Posture, spend & inventory
What the system is tracking as possible work, its status, and what's been attributed to a ticket. When a fixed item stays gone for 2 consecutive daily checks (~48h), Athena files it as completed work — risk items to Jira, asset items to JSM.
Ledger not persisted (REMEDIATION_TABLE unset) — showing the live open set only. The confirming / remediated history is retained once the ledger is configured and the daily sync runs.
Confirmed fixes awaiting/failing a ticket first, then items confirming a fix, then open work, then remediated.
| Item | Category | Target | Status | Ticket |
|---|---|---|---|---|
Critical CVE-2024-3094 (xz-utils backdoor) on processing host AWS AWS::EC2::Instance i-0nwprocessingec201 (us-west-2) — critical — Security | Cloud | Jira · risk | Tracking | — |
EBS volumes unencrypted AWS AWS::EC2::Volume nw-processing-ec2-01 (us-west-2) — high — Security | Cloud | Jira · risk | Tracking | — |
EC2 instance querying a known crypto-mining domain AWS AWS::EC2::Instance i-0nwtradeapi3 (us-east-1) — critical — Security | Cloud | Jira · risk | Tracking | — |
Processing Lambda concurrency unreserved AWS AWS::Lambda::Function processing-processor (us-west-2) — high — Scalability | Cloud | Jira · risk | Tracking | — |
Northwind-WIN-FIN-038: OS out of date Windows 11 22H2 (p.okoye@northwind.example) via Intune | Device | JSM · asset | Tracking | — |
Northwind-WIN-LEGAL-011: EDR not installed Windows 10 22H2 (d.reyes@northwind.example) via Intune | Device | JSM · asset | Tracking | — |
Northwind-WIN-LEGAL-011: OS out of date Windows 10 22H2 (d.reyes@northwind.example) via Intune | Device | JSM · asset | Tracking | — |
Northwind-WIN-OPS-076: disk not encrypted Windows 11 23H2 (k.shah@northwind.example) via Intune | Device | JSM · asset | Tracking | — |
nw-bastion-01: OS out of date Amazon Linux 2023 via AWS | Device | JSM · asset | Tracking | — |
nw-processing-ec2-01: disk not encrypted Ubuntu 22.04 LTS via AWS | Device | JSM · asset | Tracking | — |
Fuel pricing bot (decommissioned): stale enterprise app Inactive 288d; 0 assignments | Enterprise apps | Jira · risk | Tracking | — |
Legacy VPN (SAML): stale enterprise app Inactive 163d; 12 assignments | Enterprise apps | Jira · risk | Tracking | — |
Okta (migration): stale enterprise app Inactive 410d; 0 assignments | Enterprise apps | Jira · risk | Tracking | — |
Frank Doyle: Stale frank.doyle@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |
Guest — Auditor: No MFA auditor@ext-kpmg.com (Entra) | Identity | JSM · asset | Tracking | — |
Karen Lnewton: No MFA karen.lewton@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |
Legacy Admin: Privileged, no MFA administrator@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |
Legacy Admin: Stale administrator@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |
Peter Storm: Disabled peter.storm@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |
Tom Becker: Privileged, no MFA tom.becker@northwind.example (Entra) | Identity | JSM · asset | Tracking | — |