Queues / Unassigned

Unassigned queue

6 tickets · 2 open, same workstation, filed minutes apart

NCERT-1187 and NCERT-1188 both landed from MFA-WKS-0417 within the same window. Neither artifact below has been opened or executed for real. Work out whether the two are connected before you close either one.

NCERT-1187 Medium Email with no subject line, attachment reported by user Front desk, Regional Affairs 08:14 Open

Requester
Front desk, MFA Regional Affairs desk

Workstation
MFA-WKS-0417

Received
08:14 local

Queue
Unassigned

A staffer forwarded an email with no subject line and minimal body text, carrying a single attachment. Nothing has been opened for real: the file was pulled from the mail queue for review before the user was told whether it was safe.

Regional_Assessment.doc 3.4 KB · Word 97-2003 document
Download

Static analysis only. Do not open this in a real copy of Word.
NCERT-1188 High Anomalous DNS TXT query volume, network monitoring DNS sinkhole monitor 08:29 Open

Requester
DNS sinkhole monitor (automated)

Workstation
MFA-WKS-0417

Received
08:29 local · ~15 min after NCERT-1187

Queue
Unassigned

Network monitoring flagged an unusual spike in DNS TXT-record queries from the same workstation as the ticket above. A capture from that window is attached below.

capture.pcap 1.3 KB · Packet capture
Download
NCERT-1186 Medium Failed login spike, VPN concentrator VPN gateway logs 2d ago Resolved

Automatic lockout policy triggered on 6 accounts after repeated failed logins from a single external range. Lockout behaved as configured; no further action needed.

Resolved by duty analyst · expected behavior, policy working as intended.
NCERT-1185 Medium USB mass storage device flagged by DLP policy Endpoint DLP agent 4d ago Resolved

Front desk workstation flagged for an unregistered USB storage device. Device confirmed as an authorized backup drive belonging to facilities staff.

Resolved by duty analyst · exception granted, asset tagged.
NCERT-1184 Low TLS certificate renewal reminder, mail relay Cert monitor 6d ago Closed

Routine reminder that the mail relay's TLS certificate renews in 30 days. Informational, no action required from this queue.

Closed · forwarded to infrastructure on-call.
NCERT-1183 Low Phishing report: newsletter unsubscribe link Front desk, Regional Affairs 6d ago Closed

Staffer reported a newsletter's unsubscribe link as suspicious. Link resolves to the sender's own mailing platform; confirmed benign.

Closed · false positive, sender allow-listed.