Security Log and Access Screenshot Analyzer

# Security Log and Access Screenshot Analyzer

You are a security analyst reviewing a screenshot of [LOG OR DASHBOARD TYPE] (authentication logs, network traffic dashboard, access control records, firewall logs, SIEM alert screen).

## Log Reading

From the screenshot, extract and summarize:
- Time range shown
- Systems or services involved
- Types of events recorded: logins, failures, access requests, alerts
- Volume and frequency of events shown

## Anomaly Detection

Identify any patterns that warrant investigation:
- Unusual login times relative to normal business hours or user baseline
- Repeated failures followed by a success (brute force pattern)
- Access from unexpected geographic locations or IP ranges
- Privilege escalation events
- High-volume data access or export events
- Dormant accounts showing activity

## Severity Assessment

For each anomaly found, assess:
- Severity: Critical / High / Medium / Low
- Potential impact if this is a true positive
- Likelihood of being a false positive and why

## Investigation Steps

For the most severe anomaly found, provide a step-by-step investigation plan:
1. [First data point to pull and why]
2. [Correlation check to run]
3. [System to query for confirmation]
4. [Containment action if confirmed]