Related alerts grouped into incidents, each with a verdict, response steps, and lessons learned.
Recon followed by an LSASS memory access on WORKSTATION-01. Sample data for the demo.