count": 500000 }, { "date": "2026-08-24", "count": 500000 }, { "date": "2026-08-25", "count": 500000 }, { "date": "2026-08-26", "count": 500000 }, { "date": "2026-08-27", "count": 500000 }, { "date": "2026-08-28", "count": 500000 }, { "date": "2026-08-29", "count": 500000 }, { "date": "2026-08-30", "count": 500000 }, { "date": "2026-08-31", "count": 500000 }, { "date": "2026-09-01", "count": 500000 }, { "date": "2026-09-02", "count": 500000 }, { "date": "2026-09-03", "count": 500000 }, { "date": "2026-09-04", "count": 500000 }, { "date": "2026-09-05", "count": 500000 }, { "date": "2026-09-06", "count": 500000 }, { "date": "2026-09-07", "count": 500000 }, { "date": "2026-09-08", "count": 500000 }, { "date": "2026-09-09", "count": 500000 }, { "date": "2026-09-10", "count": 500000 }, { "date": "2026-09-11", "count": 500000 }, { "date": "2026-09-12", "count": 500000 }, { "date": "2026-09-13", "count": 500000 }, { "date": "2026-09-14", "count": 0 } ], "admins": 1, "lastAt": "2026-09-13T03:20:14.092Z", "apiKeys": 3, "byModel": [ { "model": "claude-sonnet-4-5", "tokens": 108300000, "requests": 0 }, { "model": "claude-haiku-4-5", "tokens": 26700000, "requests": 0 } ], "cost30d": 1962.6, "firstAt": "2026-02-26T03:20:14.092Z", "keyList": [ { "id": "ak_1", "name": "agents-prod", "owner": "mia@contoso.com", "stale": true, "status": "active", "createdAt": "2026-07-01T03:20:14.092Z", "ownerType": "user", "workspace": "agents-platform", "lastUsedAt": null }, { "id": "ak_2", "name": "alice-dev", "owner": "alice@contoso.com", "stale": true, "status": "active", "createdAt": "2026-04-27T03:20:14.092Z", "ownerType": "user", "workspace": "Default", "lastUsedAt": null }, { "id": "ak_3", "name": "old-eval", "owner": "grace@contoso.com", "stale": true, "status": "inactive", "createdAt": "2026-03-08T03:20:14.092Z", "ownerType": "user", "workspace": "Default", "lastUsedAt": null } ], "members": 5, "orgName": "Contoso", "currency": "USD", "provider": "anthropic", "settings": {}, "warnings": [], "adminKeys": 0, "staleKeys": 0, "costChange": 0.12366884232222561, "memberList": [ { "name": "Grace Hopper", "role": "admin", "email": "grace@contoso.com", "addedAt": "2026-02-26T03:20:14.092Z", "external": false, "lastActiveAt": "2026-09-13T03:20:14.092Z" }, { "name": "Mia Chen", "role": "developer", "email": "mia@contoso.com", "addedAt": "2026-03-18T03:20:14.092Z", "external": false, "lastActiveAt": "2026-09-13T03:20:14.092Z" }, { "name": "Alice Wu", "role": "developer", "email": "alice@contoso.com", "addedAt": "2026-04-17T03:20:14.092Z", "external": false, "lastActiveAt": "2026-09-12T03:20:14.092Z" }, { "name": "Erin Diaz", "role": "developer", "email": "erin@contoso.com", "addedAt": "2026-07-16T03:20:14.092Z", "external": false, "lastActiveAt": "2026-09-05T03:20:14.092Z" }, { "name": "Oscar Ruiz", "role": "user", "email": "oscar@contoso.com", "addedAt": "2026-08-15T03:20:14.092Z", "external": false, "lastActiveAt": null } ], "unusedKeys": 3, "windowDays": 30, "workspaces": [ { "id": "ws_default", "keys": 2, "name": "Default", "cost30d": 195, "members": 5, "archived": false, "requests30d": 0 }, { "id": "ws_agents", "keys": 1, "name": "agents-platform", "cost30d": 1767.6, "members": 3, "archived": false, "requests30d": 0 } ], "requests30d": 0, "costPrior30d": 1746.6, "activeUsers30d": 4, "connectionName": "Anthropic (demo)", "inputTokens30d": 120000000, "pendingMembers": 0, "externalMembers": 0, "inactiveMembers": 0, "outputTokens30d": 15000000, "serviceAccountKeys": 0 }, "relatedKeys": [ "mdca:34211", "mail:anthropic-claude", "dlp:anthropic-claude", "siem:P3xsUoa63aFWUE_YRNuUJ:anthropic-claude", "repo:giypXj7r_Gc5tatesErdR:anthropic-claude" ], "status": "open", "lastRunId": "1nLZofwmvstFdpiidq2kb", "createdAt": "2026-09-14T03:20:15.099Z", "updatedAt": "2026-09-14T03:20:14.092Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:aider", "lane": "code.repositories", "appKey": "aider", "appId": null, "appDisplayName": "Aider", "vendor": "Aider", "category": "coding", "confidence": "confirmed", "matchReasons": [ "config: Aider config" ], "sanctioned": null, "riskScore": 26, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/research-notebooks" ], "configs": [ { "path": "Aider config", "repos": 1 } ], "packages": [], "endpoints": [] }, "source": "repos:fixture", "summary": "Aider in 1 repository via GitHub (demo): Aider config", "observedAt": "2026-09-02T01:26:01.958Z" } ], "tags": [ "source-code", "fixture", "coding-assistant" ], "recommendations": [ "Aider is configured for this codebase. Set a policy on AI coding tools: which are approved, whether repository context may leave the company, and whether generated code needs review flags." ], "firstSeen": null, "lastSeen": "2026-09-02T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/research-notebooks", "name": "contoso/research-notebooks", "signals": [ "config" ], "pushedAt": "2026-09-02T01:26:01.958Z", "isPrivate": false } ], "alerts": 0, "configs": [ { "path": "Aider config", "repos": 1 } ], "secrets": 0, "signals": { "alert": 0, "config": 1, "secret": 0, "package": 0, "endpoint": 0, "model_file": 0 }, "packages": [], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-02T01:26:01.958Z", "modelFiles": 0, "publicRepos": 1, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.332Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": "giypXj7r_Gc5tatesErdR", "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "repo:giypXj7r_Gc5tatesErdR:azure-openai", "lane": "code.repositories", "appKey": "azure-openai", "appId": null, "appDisplayName": "Azure OpenAI", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "package: Azure.AI.OpenAI" ], "sanctioned": null, "riskScore": 26, "severity": "medium", "userCount": 0, "orgWide": false, "users": [], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "source_code", "detail": { "repos": [ "contoso/helpdesk-bot" ], "configs": [], "packages": [ { "name": "Azure.AI.OpenAI", "repos": 1, "ecosystem": "nuget" } ], "endpoints": [] }, "source": "repos:fixture", "summary": "Azure OpenAI in 1 repository via GitHub (demo): packages Azure.AI.OpenAI", "observedAt": "2026-09-08T01:26:01.958Z" }, { "kind": "corroboration", "detail": { "findingKey": "azure:/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourcegroups/rg-sandbox-dave/providers/microsoft.cognitiveservices/accounts/dave-openai-test" }, "source": "lantern:corroboration", "summary": "Also found by another lane (azure:/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourcegroups/rg-sandbox-dave/providers/microsoft.cognitiveservices/accounts/dave-openai-test)" }, { "kind": "corroboration", "detail": { "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.cognitiveservices/accounts/aoai-prod-eastus" }, "source": "lantern:corroboration", "summary": "Also found by another lane (azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.cognitiveservices/accounts/aoai-prod-eastus)" }, { "kind": "corroboration", "detail": { "findingKey": "pp:shared_azureopenai" }, "source": "lantern:corroboration", "summary": "Also found by another lane (pp:shared_azureopenai)" } ], "tags": [ "source-code", "fixture", "corroborated" ], "recommendations": [ "Azure OpenAI SDKs appear in 1 repository. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally." ], "firstSeen": null, "lastSeen": "2026-09-08T01:26:01.958Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": { "repos": [ { "url": "https://github.com/contoso/helpdesk-bot", "name": "contoso/helpdesk-bot", "signals": [ "package" ], "pushedAt": "2026-09-08T01:26:01.958Z", "isPrivate": true } ], "alerts": 0, "configs": [], "secrets": 0, "signals": { "alert": 0, "config": 0, "secret": 0, "package": 1, "endpoint": 0, "model_file": 0 }, "packages": [ { "name": "Azure.AI.OpenAI", "repos": 1, "ecosystem": "nuget" } ], "provider": "fixture", "endpoints": [], "lastPushAt": "2026-09-08T01:26:01.958Z", "modelFiles": 0, "publicRepos": 0, "connectionName": "GitHub (demo)" }, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "azure:/subscriptions/5c2e1f4a-2222-4a5b-9c8d-000000000002/resourcegroups/rg-sandbox-dave/providers/microsoft.cognitiveservices/accounts/dave-openai-test", "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.cognitiveservices/accounts/aoai-prod-eastus", "pp:shared_azureopenai" ], "status": "open", "lastRunId": "05yIlAg7Nl0GgYwgHfXxZ", "createdAt": "2026-09-14T01:26:02.346Z", "updatedAt": "2026-09-14T01:26:01.958Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "pp:shared_aibuilder", "lane": "cloud.ai_platforms", "appKey": "power-ai-builder", "appId": null, "appDisplayName": "AI Builder via Power Platform", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "connector shared_aibuilder" ], "sanctioned": null, "riskScore": 25, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "grace@contoso.com", "upn": "grace@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "connector_usage", "detail": { "thirdParty": false, "connectorId": "shared_aibuilder", "environments": [ { "name": "Contoso Prod", "type": "Production", "connections": 1 } ] }, "source": "powerplatform:admin", "summary": "AI Builder connector: 1 connection by 1 maker across Contoso Prod", "observedAt": "2026-06-16T01:26:01.384Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0103" }, "source": "powerplatform:admin", "summary": "Connection 'AI Builder' created by grace@contoso.com", "observedAt": "2026-06-16T01:26:01.384Z" } ], "tags": [ "power-platform" ], "recommendations": [ "AI Builder keeps data inside Microsoft, so the question is governance: confirm the 1 maker are expected and the flows are owned by a team, not an individual." ], "firstSeen": "2026-06-16T01:26:01.384Z", "lastSeen": "2026-06-16T01:26:01.384Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": { "lastAt": "2026-06-16T01:26:01.384Z", "firstAt": "2026-06-16T01:26:01.384Z", "creators": 1, "thirdParty": false, "connections": 1, "connectorId": "shared_aibuilder", "environments": [ { "name": "Contoso Prod", "type": "Production", "connections": 1 } ], "connectorName": "AI Builder", "defaultEnvironment": false }, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.571Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "azure:/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourcegroups/rg-ai-prod/providers/microsoft.machinelearningservices/workspaces/hub-contoso-ai", "lane": "cloud.ai_platforms", "appKey": "azure-ai-foundry", "appId": null, "appDisplayName": "Azure AI Foundry: hub-contoso-ai", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "resource type microsoft.machinelearningservices/workspaces (Hub)" ], "sanctioned": null, "riskScore": 25, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "azure_resource", "detail": { "kind": "Hub", "tags": { "owner": "frank@contoso.com" }, "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.MachineLearningServices/workspaces/hub-contoso-ai", "deployments": [], "localAuthDisabled": null, "publicNetworkAccess": false }, "source": "azure:resourceGraph", "summary": "Azure AI Foundry resource 'hub-contoso-ai' in rg-ai-prod (eastus), subscription 5c2e1f4a: 0 deployments" } ], "tags": [ "azure", "first-party" ], "recommendations": [ "'Azure AI Foundry: hub-contoso-ai' looks well configured. Keep it in the AI inventory with its owner and review deployments quarterly." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": { "kind": "Hub", "tags": { "owner": "frank@contoso.com" }, "owner": "frank@contoso.com", "location": "eastus", "provider": "azure", "resourceId": "/subscriptions/5c2e1f4a-1111-4a5b-9c8d-000000000001/resourceGroups/rg-ai-prod/providers/Microsoft.MachineLearningServices/workspaces/hub-contoso-ai", "deployments": [], "resourceType": "microsoft.machinelearningservices/workspaces", "resourceGroup": "rg-ai-prod", "subscriptionId": "5c2e1f4a-1111-4a5b-9c8d-000000000001", "managedIdentity": true, "localAuthDisabled": null, "publicNetworkAccess": false }, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.558Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "pp:shared_cognitiveservicestextanalytics", "lane": "cloud.ai_platforms", "appKey": "azure-ai-services", "appId": null, "appDisplayName": "Azure AI Services via Power Platform", "vendor": "Microsoft", "category": "cloud_ai", "confidence": "confirmed", "matchReasons": [ "connector shared_cognitiveservicestextanalytics" ], "sanctioned": null, "riskScore": 25, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "liam@contoso.com", "upn": "liam@contoso.com", "source": "platform", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "connector_usage", "detail": { "thirdParty": false, "connectorId": "shared_cognitiveservicestextanalytics", "environments": [ { "name": "Contoso Dev", "type": "Sandbox", "connections": 1 } ] }, "source": "powerplatform:admin", "summary": "Azure AI Language connector: 1 connection by 1 maker across Contoso Dev", "observedAt": "2026-08-15T01:26:01.408Z" }, { "kind": "connection", "detail": { "status": "Connected", "connectionId": "con-0201" }, "source": "powerplatform:admin", "summary": "Connection 'Azure AI Language' created by liam@contoso.com", "observedAt": "2026-08-15T01:26:01.408Z" } ], "tags": [ "power-platform" ], "recommendations": [ "Azure AI Language keeps data inside Microsoft, so the question is governance: confirm the 1 maker are expected and the flows are owned by a team, not an individual." ], "firstSeen": "2026-08-15T01:26:01.408Z", "lastSeen": "2026-08-15T01:26:01.408Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": { "lastAt": "2026-08-15T01:26:01.408Z", "firstAt": "2026-08-15T01:26:01.408Z", "creators": 1, "thirdParty": false, "connections": 1, "connectorId": "shared_cognitiveservicestextanalytics", "environments": [ { "name": "Contoso Dev", "type": "Sandbox", "connections": 1 } ], "connectorName": "Azure AI Language", "defaultEnvironment": false }, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5TePcPF6Ly5TxGl4qmhTU", "createdAt": "2026-09-14T01:26:01.586Z", "updatedAt": "2026-09-14T01:26:01.287Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "dlp:anthropic-claude", "lane": "m365.purview_dlp", "appKey": "anthropic-claude", "appId": null, "appDisplayName": "Claude: sensitive data", "vendor": "Anthropic", "category": "assistant", "confidence": "confirmed", "matchReasons": [ "DLP target claude.ai" ], "sanctioned": null, "riskScore": 25, "severity": "medium", "userCount": 1, "orgWide": false, "users": [ { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "audit", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "dlp_activity", "detail": { "domains": [ { "count": 2, "domain": "claude.ai" } ], "byAction": { "warn": 0, "audit": 0, "block": 2, "unknown": 0, "override": 0 }, "policies": [ { "name": "Endpoint DLP - Confidential", "count": 2 } ], "applications": [ { "count": 2, "application": "chrome.exe" } ], "sensitiveTypes": [ { "name": "Email Address", "count": 1, "matches": 25 }, { "name": "All Full Names", "count": 1, "matches": 8 } ] }, "source": "graph:security/auditLog", "summary": "2 DLP events for Claude by 1 person in 30 days: 2 blocked, 0 warned, 0 overridden, 0 audit only; types: Email Address, All Full Names", "observedAt": "2026-09-06T10:28:00.000Z" }, { "kind": "dlp_block", "detail": { "policies": [ "Endpoint DLP - Confidential" ], "recordId": "ual-0105", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "FileUploadedToCloud 'board-deck-draft.pptx' to claude.ai by carol@contoso.com: All Full Names ×8 (block)", "observedAt": "2026-08-30T13:45:00.000Z" }, { "kind": "dlp_block", "detail": { "policies": [ "Endpoint DLP - Confidential" ], "recordId": "ual-0106", "application": "chrome.exe" }, "source": "graph:security/auditLog", "summary": "TextPastedToBrowser to claude.ai by carol@contoso.com: Email Address ×25 (block)", "observedAt": "2026-09-06T10:28:00.000Z" }, { "kind": "corroboration", "detail": { "findingKey": "mdca:34211" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mdca:34211)" }, { "kind": "corroboration", "detail": { "findingKey": "mail:anthropic-claude" }, "source": "lantern:corroboration", "summary": "Also found by another lane (mail:anthropic-claude)" } ], "tags": [ "dlp", "dlp-blocked", "corroborated" ], "recommendations": [ "Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.", "Every match was blocked. The control is working; keep the policy and use these events to target awareness at the 1 person involved." ], "firstSeen": "2026-08-30T13:45:00.000Z", "lastSeen": "2026-09-06T10:28:00.000Z", "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 1 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 1 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "files": 1, "users": 1, "events": 2, "lastAt": "2026-09-06T10:28:00.000Z", "domains": [ { "count": 2, "domain": "claude.ai" } ], "firstAt": "2026-08-30T13:45:00.000Z", "byAction": { "warn": 0, "audit": 0, "block": 2, "unknown": 0, "override": 0 }, "policies": [ { "name": "Endpoint DLP - Confidential", "count": 2 } ], "windowDays": 30, "byOperation": [ { "count": 1, "operation": "FileUploadedToCloud" }, { "count": 1, "operation": "TextPastedToBrowser" } ], "applications": [ { "count": 2, "application": "chrome.exe" } ], "sensitiveTypes": [ { "name": "Email Address", "count": 1, "matches": 25 }, { "name": "All Full Names", "count": 1, "matches": 8 } ] }, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [ "mdca:34211", "mail:anthropic-claude" ], "status": "open", "lastRunId": "BpsZ3fgKQDtSx3lcAK65a", "createdAt": "2026-09-14T01:26:01.703Z", "updatedAt": "2026-09-14T01:26:01.627Z" }, { "repoConnectionId": null, "idpConnectionId": null, "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "mde:huggingface", "lane": "m365.advanced_hunting", "appKey": "huggingface", "appId": null, "appDisplayName": "Hugging Face", "vendor": "Hugging Face", "category": "model_hub", "confidence": "likely", "matchReasons": [ "network: huggingface.co" ], "sanctioned": null, "riskScore": 20, "severity": "low", "userCount": 1, "orgWide": false, "users": [ { "id": "frank@contoso.com", "upn": "frank@contoso.com", "source": "endpoint", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "endpoint_telemetry", "detail": { "domains": [ { "host": "huggingface.co", "count": 1 } ], "signals": { "network": 1, "process": 0, "software": 0, "extension": 0, "model_file": 0, "local_server": 0 }, "software": [], "processes": [], "extensions": [], "deviceNames": [ "LT-FRANK" ] }, "source": "graph:security/runHuntingQuery", "summary": "Defender for Endpoint saw Hugging Face on 1 device (1 account) in 30 days: device connections to huggingface.co", "observedAt": "2026-09-08T01:25:58.721Z" } ], "tags": [ "endpoint" ], "recommendations": [ "Device telemetry names the exact machines and accounts reaching huggingface.co. Use it to target coaching rather than blanket blocks.", "Hugging Face was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps." ], "firstSeen": "2026-09-08T01:25:58.721Z", "lastSeen": "2026-09-08T01:25:58.721Z", "usage": null, "network": null, "endpoint": { "devices": 1, "domains": [ { "host": "huggingface.co", "count": 1 } ], "signals": { "network": 1, "process": 0, "software": 0, "extension": 0, "model_file": 0, "local_server": 0 }, "accounts": 1, "lastSeen": "2026-09-08T01:25:58.721Z", "software": [], "firstSeen": "2026-09-08T01:25:58.721Z", "processes": [], "extensions": [], "modelFiles": { "bytes": 0, "count": 0 }, "windowDays": 30, "deviceNames": [ "LT-FRANK" ] }, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": null, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "5luT0wIbFWDcCIB7Sno32", "createdAt": "2026-09-14T01:26:00.090Z", "updatedAt": "2026-09-14T01:25:59.746Z" }, { "repoConnectionId": null, "idpConnectionId": "9BKV_xBnZf5pDRMXOQ1jy", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:jasper", "lane": "identity.provider", "appKey": "jasper", "appId": null, "appDisplayName": "Jasper", "vendor": "Jasper AI", "category": "writing", "confidence": "likely", "matchReasons": [ "app name matches /^jasper\\b/" ], "sanctioned": null, "riskScore": 20, "severity": "low", "userCount": 2, "orgWide": false, "users": [ { "id": "carol@contoso.com", "upn": "carol@contoso.com", "source": "idp", "department": null, "displayName": null }, { "id": "dave@contoso.com", "upn": "dave@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "0oa4jasper" ], "scopes": [], "revoked": 0, "assignedUsers": 2 }, "source": "idp:fixture-okta", "summary": "Okta (demo): Jasper, 2 assigned in 30 days", "observedAt": null } ], "tags": [ "identity", "okta", "admin-managed", "dormant" ], "recommendations": [ "Jasper is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.", "Nobody signed into Jasper through Okta in 30 days. Unassign or revoke to reduce standing access." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "0oa4jasper" ], "lastAt": null, "scopes": [], "firstAt": null, "appNames": [ "Jasper" ], "provider": "fixture-okta", "ssoEvents": 0, "windowDays": 30, "activeUsers": 0, "oauthGrants": 0, "assignedUsers": 2, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Okta (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "TGX1hqy79lxOJaLlZW_nz", "createdAt": "2026-09-14T01:46:17.467Z", "updatedAt": "2026-09-14T01:46:16.817Z" }, { "repoConnectionId": null, "idpConnectionId": "9BKV_xBnZf5pDRMXOQ1jy", "awsConnectionId": null, "gcpConnectionId": null, "vendorConnectionId": null, "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:meetingmind-ai-notetaker", "lane": "identity.provider", "appKey": null, "appId": null, "appDisplayName": "MeetingMind AI Notetaker", "vendor": null, "category": null, "confidence": "suspected", "matchReasons": [ "name keyword /\\bai\\b/" ], "sanctioned": null, "riskScore": 8, "severity": "low", "userCount": 1, "orgWide": false, "users": [ { "id": "bob@contoso.com", "upn": "bob@contoso.com", "source": "idp", "department": null, "displayName": null } ], "permissions": [], "permissionTier": "unknown", "dataClasses": [], "grants": [], "evidence": [ { "kind": "idp_app", "detail": { "appIds": [ "0oa6notetaker" ], "scopes": [], "revoked": 0, "assignedUsers": 1 }, "source": "idp:fixture-okta", "summary": "Okta (demo): MeetingMind AI Notetaker, 1 assigned in 30 days", "observedAt": null } ], "tags": [ "identity", "okta", "admin-managed", "dormant" ], "recommendations": [ "Confirm whether MeetingMind AI Notetaker is an AI service, then sanction, block, or ignore it.", "MeetingMind AI Notetaker is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.", "Nobody signed into MeetingMind AI Notetaker through Okta in 30 days. Unassign or revoke to reduce standing access." ], "firstSeen": null, "lastSeen": null, "usage": null, "network": null, "endpoint": null, "audit": null, "mail": null, "cloud": null, "platform": null, "dlp": null, "siem": null, "code": null, "identity": { "daily": [ { "date": "2026-08-16", "count": 0 }, { "date": "2026-08-17", "count": 0 }, { "date": "2026-08-18", "count": 0 }, { "date": "2026-08-19", "count": 0 }, { "date": "2026-08-20", "count": 0 }, { "date": "2026-08-21", "count": 0 }, { "date": "2026-08-22", "count": 0 }, { "date": "2026-08-23", "count": 0 }, { "date": "2026-08-24", "count": 0 }, { "date": "2026-08-25", "count": 0 }, { "date": "2026-08-26", "count": 0 }, { "date": "2026-08-27", "count": 0 }, { "date": "2026-08-28", "count": 0 }, { "date": "2026-08-29", "count": 0 }, { "date": "2026-08-30", "count": 0 }, { "date": "2026-08-31", "count": 0 }, { "date": "2026-09-01", "count": 0 }, { "date": "2026-09-02", "count": 0 }, { "date": "2026-09-03", "count": 0 }, { "date": "2026-09-04", "count": 0 }, { "date": "2026-09-05", "count": 0 }, { "date": "2026-09-06", "count": 0 }, { "date": "2026-09-07", "count": 0 }, { "date": "2026-09-08", "count": 0 }, { "date": "2026-09-09", "count": 0 }, { "date": "2026-09-10", "count": 0 }, { "date": "2026-09-11", "count": 0 }, { "date": "2026-09-12", "count": 0 }, { "date": "2026-09-13", "count": 0 }, { "date": "2026-09-14", "count": 0 } ], "appIds": [ "0oa6notetaker" ], "lastAt": null, "scopes": [], "firstAt": null, "appNames": [ "MeetingMind AI Notetaker" ], "provider": "fixture-okta", "ssoEvents": 0, "windowDays": 30, "activeUsers": 0, "oauthGrants": 0, "assignedUsers": 1, "revokedGrants": 0, "adminInstalled": true, "connectionName": "Okta (demo)" }, "aws": null, "gcp": null, "vendorOrg": null, "relatedKeys": [], "status": "open", "lastRunId": "TGX1hqy79lxOJaLlZW_nz", "createdAt": "2026-09-14T01:46:17.484Z", "updatedAt": "2026-09-14T01:46:16.817Z" } ] }