Arctic Wolf Security Dashboard · Affordable Solar / Gridworks

Reporting period: 08 Jun – 13 Jul 2026 (5 weeks · W5 partial) · MOCKUP — data parsed from weekly AW reports

Weeks W1–W5 run Mon–Mon from Jun 8 (W5 partial). Select a domain tab below — charts marked ⊞ detail open row-level data on click. · Zip Extractor ↗

Coverage Score

95%

stable all 4 weeks

Observations (W4)

29.8 M

▼ 38% over 4 weeks — ask CST

Ticketed Incidents

1 in W1 · none since

Investigations

2 · 0 · 1 · 2 by week

Failed Logins (W4)

30.0 K

▼ 31% vs W3 peak

Identity Protection Alerts

10 · 0 · 4 · 1 — one guest acct

External Vulns (Jul)

2 Low

0 critical/high network vulns

⚠ Needs Attention

HIGHkirlos.mansour@gridworks.com — failed logins rising 4 straight weeks (466 → 1,282 → 2,457 → 3,269), attempts from Egypt, EDR incident W3, heavy anonymous-VPN use. Verify with user / reset credentials.
HIGHtesh@nexussolar.net (external guest) — source of all 15 Identity Protection alerts (anonymous IP + anomalous token) and #1 anonymous-VPN user every week. Investigate or formally accept.
MEDKevin Bassalleck's MacBook — fails Sophos prerequisites ("might not be protected") twice daily for 4 weeks. Unremediated; also recurring top login-failure user.
MEDTelnet (23) & SMB (445) internet-exposed on 138.199.112.180; david@affordable-solar.com plaintext password in Sep 2025 breach. Close ports; force reset.
MEDSophos DLP "auto-allowed" events climbing 65 → 18 → 215 → 374 — data leaving endpoints without blocking. Review DLP policy mode.

Service Health

Identity & Access

Endpoint

Data Movement

Network & Shadow IT

External Attack Surface

Observations Ingested Security Review — trending down 38%

Investigations vs Ticketed Incidents⊞ detail

Ticket Activity Appendix B, Security Review

Week	Ticket ID	Severity	Description	Status
W1	17498988	MED	Add member to role in PIM completed (permanent)	closed
W1	17458858	MED	Suspicious External Teams Chat Created	closed
W1	17448750	MED	Cloud Microsoft Mass Phishing Emails Delivered	closed
W1	17448867	MED	ScreenConnect Activity Detected	closed
W1	17445905	MED	File Malware Detected	closed
W2	17558673	—	Technical support assistance	pending → closed W3
W4	17629013	—	Quarterly Service Review Follow-up	pending

Full month: 8 tickets W1 (all closed), 4 W2, 4 W3, 1 W4 open.

M365 Logins — Success vs Failed

kirlos.mansour — Failed Logins Azure report, rising weekly

Top Login-Failure Users by Week

Week	User	Failures
W1	kevin.bassalleck	3,458
W2	brian.terrell	2,691
W3	brian.terrell	3,391
W4	kirlos.mansour	3,442

Persistent spray against shared mailboxes (info@, sales@, no-reply@) from Russia/China via legacy Authenticated SMTP — blocked; disable basic auth to eliminate.

Anonymous-VPN Activity⊞ detail CSV export — capped at 500 rows/week · W5 = Jul 6–13

User	W1	W2	W3	W4	W5
tesh@nexussolar.net (guest)	147	93	81	156	167
long.nguyen	105	22	101	65	61
karl.lukes	89	32	—	—	—
kirlos.mansour	—	48	106	47	92
jordan.fredrickson	66	—	28	—	15

W5 (Jul 6–13): only the anonymous_vpn CSV has arrived so far — other W5 report types pending from AW. tesh@nexussolar.net at its highest weekly count yet.

Identity Protection Alerts⊞ detail all attributable to tesh@nexussolar.net

Sophos Events by Priority⊞ detail

Sophos Rule-Type Trends DLP & runtime detections rising

EDR: Failed Logins & USB Events⊞ detail Sat–Sat weeks; 3 weeks available

Endpoint Watch List

Host / User	Signal
Kevin MBP 2023 (kevin.bassalleck)	Fails Sophos prerequisites 2×/day, 4 weeks — all high-sev rows
EMARTINS-W11PM	10× "Lockdown" exploit prevented in claude.exe (W4)
MMONTANO-W11PMAP2	8× Generic ML PUA detections (W1)
KMANSOUR-W11PM2	Top failed-login host W3 + high-sev incident
DRICE-W10PM3	USB spike: 22 events W3 (EDR)
ALEWIS-W11PM	Chronic "system time changed" events (noise, but chronic)
JCONNALLY-W11PM	Sophos ServiceNotRunning W2 & W4

Agent check-ins fell 35.9 M → 25.7 M (−28%). Russia (Moskva) check-ins present all 3 EDR weeks (5, 1, 1).

SharePoint Anonymous Links Created⊞ detail W4 spike

Sophos DLP Events (auto-allowed)⊞ partial unblocked data egress

Collaboration & Mailbox Changes

Metric	W1	W2	W3	W4
Exchange mailbox changes (mostly system)	87	48	42	51
Anonymous SharePoint links	15	11	15	29
Auth-group assignments	14	18	14	35
Group users removed	6	55	7	11
New e-mail forwarding rules	0	0	0	0
M365 DLP triggers	0	0	0	0

Generative-AI Traffic (log rows)⊞ detail declining; ~95% ChatGPT/OpenAI

Top AI Users rows/week; process shows how

User	W1	W2	W3	W4	Via
alejandro.ruiz	194	66	71	10	codex.exe / VS Code
justin.ramsey	recurring, browser				chrome
david.adams, dylan.fortney, travis.ross…	8–12 distinct users/week				browser

Tools seen: ChatGPT/OpenAI (dominant), Gemini (3 rows total). Zero DNS hits for Claude, Copilot, Perplexity, DeepSeek, Grok.

Network Traffic Snapshot Security Review W1

Top country: US — 84.9 GB / 657 K flows / 19 devices Top outbound: https 55.4 GB Inbound: tcp 21.9 GB Interesting countries: no data all month AD lockouts / admin-group adds: none all month

Vulnerabilities⊞ detail Jul 2026 scan

Dashboard "High 1 / Medium 1" are dark-web ATO findings; actual network vulns = 2 Low (ICMP timestamp disclosure).

Account Takeover Risks dark-web breaches

User	Risk	Detail
david@affordable-solar.com	HIGH 8	Sep 2025 breach — plaintext/decryptable password
jim.kacerguis	MED 4	Jun 2026 breach — no passwords exposed
nick.babic	MED 4
ryan.centerwall	MED 4
whitney.bushnell	MED 4

Exposed Services

Host	Exposure
138.199.112.180	18 open ports incl. telnet/23 & SMB/445
138.199.112.183	19 open ports
affordable-solar.com	11 public subdomains (vpn1/vpn2, ftp, dev…)
gridworks.com	11 public subdomains

Scan scope: 138.199.112.180/30, 50.188.162.57–61, affordable-solar.com, gridworks.com. Monthly cadence — next data point Aug 2026.