Security use case

Unusual EHR access around Surgical CAPD

Observability stays on otel-demo. This scenario writes audit events into the Security Serverless project so SIEM can treat PHI access as a detection problem, not an APM chart.

SecurityCollection (TA0009)T1213

Story

While Dr. Okonkwo is in OR 5 on ACDF C5–C6, the revenue-cycle service account billing.svc authenticates from a VPN address ( 198.51.100.44), walks every synthetic FHIR Patient in the OR board, and opens the ACDF operative note.

That is not a surgeon or charting workstation. Elastic Security should fire on a non-clinical identity reading CAPD notes and FHIR Patients in bulk.

What gets written

Data stream logs-vincari.security-default on my-security-project-ac9463.

Valid-account login from outside the surgical LAN
One FHIR Patient read per OR board case (labels.mrn / case.id)
CAPD note open for OR-4421
Custom query rule: billing.svc + ehr.record.read / capd.note.read

Correlate back to otel-demo with labels.case_id and the Observability traces for the same case.