ARC Security Operations — Analyst Onboarding Brief
Anton Reyes Corporation · Internal · Revised 2026-07-01
This brief documents the ARC environment: what the business does, what the network looks like, and what routine activity looks like on it.
1. The business
Anton Reyes Corporation (ARC) is a privately held engineering and construction consultancy founded in 1998 by Anton Reyes, who remains chairman. ARC designs and supervises mid-rise commercial and infrastructure projects.
- Headcount: ~140 staff.
- Head office: roughly 110 staff.
- Project site offices: two, roughly 15 staff each, connected back to head office over site-to-site VPN.
- Crown jewels: project design files and CAD drawings, competitive bid documents, client contracts, payroll and personnel records.
- Downtime tolerance: very low. Bid deadlines are contractual, and a missed submission is a lost project.
Working hours and time
Office hours are 08:00–18:00 local time (UTC+8), Monday to Friday. Payroll is processed on the 15th and 30th of each month.
The SIEM displays all timestamps in UTC. Local time is UTC+8, so the ARC workday runs roughly 00:00–10:00 UTC. An event at 18:00 UTC occurred at 02:00 the following morning, local time.
Friday is company-wide work-from-home; VPN volume shifts accordingly.
2. Network and assets
Address space
| Range | Purpose |
|---|---|
10.10.10.0/24 | Servers |
10.10.20.0/24 | Head office workstations |
10.10.30.0/24 | Site offices over site-to-site VPN |
10.10.40.0/24 | Remote-access VPN client pool |
172.16.5.0/24 | DMZ |
Servers
| Host | Address | Role |
|---|---|---|
ARC-DC01 | 10.10.10.10 | Domain controller — AD DS, DNS, DHCP. Single DC; no secondary. |
ARC-FS01 | 10.10.10.20 | File server (shares below) |
ARC-SQL01 | 10.10.10.30 | SQL Server, backs the ERP |
ARC-APP01 | 10.10.10.31 | ERP / project management application |
ARC-BKP01 | 10.10.10.40 | Backup server. Domain-joined, holds all backup repositories. |
ARC-WSUS01 | 10.10.10.45 | WSUS patching and the internal vulnerability scanner |
ARC-PRINT01 | 10.10.10.50 | Print server |
ARC-WEB01 | 172.16.5.10 | Public website, antonreyes.com. DMZ. |
ARC-VPN01 | 172.16.5.5 | Remote-access VPN concentrator |
ARC-FW01 | — | Perimeter firewall |
Endpoints
Head-office desktops are ARC-WS-1xx, laptops are ARC-LT-2xx. Site-office machines follow the same pattern and are numbered in the same series. Asset assignment is tracked in the IT helpdesk system, not in the SIEM.
File shares on ARC-FS01
| Share | Access |
|---|---|
\\ARC-FS01\Projects | All staff. Live project files, drawings, bid documents. |
\\ARC-FS01\Finance | ARC-Finance group only |
\\ARC-FS01\HR | ARC-HR group only |
\\ARC-FS01\IT | Intended for the IT team. Scripts, build notes, software installers. |
\\ARC-FS01\Public | All staff. Templates, forms, company announcements. |
3. Identity
Naming conventions
- Staff accounts:
firstinitial.lastname— e.g.r.bautista,m.ocampo. - Administrative accounts: IT staff hold a second, separate account prefixed
adm.— e.g.adm.dvergara. Day-to-day work is expected to use the normal account; theadm.account is for administration only. - Service accounts: prefixed
svc-. These are non-human and should never perform interactive logons.
Security groups
ARC-IT-Admins, ARC-Finance, ARC-HR, ARC-Engineering, plus the built-in Domain Admins. Membership changes are rare and always ticketed.
Service accounts
These are the only service accounts provisioned in the domain.
| Account | Function | Runs from |
|---|---|---|
svc-backup | Nightly backup job, 22:00 local (14:00 UTC), connects to all servers | ARC-BKP01 only |
svc-sql | SQL Server service account | ARC-SQL01 only |
svc-erp | ERP application pool | ARC-APP01 only |
svc-scan | Weekly vulnerability scan, Sundays 02:00 local (Saturday 18:00 UTC) | ARC-WSUS01 (10.10.10.45) only |
svc-print | Print spooler | ARC-PRINT01 only |
4. Routine activity
| When (UTC) | Activity | Hosts involved |
|---|---|---|
| Daily 14:00 | Backup job | ARC-BKP01 → all servers |
| Sat 18:00 | Weekly vulnerability scan | ARC-WSUS01 (10.10.10.45) → all hosts |
| Wed 17:00 | WSUS patch window | All servers |
| 15th & 30th | Payroll processing, Finance share | ARC-FS01 |
| Fridays | Company-wide work-from-home | ARC-VPN01 |
| Every 15 min, business hours | CAD licence check-in (ticket ARC-3902) | Engineering workstations |
| Continuous | Adware infection, remediation scheduled (ticket ARC-4471) | ARC-LT-207 |
| Continuous | Failed logons for p.aquino — stale saved password on a personal device (ticket ARC-4388) | ARC-DC01 |
5. Log sources in the SIEM
| Index | Sourcetype | Coverage |
|---|---|---|
auth | win:security | Windows security events from the DC and all servers — logons, account and group changes, service installs, scheduled tasks, log clearing |
sysmon | win:sysmon | Process creation, network connections, file and registry activity |
fw | arc:firewall | Perimeter firewall traffic — allow/deny, addresses, ports, byte counts |
dns | dns:query | All internal DNS resolution, from ARC-DC01 |
proxy | arc:proxy | All outbound web traffic, with user attribution |
vpn | arc:vpn | Remote-access VPN authentication and session records, including the source ASN and network type |
filesrv | win:fileaudit | File share access on ARC-FS01 |
edr | defender:alerts | Endpoint protection detections, quarantine actions, and tamper events |
Known blind spots
The IT team has informed you of three gaps in coverage.
Remote-access VPN does not require multi-factor authentication. A valid username and password is enough to connect from anywhere, and there is no MFA log to consult because there is no MFA.
Email is outsourced, and the mail gateway does not forward anything to the SIEM. There is no mail-flow, sender or attachment visibility here at all.
Endpoint protection is deployed without tamper protection, so anyone holding administrative rights on a host can switch it off locally.
6. Console reference
The search bar filters; it does not aggregate.
failed | events whose raw text contains failed |
"failed logon" | exact phrase |
user=r.bautista | field equals value |
src_ip=10.10.20.* | wildcard |
user!=svc-backup | field exists and is not this value |
a b | implicit AND |
a OR b, NOT a, (a OR b) c | booleans and grouping |
index=auth sourcetype="win:security" | limit to a log source |
Everything is case-insensitive. The Fields sidebar lists every field present in the current result set, its number of distinct values, and its most common values. The histogram shows event volume over the selected range; clicking a bar sets the time range to that bar.