Deployment
Deployment Overview
Recap of what we covered together.
Correlating an incident today means manual exports, KQL queries, and console-hopping — costing hours on investigations that should take minutes.
5 security people covering 47 countries, 7,000 employees, and a full enterprise security stack.
Show that any enterprise system can be connected to Ceva's existing security stack — starting with ERP access rights, queried in plain language.
A third-party CRM with a limited API and minimal logs. You need SOC visibility and workflow automation — but the vendor doesn't expose enough.
INFO 192.168.4.22 2026-03-07T09:42:15 /api/v3/reports/customers/export
{
"timestamp": "2026-03-07T09:42:15",
"actor": "sarah.connor",
"source_ip": "84.229.12.47",
"action": "mass_customer_export",
"resource": "customer_database",
"records_exported": 84591,
"export_format": "CSV",
"target_id": "crm_core_prod"
}
CRM data was leaking live on Telegram — and with no visibility into who was acting in the application, they had no way to stop it.
Self Hosted CRM, one of the market leader vendors
Combined efforts of internal and external IR teams
Classified records leakage, from a gov agency that has huge potential damage, continuously leaking to the public.
Internal team trying to correlate between multiple resources (The asset, security products - EDR, FW, SIEM)
Reach out and hire 2 premium IR companies in order to accelerate the investigation process
After multiple weeks of manual investigation, they can't still determine who is the actor and what is the root cause
Trying to reach out and interact with attacker in order to stop the incident
Using the Unfolding process, unfold learned the CRM deeply - its events, entities, protocols, and operational patterns.
Unfold Maps every user activity to any product functionality - Answering the question - which user triggered the export and from which IP.
Immediately after the next export attempt, The Team was able to block the specific actor using the FW.
Telemetry pipeline from the CRM to the Customer's SIEM was built and continuously monitoring the asset.