A complete analyst workflow

Overview opens ready to score. Run assessment loads the 2500-identity baseline and scores it immediately. There is no separate scan and no waiting state. Run corrected scenario loads the same identities with deployment_user updated.

A rejected upload shows one error line. A file that loads does not leave a standing success message. The paragraph under Priority findings is the local rule summary. OpenAI is not called from Overview.

The sidebar is grouped. Review holds the working lists. Compare holds the scenario. Reference holds the rules and this guide.

1. On Overview, run the baseline, or choose Upload JSON.
2. Use a JSON array no larger than 2 MB. Each record needs a unique id, name, source, and type.
3. Active Directory checks read privileged and never. AWS checks read admin, keyActive, and keyAge for an active key.

A wrong type of value skips that row. A missing check stays Not assessed. Missing information is not a pass. The baseline holds 2500 synthetic identities across Active Directory and AWS IAM, including the curated seed accounts used in the walkthrough. The corrected file changes only AWS-001: administrative access is removed, and the active key age becomes 1 day.

Download baseline JSON in the header saves that 2500-identity sample so you can edit it and upload the copy.

Rule set v1.0 adds 60 points for privileged Active Directory membership, 25 for a password that never expires, 80 for an attached AdministratorAccess policy, and 20 for an active key older than 90 days. The total is capped at 100.

Zero is None: no supported rule triggered. That is not a clearance. These weights are a lab convention, not a probability of compromise. A disabled account keeps its score. An inferred type does not add points. The AdministratorAccess check matches the policy name. It does not establish effective permissions.

1. Start with the priority list. Filter by source, severity, or review status, and search by name or id.
2. Open the identity. The account panel, the score lines, and the review form are on one page.
3. Choose Generate explanation when you want the four sections: what deserves attention, a consequence stated as a hypothesis, suggested validation, and missing context.

The explanation is requested only after that click. It uses the pilot rules already on the page. If OpenAI does not return a usable explanation, the page shows the local rule summary instead. Regenerating asks again. The score does not change.

Save writes Alex Morgan, the time, the note, and any proposed action onto an activity list. Older entries stay on the finding. Notes survive a new dataset load because they are kept by identity id.

Comparison matches identities by id. On the baseline, one finding clears: deployment_user. The other findings stay the same. Running the corrected scenario from Overview or from Comparison replaces the working dataset. The earlier review on that identity remains.

A clean result in the corrected file is sample evidence. It does not close an Action Planned entry, and it does not confirm that a change was made outside this lab.

Export JSON on Risk findings and Identity inventory downloads the rows currently shown, using the same identity fields an upload expects. Filter first if you want a smaller file. The baseline download on this page is the original 2500-identity sample, independent of what is loaded.

Reviews live in this browser. There is no shared database and no server copy of your notes. Export the identities before you clear the browser if you need the records elsewhere.

1. 1
   Run assessment

   Load the baseline. Scoring finishes as the page updates. deployment_user is the highest finding, at 100 Critical.

2. 2
   Open the finding

   Two rules contribute: AdministratorAccess for 80 points, and an active key aged 120 days for 20. Read the policy-name limitation on the first line.

3. 3
   Generate the explanation

   Ask for the four sections. Treat the consequence as a hypothesis. The page will not claim an attack path.

4. 4
   Save Action Planned

   Write a note and a proposed action, then save. The new line appears above the older activity.

5. 5
   Open comparison

   Or run the corrected scenario. deployment_user clears. The other findings, and the review you just saved, stay.