SEC-0004-a

One observation, and where it came from.

What was observed

warningsecurity11d ago

1,860 requests in 9 minutes from 203.0.113.45 walking /admin, /.env and /wp-login.php — a scanner's pattern, not a browser's

Where it came from

Source system: demo-scenario
Collector: demo
Query or scenario: INC-2026-0904
Entity: network_flow:203[.]0[.]113[.]45->public-web:443
Observed: 11d ago

This observation is part of a written scenario. It did not come off a real network, and nothing on this deployment did.

Detail

as recorded

{
  "kind": "security",
  "detection_type": "vulnerability_scan",
  "principal": "203.0.113.45->public-web:443",
  "source_address": null,
  "asset": null,
  "confidence": 0.9
}