User 'finance_admin' executed macro-enabled document from external sender.


Orphaned IAM role assumed from unknown IP; added AdministratorAccess to self.


Blind SQL injection pattern detected on /api/v1/search.


Container breakout detected; privileged mount accessed /var/run/secrets.