SEC-0005-a

fin-034 fetched build 7.4.11 from the vendor update endpoint at 192.0.2.30 — signed, on schedule, and indistinguishable from every other Tuesday

Source system

demo-scenario

Collector

demo

Query or scenario

INC-2026-0905

Entity

network_flow:192[.]0[.]2[.]30->fin-034:443

Observed

11d ago

◆ This observation is part of a written scenario. It did not come off a real network, and nothing on this deployment did.

{
  "kind": "security",
  "detection_type": "software_update_fetched",
  "principal": "192.0.2.30->fin-034:443",
  "source_address": null,
  "asset": null,
  "confidence": 0.99
}