Monitor running; captures: 5; unchanged: 0; last events: 379; last result: changed
Deterministic local event view with normalized process, file, and network records.
partial: process and network evidence are correlated; file evidence is summarized
Counts
- Total normalized events: 379
- Process evidence: 247
- File evidence: 122
- Network evidence: 10
- Auxiliary evidence: 0
- Correlations: 1
Coverage Checks
- process evidence = present
- file evidence = present
- network evidence = present
- source provenance = present
- correlation = present
Selected Chain
- process observed
- file summarized
- network connect
Classification preview
process_network_activity
Local activity chain with review-worthy network behavior
This public version uses fixed placeholder records. It shows how the dashboard explains a selected chain without exposing production rules, host data, or private logic.
Why surfaced
Process, file, and network signals line up in a compact review story.
Confidence
Medium in the sample because the data is intentionally limited.
Next action
Review the static narrative and inspect the fixed Raw Events table.
Narrative
The sample run starts with a workstation process observation, groups a related file summary, and links that activity to a single outbound connection placeholder.
The dashboard turns those records into a readable investigation note so a reviewer can understand what changed, why it matters, and what to inspect next.
No live workstation data is read in this portfolio demo. Every row and summary is static.
Activity Graph
Process
File
Network
Report
Explainability
| Signal | Reason | Weight |
|---|
| Process | Sample process was selected as the root of the chain. | High |
| File | File evidence is summarized in the same review window. | Medium |
| Network | Connection metadata is grouped for reviewer context. | Medium |
Deterministic event table with fixed portfolio-safe sample rows.
Counts
- Total events: 379
- process_observed: 247
- file_observed: 122
- network_connect: 10
Sources
- local-file-observation: 122
- local-netstat-snapshot: 10
- local-process-snapshot: 247
Event Table
| # | Type | Timestamp | Process | Command Line | File Path | Network | Source |
|---|