4

Forensics

SL-05

Immutable identity activity, assembled across modules into a single investigation timeline. Access Assurance saw the authentication, Database Activity Monitoring saw the query, Discovery knew what the query touched — a forensic account needs all three.

DischargesR.6S.28
Identities with activity
68
Log retention
400days

Rule 6(1)(g)

Archive retention
7years
Investigations open
17
Investigate an identity

Enter an identity name to assemble its cross-module timeline.

svc_scheme_sync

svc_scheme_sync@aiventuretech.io

CriticalIT & Digital InfrastructureNo MFASuspended
Risk score
97
PD sources
6
Anomalies 30d
3
Last active
yesterday
Resolved owner
Vikram Saxena
Directory
active directory
Evidence integrity
c462bdd0a1575000
Open the full audit trail
Investigation timeline

Correlated across Access Assurance and Database Activity Monitoring, newest first.

  1. Sudden volume of personal data accessedyesterday

    Volume of personal-data rows read exceeded the identity's 99th-percentile baseline by 41×, sustained over 93 minutes.

    05 Aug 2026, 22:06Access Assurance
    AAN-2026-0913Session terminated
  2. Database: mass selectyesterday

    148,200 rows returned across two classified tables in 93 minutes, against a nightly baseline of roughly 3,600. Classification confirmed the columns include government identifier references and bank account numbers, raising severity to critical.

    05 Aug 2026, 21:54Database Activity Monitoring
    DAM-2026-1204familyid-prod-011,48,200 rows
  3. Access from an unusual location2 days ago

    Service account authenticated from a source host that has never appeared in its 90-day baseline, at 02:14 IST — outside its scheduled window entirely.

    05 Aug 2026, 21:36Access Assurance
    AAN-2026-0912Account suspended
  4. Database: off hours access7 days ago

    Activity deviates from the established policy threshold and baseline for this object.

    31 Jul 2026, 09:30Database Activity Monitoring
    DAM-2026-1183vitals-pg2,738 rows
  5. Database: export anomaly12 days ago

    Activity deviates from the established policy threshold and baseline for this object.

    26 Jul 2026, 09:30Database Activity Monitoring
    DAM-2026-1162vitals-pg44,720 rows
  6. Database: audit tampering13 days ago

    An attempt was made to disable auditing on a classified object. Separation of duties prevented the change; evidence preserved.

    25 Jul 2026, 09:30Database Activity Monitoring
    DAM-2026-1193familyid-prod-0133,082 rows
  7. Database: audit tampering18 days ago

    An attempt was made to disable auditing on a classified object. Separation of duties prevented the change; evidence preserved.

    20 Jul 2026, 09:30Database Activity Monitoring
    DAM-2026-1185scholarship-pg29,886 rows

What a regulator would ask for

Immutable activity logs
Append-only, hash-chained, with administrative segregation.
Clear investigation timelines
Who did what, when, and what the platform did about it.
Proof of enforcement
That the control existed and acted, not merely that it was configured.
Regulator-ready packaging
Exportable evidence with the chain intact.
Evidences:R.6S.28S.8(4)