Use case 6 – man-in-the-middle attack

This raw use case log surfaced in the SOC:

=========================================================================
- Incident ID: 20231118-0912-04
- Timestamp: 2023-11-18T09:12:00Z
- Incident Type: Man-In-The-Middle (MITM) Attack
- Source System: Network Monitoring Tool
- Affected User: [e-mail]
- Affected Device: SARAHJ-LAPTOP
- Affected IP: 10.50.30.20
- Incident Details:
  - Alert Description: Suspicious SSL/TLS Certificate Detected
  - Detected Anomaly: SSL Certificate Mismatch
  - Affected Application: Web Browser (Chrome)
  - Destination URL: https://secure.companybank.com
  - Detection: Anomalous SSL certificate presented during a banking transaction
- Initial Detection System: SSL Inspection Tool
- Additional Information:
  - Suspicious Certificate Details: Issued by "Unknown CA", Serial No. 1234567890ABCDEF
  - Network Traffic...