# Draft playbook — INC-2026-0901

*This is a draft assembled from stored records. Nothing in it has been adopted, approved or signed off by anyone. Adoption is a registered action that goes through policy evaluation and leaves its own audit record; if this document were adopted, that record — not this file — would be the evidence of it.*

- **Incident:** `INC-2026-0901`
- **Document:** playbook (draft)
- **Generated:** 2026-10-30T06:01:32.523701+00:00
- **Source:** https://265d0hsmwa.execute-api.us-east-1.amazonaws.com/api/v1/incidents/INC-2026-0901/draft/playbook/export

## What this was *(draft)*

- Credential stuffing against the SSO portal succeeded on one account: 412 failures from a single new ASN, then one success. (confidence 0.94)
  - *evidence:* `INC-2026-0901#hypothesis-0`, `SEC-0001-a`, `SEC-0001-b`, `SEC-0001-c`

## How it unfolded *(draft)*

- network_flow:203.0.113.22->sso-portal:443 — 412 sign-in failures from one new ASN in 6 minutes
  - *evidence:* `INC-2026-0901#chain-0`, `SEC-0001-a`
- account:j.rivera — failures → one success on the same account
  - *evidence:* `INC-2026-0901#chain-1`, `SEC-0001-b`, `SEC-0001-c`
- asset:sso-portal — session issued to an unrecognised device
  - *evidence:* `INC-2026-0901#chain-2`, `SEC-0001-d`

## What to do *(draft)*

- 1. revoke_session — rollback: reissue_session; authorisation: not scored for this incident yet
  - *evidence:* `INC-2026-0901#plan-1`
- 2. require_mfa_reauth — rollback: clear_mfa_requirement; authorisation: not scored for this incident yet
  - *evidence:* `INC-2026-0901#plan-2`

## How to tell it worked *(draft)*

- session should read invalid after step 1
  - *evidence:* `INC-2026-0901#plan-1`
- session should read re-verified after step 2
  - *evidence:* `INC-2026-0901#plan-2`

## Provenance

Every assertion above cites the records it rests on; 10 distinct reference(s) in total.

Audit records for this incident, against which the above can be reconstructed:

- `2026-10-19T00:23:18.416941+00:00 · policy_evaluation · dharma — awaiting approval — revoke_session scores 25 → approval tier`
- `2026-10-19T00:23:18.416922+00:00 · observation · agent:analyst — diagnosed — impossible travel rules out the travelling-user reading`
- `2026-10-19T00:23:18.416872+00:00 · observation · agent:sentinel — correlated — 412 failures and one success on one account within 11 minutes`
- `2026-10-18T23:59:18.416639+00:00 · observation · drishti — new session issued to j.rivera from an unrecognised device`
- `2026-10-18T23:58:18.416639+00:00 · observation · drishti — sign-in from Lagos 4 minutes after a sign-in from Charlotte`
- `2026-10-18T23:54:58.416639+00:00 · hypothesis · buddhi — The user is travelling and signed in from a new location. (3%) · ruled out by SEC-0001-c, SEC-0001-a`
- `2026-10-18T23:54:58.416639+00:00 · hypothesis · buddhi — Credential stuffing against the SSO portal succeeded on one account: 412 failures from a single new ASN, then one success. (94%)`
- `2026-10-18T23:54:18.416639+00:00 · observation · drishti — successful sign-in for j.rivera from the same address`
- `2026-10-18T23:48:18.416639+00:00 · observation · drishti — 412 failed sign-ins from AS204428, an ASN never seen before`

*Exported documents do not update. An incident can reopen, a verification can land and an execution can be rolled back after this was written, and nothing on this page would show it. Check the references against the source before relying on it.*

*Adopting this would require the registered action `adopt_playbook`, which is scored and routed through policy evaluation like any other action. This file is not that.*