[{"id":1136,"userId":"compromised-user-mocksiemkasperskyedr-20957","actionType":"BLOCK","incidentId":20957,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20957-iam-block","performedAt":"2026-05-15T20:53:48.471201Z"},{"id":1135,"userId":"compromised-user-mocksiemkasperskyedr-20951","actionType":"BLOCK","incidentId":20951,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20951-iam-block","performedAt":"2026-05-15T20:53:48.351749Z"},{"id":1134,"userId":"compromised-user-mocksiemkasperskyedr-20949","actionType":"BLOCK","incidentId":20949,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20949-iam-block","performedAt":"2026-05-15T20:53:48.288155Z"},{"id":1133,"userId":"compromised-user-mocksiemkasperskyedr-20948","actionType":"BLOCK","incidentId":20948,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20948-iam-block","performedAt":"2026-05-15T20:53:48.264095Z"},{"id":1132,"userId":"compromised-user-mocksiemkasperskyedr-20921","actionType":"BLOCK","incidentId":20921,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20921-iam-block","performedAt":"2026-05-15T20:53:47.703309Z"},{"id":1131,"userId":"compromised-user-mocksiemkasperskyedr-20917","actionType":"BLOCK","incidentId":20917,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20917-iam-block","performedAt":"2026-05-15T20:53:47.584429Z"},{"id":1130,"userId":"compromised-user-mocksiemkasperskyedr-20914","actionType":"BLOCK","incidentId":20914,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20914-iam-block","performedAt":"2026-05-15T20:53:47.497154Z"},{"id":1129,"userId":"compromised-user-mocksiemkasperskyedr-20911","actionType":"BLOCK","incidentId":20911,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20911-iam-block","performedAt":"2026-05-15T20:53:47.407772Z"},{"id":1128,"userId":"compromised-user-mocksiemkasperskyedr-20906","actionType":"BLOCK","incidentId":20906,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20906-iam-block","performedAt":"2026-05-15T20:53:47.285443Z"},{"id":1127,"userId":"compromised-user-mocksiemkasperskyedr-20898","actionType":"BLOCK","incidentId":20898,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20898-iam-block","performedAt":"2026-05-15T20:53:47.154959Z"},{"id":1126,"userId":"compromised-user-mocksiemkasperskyedr-20882","actionType":"BLOCK","incidentId":20882,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20882-iam-block","performedAt":"2026-05-15T20:53:46.712481Z"},{"id":1125,"userId":"compromised-user-mocksiemkasperskyedr-20874","actionType":"BLOCK","incidentId":20874,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20874-iam-block","performedAt":"2026-05-15T20:53:46.554496Z"},{"id":1124,"userId":"compromised-user-mocksiemkasperskyedr-20858","actionType":"BLOCK","incidentId":20858,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20858-iam-block","performedAt":"2026-05-15T20:53:46.267826Z"},{"id":1123,"userId":"compromised-user-mocksiemkasperskyedr-20838","actionType":"BLOCK","incidentId":20838,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20838-iam-block","performedAt":"2026-05-15T20:53:45.911012Z"},{"id":1122,"userId":"compromised-user-mocksiemkasperskyedr-20828","actionType":"BLOCK","incidentId":20828,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20828-iam-block","performedAt":"2026-05-15T20:53:45.739538Z"},{"id":1121,"userId":"compromised-user-mocksiemkasperskyedr-20823","actionType":"BLOCK","incidentId":20823,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20823-iam-block","performedAt":"2026-05-15T20:53:45.638741Z"},{"id":1120,"userId":"compromised-user-mocksiemkasperskyedr-20822","actionType":"BLOCK","incidentId":20822,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20822-iam-block","performedAt":"2026-05-15T20:53:45.590978Z"},{"id":1119,"userId":"compromised-user-mocksiemkasperskyedr-20806","actionType":"BLOCK","incidentId":20806,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20806-iam-block","performedAt":"2026-05-15T20:53:45.285816Z"},{"id":1118,"userId":"compromised-user-mocksiemkasperskyedr-20802","actionType":"BLOCK","incidentId":20802,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20802-iam-block","performedAt":"2026-05-15T20:53:45.223200Z"},{"id":1117,"userId":"compromised-user-mocksiemkasperskyedr-20799","actionType":"BLOCK","incidentId":20799,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20799-iam-block","performedAt":"2026-05-15T20:53:45.096716Z"},{"id":1116,"userId":"compromised-user-mocksiemkasperskyedr-20798","actionType":"BLOCK","incidentId":20798,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20798-iam-block","performedAt":"2026-05-15T20:53:45.068560Z"},{"id":1115,"userId":"compromised-user-mocksiemkasperskyedr-20787","actionType":"BLOCK","incidentId":20787,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20787-iam-block","performedAt":"2026-05-15T20:53:44.783099Z"},{"id":1114,"userId":"compromised-user-mocksiemkasperskyedr-20773","actionType":"BLOCK","incidentId":20773,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20773-iam-block","performedAt":"2026-05-15T20:53:44.466428Z"},{"id":1113,"userId":"compromised-user-mocksiemkasperskyedr-20726","actionType":"BLOCK","incidentId":20726,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20726-iam-block","performedAt":"2026-05-15T20:53:43.573403Z"},{"id":1112,"userId":"compromised-user-mocksiemkasperskyedr-20720","actionType":"BLOCK","incidentId":20720,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20720-iam-block","performedAt":"2026-05-15T20:53:43.426403Z"},{"id":1111,"userId":"compromised-user-mocksiemkasperskyedr-20717","actionType":"BLOCK","incidentId":20717,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20717-iam-block","performedAt":"2026-05-15T20:53:43.365806Z"},{"id":1110,"userId":"compromised-user-mocksiemkasperskyedr-20711","actionType":"BLOCK","incidentId":20711,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20711-iam-block","performedAt":"2026-05-15T20:53:43.215532Z"},{"id":1109,"userId":"compromised-user-mocksiemkasperskyedr-20710","actionType":"BLOCK","incidentId":20710,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20710-iam-block","performedAt":"2026-05-15T20:53:43.185732Z"},{"id":1108,"userId":"compromised-user-mocksiemkasperskyedr-20704","actionType":"BLOCK","incidentId":20704,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20704-iam-block","performedAt":"2026-05-15T20:53:42.997123Z"},{"id":1107,"userId":"compromised-user-mocksiemkasperskyedr-20692","actionType":"BLOCK","incidentId":20692,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20692-iam-block","performedAt":"2026-05-15T20:53:42.743462Z"},{"id":1106,"userId":"compromised-user-mocksiemkasperskyedr-20668","actionType":"BLOCK","incidentId":20668,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20668-iam-block","performedAt":"2026-05-15T20:53:42.087959Z"},{"id":1105,"userId":"compromised-user-mocksiemkasperskyedr-20666","actionType":"BLOCK","incidentId":20666,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20666-iam-block","performedAt":"2026-05-15T20:53:42.007970Z"},{"id":1104,"userId":"compromised-user-mocksiemkasperskyedr-20654","actionType":"BLOCK","incidentId":20654,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20654-iam-block","performedAt":"2026-05-15T20:53:41.741763Z"},{"id":1103,"userId":"compromised-user-mocksiemkasperskyedr-20646","actionType":"BLOCK","incidentId":20646,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20646-iam-block","performedAt":"2026-05-15T20:53:41.562432Z"},{"id":1102,"userId":"compromised-user-mocksiemkasperskyedr-20627","actionType":"BLOCK","incidentId":20627,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20627-iam-block","performedAt":"2026-05-15T20:53:41.222891Z"},{"id":1101,"userId":"compromised-user-mocksiemkasperskyedr-20624","actionType":"BLOCK","incidentId":20624,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20624-iam-block","performedAt":"2026-05-15T20:53:41.124240Z"},{"id":1100,"userId":"compromised-user-mocksiemkasperskyedr-20593","actionType":"BLOCK","incidentId":20593,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20593-iam-block","performedAt":"2026-05-15T20:53:40.488486Z"},{"id":1099,"userId":"compromised-user-mocksiemkasperskyedr-20575","actionType":"BLOCK","incidentId":20575,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20575-iam-block","performedAt":"2026-05-15T20:53:40.072520Z"},{"id":1098,"userId":"compromised-user-mocksiemkasperskyedr-20525","actionType":"BLOCK","incidentId":20525,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20525-iam-block","performedAt":"2026-05-15T20:53:39.004243Z"},{"id":1097,"userId":"compromised-user-mocksiemkasperskyedr-20511","actionType":"BLOCK","incidentId":20511,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20511-iam-block","performedAt":"2026-05-15T20:53:38.710469Z"},{"id":1096,"userId":"compromised-user-mocksiemkasperskyedr-20484","actionType":"BLOCK","incidentId":20484,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20484-iam-block","performedAt":"2026-05-15T20:53:38.164653Z"},{"id":1095,"userId":"compromised-user-mocksiemkasperskyedr-20465","actionType":"BLOCK","incidentId":20465,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20465-iam-block","performedAt":"2026-05-15T20:53:37.692354Z"},{"id":1094,"userId":"compromised-user-mocksiemkasperskyedr-20460","actionType":"BLOCK","incidentId":20460,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20460-iam-block","performedAt":"2026-05-15T20:53:37.563382Z"},{"id":1093,"userId":"compromised-user-mocksiemkasperskyedr-20455","actionType":"BLOCK","incidentId":20455,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20455-iam-block","performedAt":"2026-05-15T20:53:37.457913Z"},{"id":1092,"userId":"compromised-user-mocksiemkasperskyedr-20435","actionType":"BLOCK","incidentId":20435,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20435-iam-block","performedAt":"2026-05-15T20:53:37.116227Z"},{"id":1091,"userId":"compromised-user-mocksiemkasperskyedr-20397","actionType":"BLOCK","incidentId":20397,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20397-iam-block","performedAt":"2026-05-15T20:53:36.261331Z"},{"id":1090,"userId":"compromised-user-mocksiemkasperskyedr-20385","actionType":"BLOCK","incidentId":20385,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20385-iam-block","performedAt":"2026-05-15T20:53:36.028601Z"},{"id":1089,"userId":"compromised-user-mocksiemkasperskyedr-20366","actionType":"BLOCK","incidentId":20366,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20366-iam-block","performedAt":"2026-05-15T20:53:35.628838Z"},{"id":1088,"userId":"compromised-user-mocksiemkasperskyedr-20357","actionType":"BLOCK","incidentId":20357,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20357-iam-block","performedAt":"2026-05-15T20:53:35.447769Z"},{"id":1087,"userId":"compromised-user-mocksiemkasperskyedr-20354","actionType":"BLOCK","incidentId":20354,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20354-iam-block","performedAt":"2026-05-15T20:53:35.384566Z"},{"id":1086,"userId":"compromised-user-mocksiemkasperskyedr-20347","actionType":"BLOCK","incidentId":20347,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20347-iam-block","performedAt":"2026-05-15T20:53:35.201897Z"},{"id":1085,"userId":"compromised-user-mocksiemkasperskyedr-20342","actionType":"BLOCK","incidentId":20342,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20342-iam-block","performedAt":"2026-05-15T20:53:35.100917Z"},{"id":1084,"userId":"compromised-user-mocksiemkasperskyedr-20334","actionType":"BLOCK","incidentId":20334,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20334-iam-block","performedAt":"2026-05-15T20:53:34.935567Z"},{"id":1083,"userId":"compromised-user-mocksiemkasperskyedr-20324","actionType":"BLOCK","incidentId":20324,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20324-iam-block","performedAt":"2026-05-15T20:53:34.700756Z"},{"id":1082,"userId":"compromised-user-mocksiemkasperskyedr-20322","actionType":"BLOCK","incidentId":20322,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20322-iam-block","performedAt":"2026-05-15T20:53:34.655986Z"},{"id":1081,"userId":"compromised-user-mocksiemkasperskyedr-20317","actionType":"BLOCK","incidentId":20317,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20317-iam-block","performedAt":"2026-05-15T20:53:34.528876Z"},{"id":1080,"userId":"compromised-user-mocksiemkasperskyedr-20296","actionType":"BLOCK","incidentId":20296,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20296-iam-block","performedAt":"2026-05-15T20:53:33.936403Z"},{"id":1079,"userId":"compromised-user-mocksiemkasperskyedr-20290","actionType":"BLOCK","incidentId":20290,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20290-iam-block","performedAt":"2026-05-15T20:53:33.822598Z"},{"id":1078,"userId":"compromised-user-mocksiemkasperskyedr-20284","actionType":"BLOCK","incidentId":20284,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20284-iam-block","performedAt":"2026-05-15T20:53:33.694701Z"},{"id":1077,"userId":"compromised-user-mocksiemkasperskyedr-20274","actionType":"BLOCK","incidentId":20274,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20274-iam-block","performedAt":"2026-05-15T20:53:33.464615Z"},{"id":1076,"userId":"compromised-user-mocksiemkasperskyedr-20270","actionType":"BLOCK","incidentId":20270,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20270-iam-block","performedAt":"2026-05-15T20:53:33.394652Z"},{"id":1075,"userId":"compromised-user-mocksiemkasperskyedr-20239","actionType":"BLOCK","incidentId":20239,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20239-iam-block","performedAt":"2026-05-15T20:53:32.594113Z"},{"id":1074,"userId":"compromised-user-mocksiemkasperskyedr-20237","actionType":"BLOCK","incidentId":20237,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20237-iam-block","performedAt":"2026-05-15T20:53:32.553613Z"},{"id":1073,"userId":"compromised-user-mocksiemkasperskyedr-20224","actionType":"BLOCK","incidentId":20224,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20224-iam-block","performedAt":"2026-05-15T20:53:32.311519Z"},{"id":1072,"userId":"compromised-user-mocksiemkasperskyedr-20184","actionType":"BLOCK","incidentId":20184,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20184-iam-block","performedAt":"2026-05-15T20:53:31.474668Z"},{"id":1071,"userId":"compromised-user-mocksiemkasperskyedr-20168","actionType":"BLOCK","incidentId":20168,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20168-iam-block","performedAt":"2026-05-15T20:53:31.161573Z"},{"id":1070,"userId":"compromised-user-mocksiemkasperskyedr-20154","actionType":"BLOCK","incidentId":20154,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20154-iam-block","performedAt":"2026-05-15T20:53:30.924745Z"},{"id":1069,"userId":"compromised-user-mocksiemkasperskyedr-20137","actionType":"BLOCK","incidentId":20137,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20137-iam-block","performedAt":"2026-05-15T20:53:30.491794Z"},{"id":1068,"userId":"compromised-user-mocksiemkasperskyedr-20115","actionType":"BLOCK","incidentId":20115,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20115-iam-block","performedAt":"2026-05-15T20:53:29.982399Z"},{"id":1067,"userId":"compromised-user-mocksiemkasperskyedr-20099","actionType":"BLOCK","incidentId":20099,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20099-iam-block","performedAt":"2026-05-15T20:53:29.665767Z"},{"id":1066,"userId":"compromised-user-mocksiemkasperskyedr-20085","actionType":"BLOCK","incidentId":20085,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20085-iam-block","performedAt":"2026-05-15T20:53:29.362051Z"},{"id":1065,"userId":"compromised-user-mocksiemkasperskyedr-20058","actionType":"BLOCK","incidentId":20058,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20058-iam-block","performedAt":"2026-05-15T20:53:28.882306Z"},{"id":1064,"userId":"compromised-user-mocksiemkasperskyedr-20040","actionType":"BLOCK","incidentId":20040,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20040-iam-block","performedAt":"2026-05-15T20:53:28.513085Z"},{"id":1063,"userId":"compromised-user-mocksiemkasperskyedr-20032","actionType":"BLOCK","incidentId":20032,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20032-iam-block","performedAt":"2026-05-15T20:53:28.354501Z"},{"id":1062,"userId":"compromised-user-mocksiemkasperskyedr-20022","actionType":"BLOCK","incidentId":20022,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-20022-iam-block","performedAt":"2026-05-15T20:53:28.171417Z"},{"id":1061,"userId":"compromised-user-mocksiemkasperskyedr-20006","actionType":"BLOCK","incidentId":20006,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20006-iam-block","performedAt":"2026-05-15T20:53:27.835706Z"},{"id":1060,"userId":"compromised-user-mocksiemkasperskyedr-20003","actionType":"BLOCK","incidentId":20003,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-20003-iam-block","performedAt":"2026-05-15T20:53:27.768533Z"},{"id":1059,"userId":"compromised-user-mocksiemkasperskyedr-19954","actionType":"BLOCK","incidentId":19954,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19954-iam-block","performedAt":"2026-05-15T20:53:26.780726Z"},{"id":1058,"userId":"compromised-user-mocksiemkasperskyedr-19950","actionType":"BLOCK","incidentId":19950,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19950-iam-block","performedAt":"2026-05-15T20:53:26.660016Z"},{"id":1057,"userId":"compromised-user-mocksiemkasperskyedr-19915","actionType":"BLOCK","incidentId":19915,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19915-iam-block","performedAt":"2026-05-15T20:53:25.573587Z"},{"id":1056,"userId":"compromised-user-mocksiemkasperskyedr-19901","actionType":"BLOCK","incidentId":19901,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19901-iam-block","performedAt":"2026-05-15T20:53:25.206779Z"},{"id":1055,"userId":"compromised-user-mocksiemkasperskyedr-19895","actionType":"BLOCK","incidentId":19895,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19895-iam-block","performedAt":"2026-05-15T20:53:25.052883Z"},{"id":1054,"userId":"compromised-user-mocksiemkasperskyedr-19894","actionType":"BLOCK","incidentId":19894,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19894-iam-block","performedAt":"2026-05-15T20:53:25.025491Z"},{"id":1053,"userId":"compromised-user-mocksiemkasperskyedr-19884","actionType":"BLOCK","incidentId":19884,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19884-iam-block","performedAt":"2026-05-15T20:53:24.714940Z"},{"id":1052,"userId":"compromised-user-mocksiemkasperskyedr-19869","actionType":"BLOCK","incidentId":19869,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19869-iam-block","performedAt":"2026-05-15T20:53:24.396969Z"},{"id":1051,"userId":"compromised-user-mocksiemkasperskyedr-19857","actionType":"BLOCK","incidentId":19857,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19857-iam-block","performedAt":"2026-05-15T20:53:24.171455Z"},{"id":1050,"userId":"compromised-user-mocksiemkasperskyedr-19844","actionType":"BLOCK","incidentId":19844,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19844-iam-block","performedAt":"2026-05-15T20:53:23.889950Z"},{"id":1049,"userId":"compromised-user-mocksiemkasperskyedr-19837","actionType":"BLOCK","incidentId":19837,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19837-iam-block","performedAt":"2026-05-15T20:53:23.721704Z"},{"id":1048,"userId":"compromised-user-mocksiemkasperskyedr-19813","actionType":"BLOCK","incidentId":19813,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19813-iam-block","performedAt":"2026-05-15T20:53:23.281697Z"},{"id":1047,"userId":"compromised-user-mocksiemkasperskyedr-19790","actionType":"BLOCK","incidentId":19790,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19790-iam-block","performedAt":"2026-05-15T20:53:22.878690Z"},{"id":1046,"userId":"compromised-user-mocksiemkasperskyedr-19766","actionType":"BLOCK","incidentId":19766,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19766-iam-block","performedAt":"2026-05-15T20:53:22.448881Z"},{"id":1045,"userId":"compromised-user-mocksiemkasperskyedr-19748","actionType":"BLOCK","incidentId":19748,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19748-iam-block","performedAt":"2026-05-15T20:53:22.164009Z"},{"id":1044,"userId":"compromised-user-mocksiemkasperskyedr-19728","actionType":"BLOCK","incidentId":19728,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19728-iam-block","performedAt":"2026-05-15T20:53:21.795079Z"},{"id":1043,"userId":"compromised-user-mocksiemkasperskyedr-19725","actionType":"BLOCK","incidentId":19725,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19725-iam-block","performedAt":"2026-05-15T20:53:21.743226Z"},{"id":1042,"userId":"compromised-user-mocksiemkasperskyedr-19712","actionType":"BLOCK","incidentId":19712,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19712-iam-block","performedAt":"2026-05-15T20:53:21.535421Z"},{"id":1041,"userId":"compromised-user-mocksiemkasperskyedr-19692","actionType":"BLOCK","incidentId":19692,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19692-iam-block","performedAt":"2026-05-15T20:53:21.034321Z"},{"id":1040,"userId":"compromised-user-mocksiemkasperskyedr-19674","actionType":"BLOCK","incidentId":19674,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19674-iam-block","performedAt":"2026-05-15T20:53:20.636085Z"},{"id":1039,"userId":"compromised-user-mocksiemkasperskyedr-19672","actionType":"BLOCK","incidentId":19672,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19672-iam-block","performedAt":"2026-05-15T20:53:20.566217Z"},{"id":1038,"userId":"compromised-user-mocksiemkasperskyedr-19670","actionType":"BLOCK","incidentId":19670,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19670-iam-block","performedAt":"2026-05-15T20:53:20.512299Z"},{"id":1037,"userId":"compromised-user-mocksiemkasperskyedr-19666","actionType":"BLOCK","incidentId":19666,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19666-iam-block","performedAt":"2026-05-15T20:53:20.420707Z"},{"id":1036,"userId":"compromised-user-mocksiemkasperskyedr-19658","actionType":"BLOCK","incidentId":19658,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19658-iam-block","performedAt":"2026-05-15T20:53:20.230694Z"},{"id":1035,"userId":"compromised-user-mocksiemkasperskyedr-19649","actionType":"BLOCK","incidentId":19649,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19649-iam-block","performedAt":"2026-05-15T20:53:20.048484Z"},{"id":1034,"userId":"compromised-user-mocksiemkasperskyedr-19647","actionType":"BLOCK","incidentId":19647,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19647-iam-block","performedAt":"2026-05-15T20:53:19.994888Z"},{"id":1033,"userId":"compromised-user-mocksiemkasperskyedr-19645","actionType":"BLOCK","incidentId":19645,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19645-iam-block","performedAt":"2026-05-15T20:53:19.935451Z"},{"id":1032,"userId":"compromised-user-mocksiemkasperskyedr-19642","actionType":"BLOCK","incidentId":19642,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19642-iam-block","performedAt":"2026-05-15T20:53:19.872842Z"},{"id":1031,"userId":"compromised-user-mocksiemkasperskyedr-19641","actionType":"BLOCK","incidentId":19641,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19641-iam-block","performedAt":"2026-05-15T20:53:19.836806Z"},{"id":1030,"userId":"compromised-user-mocksiemkasperskyedr-19629","actionType":"BLOCK","incidentId":19629,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19629-iam-block","performedAt":"2026-05-15T20:53:19.550074Z"},{"id":1029,"userId":"compromised-user-mocksiemkasperskyedr-19594","actionType":"BLOCK","incidentId":19594,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19594-iam-block","performedAt":"2026-05-15T20:53:18.832311Z"},{"id":1028,"userId":"compromised-user-mocksiemkasperskyedr-19588","actionType":"BLOCK","incidentId":19588,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19588-iam-block","performedAt":"2026-05-15T20:53:18.697600Z"},{"id":1027,"userId":"compromised-user-mocksiemkasperskyedr-19557","actionType":"BLOCK","incidentId":19557,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19557-iam-block","performedAt":"2026-05-15T20:53:18.140429Z"},{"id":1026,"userId":"compromised-user-mocksiemkasperskyedr-19552","actionType":"BLOCK","incidentId":19552,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19552-iam-block","performedAt":"2026-05-15T20:53:18.006203Z"},{"id":1025,"userId":"compromised-user-mocksiemkasperskyedr-19534","actionType":"BLOCK","incidentId":19534,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19534-iam-block","performedAt":"2026-05-15T20:53:17.690684Z"},{"id":1024,"userId":"compromised-user-mocksiemkasperskyedr-19532","actionType":"BLOCK","incidentId":19532,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19532-iam-block","performedAt":"2026-05-15T20:53:17.645288Z"},{"id":1023,"userId":"compromised-user-mocksiemkasperskyedr-19510","actionType":"BLOCK","incidentId":19510,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19510-iam-block","performedAt":"2026-05-15T20:53:17.077794Z"},{"id":1022,"userId":"compromised-user-mocksiemkasperskyedr-19505","actionType":"BLOCK","incidentId":19505,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19505-iam-block","performedAt":"2026-05-15T20:53:16.953911Z"},{"id":1021,"userId":"compromised-user-mocksiemkasperskyedr-19496","actionType":"BLOCK","incidentId":19496,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19496-iam-block","performedAt":"2026-05-15T20:53:16.784836Z"},{"id":1020,"userId":"compromised-user-mocksiemkasperskyedr-19495","actionType":"BLOCK","incidentId":19495,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19495-iam-block","performedAt":"2026-05-15T20:53:16.759460Z"},{"id":1019,"userId":"compromised-user-mocksiemkasperskyedr-19490","actionType":"BLOCK","incidentId":19490,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19490-iam-block","performedAt":"2026-05-15T20:53:16.678973Z"},{"id":1018,"userId":"compromised-user-mocksiemkasperskyedr-19484","actionType":"BLOCK","incidentId":19484,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19484-iam-block","performedAt":"2026-05-15T20:53:16.566006Z"},{"id":1017,"userId":"compromised-user-mocksiemkasperskyedr-19473","actionType":"BLOCK","incidentId":19473,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19473-iam-block","performedAt":"2026-05-15T20:53:16.369125Z"},{"id":1016,"userId":"compromised-user-mocksiemkasperskyedr-19466","actionType":"BLOCK","incidentId":19466,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19466-iam-block","performedAt":"2026-05-15T20:53:16.221003Z"},{"id":1015,"userId":"compromised-user-mocksiemkasperskyedr-19432","actionType":"BLOCK","incidentId":19432,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19432-iam-block","performedAt":"2026-05-15T20:53:15.544831Z"},{"id":1014,"userId":"compromised-user-mocksiemkasperskyedr-19431","actionType":"BLOCK","incidentId":19431,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19431-iam-block","performedAt":"2026-05-15T20:53:15.511588Z"},{"id":1013,"userId":"compromised-user-mocksiemkasperskyedr-19429","actionType":"BLOCK","incidentId":19429,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19429-iam-block","performedAt":"2026-05-15T20:53:15.455519Z"},{"id":1012,"userId":"compromised-user-mocksiemkasperskyedr-19424","actionType":"BLOCK","incidentId":19424,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19424-iam-block","performedAt":"2026-05-15T20:53:15.308600Z"},{"id":1011,"userId":"compromised-user-mocksiemkasperskyedr-19394","actionType":"BLOCK","incidentId":19394,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19394-iam-block","performedAt":"2026-05-15T20:53:14.604512Z"},{"id":1010,"userId":"compromised-user-mocksiemkasperskyedr-19369","actionType":"BLOCK","incidentId":19369,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19369-iam-block","performedAt":"2026-05-15T20:53:14.129998Z"},{"id":1009,"userId":"compromised-user-mocksiemkasperskyedr-19353","actionType":"BLOCK","incidentId":19353,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19353-iam-block","performedAt":"2026-05-15T20:53:13.816600Z"},{"id":1008,"userId":"compromised-user-mocksiemkasperskyedr-19349","actionType":"BLOCK","incidentId":19349,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19349-iam-block","performedAt":"2026-05-15T20:53:13.742641Z"},{"id":1007,"userId":"compromised-user-mocksiemkasperskyedr-19333","actionType":"BLOCK","incidentId":19333,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19333-iam-block","performedAt":"2026-05-15T20:53:13.447429Z"},{"id":1006,"userId":"compromised-user-mocksiemkasperskyedr-19323","actionType":"BLOCK","incidentId":19323,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19323-iam-block","performedAt":"2026-05-15T20:53:13.268227Z"},{"id":1005,"userId":"compromised-user-mocksiemkasperskyedr-19316","actionType":"BLOCK","incidentId":19316,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19316-iam-block","performedAt":"2026-05-15T20:53:13.143839Z"},{"id":1004,"userId":"compromised-user-mocksiemkasperskyedr-19308","actionType":"BLOCK","incidentId":19308,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19308-iam-block","performedAt":"2026-05-15T20:53:12.999700Z"},{"id":1003,"userId":"compromised-user-mocksiemkasperskyedr-19298","actionType":"BLOCK","incidentId":19298,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19298-iam-block","performedAt":"2026-05-15T20:53:12.783894Z"},{"id":1002,"userId":"compromised-user-mocksiemkasperskyedr-19268","actionType":"BLOCK","incidentId":19268,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19268-iam-block","performedAt":"2026-05-15T20:53:12.191855Z"},{"id":1001,"userId":"compromised-user-mocksiemkasperskyedr-19261","actionType":"BLOCK","incidentId":19261,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19261-iam-block","performedAt":"2026-05-15T20:53:12.059583Z"},{"id":1000,"userId":"compromised-user-mocksiemkasperskyedr-19250","actionType":"BLOCK","incidentId":19250,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19250-iam-block","performedAt":"2026-05-15T20:53:11.818869Z"},{"id":999,"userId":"compromised-user-mocksiemkasperskyedr-19243","actionType":"BLOCK","incidentId":19243,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19243-iam-block","performedAt":"2026-05-15T20:53:11.696761Z"},{"id":998,"userId":"compromised-user-mocksiemkasperskyedr-19214","actionType":"BLOCK","incidentId":19214,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19214-iam-block","performedAt":"2026-05-15T20:53:11.131936Z"},{"id":997,"userId":"compromised-user-mocksiemkasperskyedr-19210","actionType":"BLOCK","incidentId":19210,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19210-iam-block","performedAt":"2026-05-15T20:53:11.047795Z"},{"id":996,"userId":"compromised-user-mocksiemkasperskyedr-19178","actionType":"BLOCK","incidentId":19178,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19178-iam-block","performedAt":"2026-05-15T20:53:10.368158Z"},{"id":995,"userId":"compromised-user-mocksiemkasperskyedr-19157","actionType":"BLOCK","incidentId":19157,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19157-iam-block","performedAt":"2026-05-15T20:53:09.822790Z"},{"id":994,"userId":"compromised-user-mocksiemkasperskyedr-19145","actionType":"BLOCK","incidentId":19145,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19145-iam-block","performedAt":"2026-05-15T20:53:09.568603Z"},{"id":993,"userId":"compromised-user-mocksiemkasperskyedr-19144","actionType":"BLOCK","incidentId":19144,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19144-iam-block","performedAt":"2026-05-15T20:53:09.542882Z"},{"id":992,"userId":"compromised-user-mocksiemkasperskyedr-19143","actionType":"BLOCK","incidentId":19143,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19143-iam-block","performedAt":"2026-05-15T20:53:09.515844Z"},{"id":991,"userId":"compromised-user-mocksiemkasperskyedr-19128","actionType":"BLOCK","incidentId":19128,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19128-iam-block","performedAt":"2026-05-15T20:53:09.235402Z"},{"id":990,"userId":"compromised-user-mocksiemkasperskyedr-19082","actionType":"BLOCK","incidentId":19082,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19082-iam-block","performedAt":"2026-05-15T20:53:08.325004Z"},{"id":989,"userId":"compromised-user-mocksiemkasperskyedr-19053","actionType":"BLOCK","incidentId":19053,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19053-iam-block","performedAt":"2026-05-15T20:53:07.804813Z"},{"id":988,"userId":"compromised-user-mocksiemkasperskyedr-19052","actionType":"BLOCK","incidentId":19052,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19052-iam-block","performedAt":"2026-05-15T20:53:07.772098Z"},{"id":987,"userId":"compromised-user-mocksiemkasperskyedr-19028","actionType":"BLOCK","incidentId":19028,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19028-iam-block","performedAt":"2026-05-15T20:53:07.163226Z"},{"id":986,"userId":"compromised-user-mocksiemkasperskyedr-19021","actionType":"BLOCK","incidentId":19021,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19021-iam-block","performedAt":"2026-05-15T20:53:06.931938Z"},{"id":985,"userId":"compromised-user-mocksiemkasperskyedr-19010","actionType":"BLOCK","incidentId":19010,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-19010-iam-block","performedAt":"2026-05-15T20:53:06.681303Z"},{"id":984,"userId":"compromised-user-mocksiemkasperskyedr-19006","actionType":"BLOCK","incidentId":19006,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-19006-iam-block","performedAt":"2026-05-15T20:53:06.572574Z"},{"id":983,"userId":"compromised-user-mocksiemkasperskyedr-18974","actionType":"BLOCK","incidentId":18974,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18974-iam-block","performedAt":"2026-05-15T20:53:05.934406Z"},{"id":982,"userId":"compromised-user-mocksiemkasperskyedr-18898","actionType":"BLOCK","incidentId":18898,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18898-iam-block","performedAt":"2026-05-15T20:53:04.524994Z"},{"id":981,"userId":"compromised-user-mocksiemkasperskyedr-18894","actionType":"BLOCK","incidentId":18894,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18894-iam-block","performedAt":"2026-05-15T20:53:04.434520Z"},{"id":980,"userId":"compromised-user-mocksiemkasperskyedr-18886","actionType":"BLOCK","incidentId":18886,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18886-iam-block","performedAt":"2026-05-15T20:53:04.271862Z"},{"id":979,"userId":"compromised-user-mocksiemkasperskyedr-18868","actionType":"BLOCK","incidentId":18868,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18868-iam-block","performedAt":"2026-05-15T20:53:03.950074Z"},{"id":978,"userId":"compromised-user-mocksiemkasperskyedr-18861","actionType":"BLOCK","incidentId":18861,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18861-iam-block","performedAt":"2026-05-15T20:53:03.807023Z"},{"id":977,"userId":"compromised-user-mocksiemkasperskyedr-18844","actionType":"BLOCK","incidentId":18844,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18844-iam-block","performedAt":"2026-05-15T20:53:03.496146Z"},{"id":976,"userId":"compromised-user-mocksiemkasperskyedr-18841","actionType":"BLOCK","incidentId":18841,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18841-iam-block","performedAt":"2026-05-15T20:53:03.420115Z"},{"id":975,"userId":"compromised-user-mocksiemkasperskyedr-18817","actionType":"BLOCK","incidentId":18817,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18817-iam-block","performedAt":"2026-05-15T20:53:02.856964Z"},{"id":974,"userId":"compromised-user-mocksiemkasperskyedr-18812","actionType":"BLOCK","incidentId":18812,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18812-iam-block","performedAt":"2026-05-15T20:53:02.745948Z"},{"id":973,"userId":"compromised-user-mocksiemkasperskyedr-18801","actionType":"BLOCK","incidentId":18801,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18801-iam-block","performedAt":"2026-05-15T20:53:02.547550Z"},{"id":972,"userId":"compromised-user-mocksiemkasperskyedr-18797","actionType":"BLOCK","incidentId":18797,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18797-iam-block","performedAt":"2026-05-15T20:53:02.454353Z"},{"id":971,"userId":"compromised-user-mocksiemkasperskyedr-18791","actionType":"BLOCK","incidentId":18791,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18791-iam-block","performedAt":"2026-05-15T20:53:02.317964Z"},{"id":970,"userId":"compromised-user-mocksiemkasperskyedr-18789","actionType":"BLOCK","incidentId":18789,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18789-iam-block","performedAt":"2026-05-15T20:53:02.261043Z"},{"id":969,"userId":"compromised-user-mocksiemkasperskyedr-18784","actionType":"BLOCK","incidentId":18784,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18784-iam-block","performedAt":"2026-05-15T20:53:02.163789Z"},{"id":968,"userId":"compromised-user-mocksiemkasperskyedr-18779","actionType":"BLOCK","incidentId":18779,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18779-iam-block","performedAt":"2026-05-15T20:53:02.047968Z"},{"id":967,"userId":"compromised-user-mocksiemkasperskyedr-18766","actionType":"BLOCK","incidentId":18766,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18766-iam-block","performedAt":"2026-05-15T20:53:01.765834Z"},{"id":966,"userId":"compromised-user-mocksiemkasperskyedr-18759","actionType":"BLOCK","incidentId":18759,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18759-iam-block","performedAt":"2026-05-15T20:53:01.565411Z"},{"id":965,"userId":"compromised-user-mocksiemkasperskyedr-18753","actionType":"BLOCK","incidentId":18753,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18753-iam-block","performedAt":"2026-05-15T20:53:01.446418Z"},{"id":964,"userId":"compromised-user-mocksiemkasperskyedr-18750","actionType":"BLOCK","incidentId":18750,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18750-iam-block","performedAt":"2026-05-15T20:53:01.377743Z"},{"id":963,"userId":"compromised-user-mocksiemkasperskyedr-18701","actionType":"BLOCK","incidentId":18701,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18701-iam-block","performedAt":"2026-05-15T20:53:00.346043Z"},{"id":962,"userId":"compromised-user-mocksiemkasperskyedr-18698","actionType":"BLOCK","incidentId":18698,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18698-iam-block","performedAt":"2026-05-15T20:53:00.269016Z"},{"id":961,"userId":"compromised-user-mocksiemkasperskyedr-18675","actionType":"BLOCK","incidentId":18675,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18675-iam-block","performedAt":"2026-05-15T20:52:59.679789Z"},{"id":960,"userId":"compromised-user-mocksiemkasperskyedr-18657","actionType":"BLOCK","incidentId":18657,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18657-iam-block","performedAt":"2026-05-15T20:52:59.307770Z"},{"id":959,"userId":"compromised-user-mocksiemkasperskyedr-18654","actionType":"BLOCK","incidentId":18654,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18654-iam-block","performedAt":"2026-05-15T20:52:59.242736Z"},{"id":958,"userId":"compromised-user-mocksiemkasperskyedr-18633","actionType":"BLOCK","incidentId":18633,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18633-iam-block","performedAt":"2026-05-15T20:52:58.846962Z"},{"id":957,"userId":"compromised-user-mocksiemkasperskyedr-18628","actionType":"BLOCK","incidentId":18628,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18628-iam-block","performedAt":"2026-05-15T20:52:58.724095Z"},{"id":956,"userId":"compromised-user-mocksiemkasperskyedr-18626","actionType":"BLOCK","incidentId":18626,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18626-iam-block","performedAt":"2026-05-15T20:52:58.675974Z"},{"id":955,"userId":"compromised-user-mocksiemkasperskyedr-18615","actionType":"BLOCK","incidentId":18615,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18615-iam-block","performedAt":"2026-05-15T20:52:58.418969Z"},{"id":954,"userId":"compromised-user-mocksiemkasperskyedr-18606","actionType":"BLOCK","incidentId":18606,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18606-iam-block","performedAt":"2026-05-15T20:52:58.230519Z"},{"id":953,"userId":"compromised-user-mocksiemkasperskyedr-18594","actionType":"BLOCK","incidentId":18594,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18594-iam-block","performedAt":"2026-05-15T20:52:57.904820Z"},{"id":952,"userId":"compromised-user-mocksiemkasperskyedr-18586","actionType":"BLOCK","incidentId":18586,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18586-iam-block","performedAt":"2026-05-15T20:52:57.737042Z"},{"id":951,"userId":"compromised-user-mocksiemkasperskyedr-18583","actionType":"BLOCK","incidentId":18583,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18583-iam-block","performedAt":"2026-05-15T20:52:57.671996Z"},{"id":950,"userId":"compromised-user-mocksiemkasperskyedr-18541","actionType":"BLOCK","incidentId":18541,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18541-iam-block","performedAt":"2026-05-15T20:52:56.816515Z"},{"id":949,"userId":"compromised-user-mocksiemkasperskyedr-18518","actionType":"BLOCK","incidentId":18518,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18518-iam-block","performedAt":"2026-05-15T20:52:56.361856Z"},{"id":948,"userId":"compromised-user-mocksiemkasperskyedr-18467","actionType":"BLOCK","incidentId":18467,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18467-iam-block","performedAt":"2026-05-15T20:52:55.350657Z"},{"id":947,"userId":"compromised-user-mocksiemkasperskyedr-18446","actionType":"BLOCK","incidentId":18446,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18446-iam-block","performedAt":"2026-05-15T20:52:54.934381Z"},{"id":946,"userId":"compromised-user-mocksiemkasperskyedr-18373","actionType":"BLOCK","incidentId":18373,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18373-iam-block","performedAt":"2026-05-15T20:52:53.353406Z"},{"id":945,"userId":"compromised-user-mocksiemkasperskyedr-18354","actionType":"BLOCK","incidentId":18354,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18354-iam-block","performedAt":"2026-05-15T20:52:52.971334Z"},{"id":944,"userId":"compromised-user-mocksiemkasperskyedr-18347","actionType":"BLOCK","incidentId":18347,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18347-iam-block","performedAt":"2026-05-15T20:52:52.818600Z"},{"id":943,"userId":"compromised-user-mocksiemkasperskyedr-18317","actionType":"BLOCK","incidentId":18317,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18317-iam-block","performedAt":"2026-05-15T20:52:52.165433Z"},{"id":942,"userId":"compromised-user-mocksiemkasperskyedr-18316","actionType":"BLOCK","incidentId":18316,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18316-iam-block","performedAt":"2026-05-15T20:52:52.133353Z"},{"id":941,"userId":"compromised-user-mocksiemkasperskyedr-18285","actionType":"BLOCK","incidentId":18285,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18285-iam-block","performedAt":"2026-05-15T20:52:51.477716Z"},{"id":940,"userId":"compromised-user-mocksiemkasperskyedr-18277","actionType":"BLOCK","incidentId":18277,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18277-iam-block","performedAt":"2026-05-15T20:52:51.310021Z"},{"id":939,"userId":"compromised-user-mocksiemkasperskyedr-18237","actionType":"BLOCK","incidentId":18237,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18237-iam-block","performedAt":"2026-05-15T20:52:50.254889Z"},{"id":938,"userId":"compromised-user-mocksiemkasperskyedr-18210","actionType":"BLOCK","incidentId":18210,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18210-iam-block","performedAt":"2026-05-15T20:52:49.371937Z"},{"id":937,"userId":"compromised-user-mocksiemkasperskyedr-18208","actionType":"BLOCK","incidentId":18208,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18208-iam-block","performedAt":"2026-05-15T20:52:49.284325Z"},{"id":936,"userId":"compromised-user-mocksiemkasperskyedr-18207","actionType":"BLOCK","incidentId":18207,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18207-iam-block","performedAt":"2026-05-15T20:52:49.201646Z"},{"id":935,"userId":"compromised-user-mocksiemkasperskyedr-18201","actionType":"BLOCK","incidentId":18201,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18201-iam-block","performedAt":"2026-05-15T20:52:48.919885Z"},{"id":934,"userId":"compromised-user-mocksiemkasperskyedr-18197","actionType":"BLOCK","incidentId":18197,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18197-iam-block","performedAt":"2026-05-15T20:52:48.748380Z"},{"id":933,"userId":"compromised-user-mocksiemkasperskyedr-18165","actionType":"BLOCK","incidentId":18165,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18165-iam-block","performedAt":"2026-05-15T20:52:47.975461Z"},{"id":932,"userId":"compromised-user-mocksiemkasperskyedr-18160","actionType":"BLOCK","incidentId":18160,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18160-iam-block","performedAt":"2026-05-15T20:52:47.827115Z"},{"id":931,"userId":"compromised-user-mocksiemkasperskyedr-18127","actionType":"BLOCK","incidentId":18127,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18127-iam-block","performedAt":"2026-05-15T20:52:46.977471Z"},{"id":930,"userId":"compromised-user-mocksiemkasperskyedr-18113","actionType":"BLOCK","incidentId":18113,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18113-iam-block","performedAt":"2026-05-15T20:52:46.686751Z"},{"id":929,"userId":"compromised-user-mocksiemkasperskyedr-18103","actionType":"BLOCK","incidentId":18103,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18103-iam-block","performedAt":"2026-05-15T20:52:46.493295Z"},{"id":928,"userId":"compromised-user-mocksiemkasperskyedr-18093","actionType":"BLOCK","incidentId":18093,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18093-iam-block","performedAt":"2026-05-15T20:52:46.277694Z"},{"id":927,"userId":"compromised-user-mocksiemkasperskyedr-18087","actionType":"BLOCK","incidentId":18087,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18087-iam-block","performedAt":"2026-05-15T20:52:46.153574Z"},{"id":926,"userId":"compromised-user-mocksiemkasperskyedr-18071","actionType":"BLOCK","incidentId":18071,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18071-iam-block","performedAt":"2026-05-15T20:52:45.720151Z"},{"id":925,"userId":"compromised-user-mocksiemkasperskyedr-18059","actionType":"BLOCK","incidentId":18059,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18059-iam-block","performedAt":"2026-05-15T20:52:45.339137Z"},{"id":924,"userId":"compromised-user-mocksiemkasperskyedr-18052","actionType":"BLOCK","incidentId":18052,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18052-iam-block","performedAt":"2026-05-15T20:52:45.199655Z"},{"id":923,"userId":"compromised-user-mocksiemkasperskyedr-18044","actionType":"BLOCK","incidentId":18044,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18044-iam-block","performedAt":"2026-05-15T20:52:45.017023Z"},{"id":922,"userId":"compromised-user-mocksiemkasperskyedr-18031","actionType":"BLOCK","incidentId":18031,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18031-iam-block","performedAt":"2026-05-15T20:52:44.667634Z"},{"id":921,"userId":"compromised-user-mocksiemkasperskyedr-18023","actionType":"BLOCK","incidentId":18023,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18023-iam-block","performedAt":"2026-05-15T20:52:44.440537Z"},{"id":920,"userId":"compromised-user-mocksiemkasperskyedr-18016","actionType":"BLOCK","incidentId":18016,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18016-iam-block","performedAt":"2026-05-15T20:52:44.299099Z"},{"id":919,"userId":"compromised-user-mocksiemkasperskyedr-18014","actionType":"BLOCK","incidentId":18014,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-18014-iam-block","performedAt":"2026-05-15T20:52:44.259001Z"},{"id":918,"userId":"compromised-user-mocksiemkasperskyedr-18013","actionType":"BLOCK","incidentId":18013,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18013-iam-block","performedAt":"2026-05-15T20:52:44.228961Z"},{"id":917,"userId":"compromised-user-mocksiemkasperskyedr-18010","actionType":"BLOCK","incidentId":18010,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-18010-iam-block","performedAt":"2026-05-15T20:52:44.169136Z"},{"id":916,"userId":"compromised-user-mocksiemkasperskyedr-17990","actionType":"BLOCK","incidentId":17990,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17990-iam-block","performedAt":"2026-05-15T20:52:43.758061Z"},{"id":915,"userId":"compromised-user-mocksiemkasperskyedr-17989","actionType":"BLOCK","incidentId":17989,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17989-iam-block","performedAt":"2026-05-15T20:52:43.728650Z"},{"id":914,"userId":"compromised-user-mocksiemkasperskyedr-17984","actionType":"BLOCK","incidentId":17984,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17984-iam-block","performedAt":"2026-05-15T20:52:43.612407Z"},{"id":913,"userId":"compromised-user-mocksiemkasperskyedr-17975","actionType":"BLOCK","incidentId":17975,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17975-iam-block","performedAt":"2026-05-15T20:52:43.403426Z"},{"id":912,"userId":"compromised-user-mocksiemkasperskyedr-17964","actionType":"BLOCK","incidentId":17964,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17964-iam-block","performedAt":"2026-05-15T20:52:43.134895Z"},{"id":911,"userId":"compromised-user-mocksiemkasperskyedr-17946","actionType":"BLOCK","incidentId":17946,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17946-iam-block","performedAt":"2026-05-15T20:52:42.763601Z"},{"id":910,"userId":"compromised-user-mocksiemkasperskyedr-17943","actionType":"BLOCK","incidentId":17943,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17943-iam-block","performedAt":"2026-05-15T20:52:42.700570Z"},{"id":909,"userId":"compromised-user-mocksiemkasperskyedr-17938","actionType":"BLOCK","incidentId":17938,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17938-iam-block","performedAt":"2026-05-15T20:52:42.609587Z"},{"id":908,"userId":"compromised-user-mocksiemkasperskyedr-17936","actionType":"BLOCK","incidentId":17936,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17936-iam-block","performedAt":"2026-05-15T20:52:42.563412Z"},{"id":907,"userId":"compromised-user-mocksiemkasperskyedr-17917","actionType":"BLOCK","incidentId":17917,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17917-iam-block","performedAt":"2026-05-15T20:52:42.158614Z"},{"id":906,"userId":"compromised-user-mocksiemkasperskyedr-17896","actionType":"BLOCK","incidentId":17896,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17896-iam-block","performedAt":"2026-05-15T20:52:41.704001Z"},{"id":905,"userId":"compromised-user-mocksiemkasperskyedr-17894","actionType":"BLOCK","incidentId":17894,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17894-iam-block","performedAt":"2026-05-15T20:52:41.653464Z"},{"id":904,"userId":"compromised-user-mocksiemkasperskyedr-17891","actionType":"BLOCK","incidentId":17891,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17891-iam-block","performedAt":"2026-05-15T20:52:41.579874Z"},{"id":903,"userId":"compromised-user-mocksiemkasperskyedr-17872","actionType":"BLOCK","incidentId":17872,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17872-iam-block","performedAt":"2026-05-15T20:52:41.145876Z"},{"id":902,"userId":"compromised-user-mocksiemkasperskyedr-17860","actionType":"BLOCK","incidentId":17860,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17860-iam-block","performedAt":"2026-05-15T20:52:40.762070Z"},{"id":901,"userId":"compromised-user-mocksiemkasperskyedr-17855","actionType":"BLOCK","incidentId":17855,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17855-iam-block","performedAt":"2026-05-15T20:52:40.648937Z"},{"id":900,"userId":"compromised-user-mocksiemkasperskyedr-17841","actionType":"BLOCK","incidentId":17841,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17841-iam-block","performedAt":"2026-05-15T20:52:40.344067Z"},{"id":899,"userId":"compromised-user-mocksiemkasperskyedr-17839","actionType":"BLOCK","incidentId":17839,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17839-iam-block","performedAt":"2026-05-15T20:52:40.284453Z"},{"id":898,"userId":"compromised-user-mocksiemkasperskyedr-17830","actionType":"BLOCK","incidentId":17830,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17830-iam-block","performedAt":"2026-05-15T20:52:40.081717Z"},{"id":897,"userId":"compromised-user-mocksiemkasperskyedr-17797","actionType":"BLOCK","incidentId":17797,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17797-iam-block","performedAt":"2026-05-15T20:52:39.192928Z"},{"id":896,"userId":"compromised-user-mocksiemkasperskyedr-17794","actionType":"BLOCK","incidentId":17794,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17794-iam-block","performedAt":"2026-05-15T20:52:39.094132Z"},{"id":895,"userId":"compromised-user-mocksiemkasperskyedr-17793","actionType":"BLOCK","incidentId":17793,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17793-iam-block","performedAt":"2026-05-15T20:52:39.021921Z"},{"id":894,"userId":"compromised-user-mocksiemkasperskyedr-17783","actionType":"BLOCK","incidentId":17783,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17783-iam-block","performedAt":"2026-05-15T20:52:38.795703Z"},{"id":893,"userId":"compromised-user-mocksiemkasperskyedr-17764","actionType":"BLOCK","incidentId":17764,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17764-iam-block","performedAt":"2026-05-15T20:52:38.013716Z"},{"id":892,"userId":"compromised-user-mocksiemkasperskyedr-17746","actionType":"BLOCK","incidentId":17746,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17746-iam-block","performedAt":"2026-05-15T20:52:37.654902Z"},{"id":891,"userId":"compromised-user-mocksiemkasperskyedr-17710","actionType":"BLOCK","incidentId":17710,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17710-iam-block","performedAt":"2026-05-15T20:52:36.773418Z"},{"id":890,"userId":"compromised-user-mocksiemkasperskyedr-17705","actionType":"BLOCK","incidentId":17705,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17705-iam-block","performedAt":"2026-05-15T20:52:36.681919Z"},{"id":889,"userId":"compromised-user-mocksiemkasperskyedr-17681","actionType":"BLOCK","incidentId":17681,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17681-iam-block","performedAt":"2026-05-15T20:52:36.169829Z"},{"id":888,"userId":"compromised-user-mocksiemkasperskyedr-17646","actionType":"BLOCK","incidentId":17646,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17646-iam-block","performedAt":"2026-05-15T20:52:35.544638Z"},{"id":887,"userId":"compromised-user-mocksiemkasperskyedr-17635","actionType":"BLOCK","incidentId":17635,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17635-iam-block","performedAt":"2026-05-15T20:52:35.298764Z"},{"id":886,"userId":"compromised-user-mocksiemkasperskyedr-17626","actionType":"BLOCK","incidentId":17626,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17626-iam-block","performedAt":"2026-05-15T20:52:34.926819Z"},{"id":885,"userId":"compromised-user-mocksiemkasperskyedr-17619","actionType":"BLOCK","incidentId":17619,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17619-iam-block","performedAt":"2026-05-15T20:52:34.684778Z"},{"id":884,"userId":"compromised-user-mocksiemkasperskyedr-17613","actionType":"BLOCK","incidentId":17613,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17613-iam-block","performedAt":"2026-05-15T20:52:34.540620Z"},{"id":883,"userId":"compromised-user-mocksiemkasperskyedr-17611","actionType":"BLOCK","incidentId":17611,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17611-iam-block","performedAt":"2026-05-15T20:52:34.474857Z"},{"id":882,"userId":"compromised-user-mocksiemkasperskyedr-17574","actionType":"BLOCK","incidentId":17574,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17574-iam-block","performedAt":"2026-05-15T20:52:33.633371Z"},{"id":881,"userId":"compromised-user-mocksiemkasperskyedr-17570","actionType":"BLOCK","incidentId":17570,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17570-iam-block","performedAt":"2026-05-15T20:52:33.536939Z"},{"id":880,"userId":"compromised-user-mocksiemkasperskyedr-17559","actionType":"BLOCK","incidentId":17559,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17559-iam-block","performedAt":"2026-05-15T20:52:33.310696Z"},{"id":879,"userId":"compromised-user-mocksiemkasperskyedr-17551","actionType":"BLOCK","incidentId":17551,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17551-iam-block","performedAt":"2026-05-15T20:52:33.153045Z"},{"id":878,"userId":"compromised-user-mocksiemkasperskyedr-17547","actionType":"BLOCK","incidentId":17547,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17547-iam-block","performedAt":"2026-05-15T20:52:33.068475Z"},{"id":877,"userId":"compromised-user-mocksiemkasperskyedr-17532","actionType":"BLOCK","incidentId":17532,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17532-iam-block","performedAt":"2026-05-15T20:52:32.735641Z"},{"id":876,"userId":"compromised-user-mocksiemkasperskyedr-17531","actionType":"BLOCK","incidentId":17531,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17531-iam-block","performedAt":"2026-05-15T20:52:32.705804Z"},{"id":875,"userId":"compromised-user-mocksiemkasperskyedr-17529","actionType":"BLOCK","incidentId":17529,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17529-iam-block","performedAt":"2026-05-15T20:52:32.662236Z"},{"id":874,"userId":"compromised-user-mocksiemkasperskyedr-17508","actionType":"BLOCK","incidentId":17508,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17508-iam-block","performedAt":"2026-05-15T20:52:32.133735Z"},{"id":873,"userId":"compromised-user-mocksiemkasperskyedr-17493","actionType":"BLOCK","incidentId":17493,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17493-iam-block","performedAt":"2026-05-15T20:52:31.723359Z"},{"id":872,"userId":"compromised-user-mocksiemkasperskyedr-17487","actionType":"BLOCK","incidentId":17487,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17487-iam-block","performedAt":"2026-05-15T20:52:31.543643Z"},{"id":871,"userId":"compromised-user-mocksiemkasperskyedr-17478","actionType":"BLOCK","incidentId":17478,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17478-iam-block","performedAt":"2026-05-15T20:52:31.354601Z"},{"id":870,"userId":"compromised-user-mocksiemkasperskyedr-17469","actionType":"BLOCK","incidentId":17469,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17469-iam-block","performedAt":"2026-05-15T20:52:31.158034Z"},{"id":869,"userId":"compromised-user-mocksiemkasperskyedr-17464","actionType":"BLOCK","incidentId":17464,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17464-iam-block","performedAt":"2026-05-15T20:52:31.070389Z"},{"id":868,"userId":"compromised-user-mocksiemkasperskyedr-17460","actionType":"BLOCK","incidentId":17460,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17460-iam-block","performedAt":"2026-05-15T20:52:30.963086Z"},{"id":867,"userId":"compromised-user-mocksiemkasperskyedr-17458","actionType":"BLOCK","incidentId":17458,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17458-iam-block","performedAt":"2026-05-15T20:52:30.919123Z"},{"id":866,"userId":"compromised-user-mocksiemkasperskyedr-17415","actionType":"BLOCK","incidentId":17415,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17415-iam-block","performedAt":"2026-05-15T20:52:30.089001Z"},{"id":865,"userId":"compromised-user-mocksiemkasperskyedr-17405","actionType":"BLOCK","incidentId":17405,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17405-iam-block","performedAt":"2026-05-15T20:52:29.886376Z"},{"id":864,"userId":"compromised-user-mocksiemkasperskyedr-17387","actionType":"BLOCK","incidentId":17387,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17387-iam-block","performedAt":"2026-05-15T20:52:29.498648Z"},{"id":863,"userId":"compromised-user-mocksiemkasperskyedr-17379","actionType":"BLOCK","incidentId":17379,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17379-iam-block","performedAt":"2026-05-15T20:52:29.328771Z"},{"id":862,"userId":"compromised-user-mocksiemkasperskyedr-17350","actionType":"BLOCK","incidentId":17350,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17350-iam-block","performedAt":"2026-05-15T20:52:28.795127Z"},{"id":861,"userId":"compromised-user-mocksiemkasperskyedr-17338","actionType":"BLOCK","incidentId":17338,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17338-iam-block","performedAt":"2026-05-15T20:52:28.540123Z"},{"id":860,"userId":"compromised-user-mocksiemkasperskyedr-17337","actionType":"BLOCK","incidentId":17337,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17337-iam-block","performedAt":"2026-05-15T20:52:28.509146Z"},{"id":859,"userId":"compromised-user-mocksiemkasperskyedr-17324","actionType":"BLOCK","incidentId":17324,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17324-iam-block","performedAt":"2026-05-15T20:52:28.202865Z"},{"id":858,"userId":"compromised-user-mocksiemkasperskyedr-17322","actionType":"BLOCK","incidentId":17322,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17322-iam-block","performedAt":"2026-05-15T20:52:28.112573Z"},{"id":857,"userId":"compromised-user-mocksiemkasperskyedr-17308","actionType":"BLOCK","incidentId":17308,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17308-iam-block","performedAt":"2026-05-15T20:52:27.783003Z"},{"id":856,"userId":"compromised-user-mocksiemkasperskyedr-17301","actionType":"BLOCK","incidentId":17301,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17301-iam-block","performedAt":"2026-05-15T20:52:27.654282Z"},{"id":855,"userId":"compromised-user-mocksiemkasperskyedr-17295","actionType":"BLOCK","incidentId":17295,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17295-iam-block","performedAt":"2026-05-15T20:52:27.511095Z"},{"id":854,"userId":"compromised-user-mocksiemkasperskyedr-17290","actionType":"BLOCK","incidentId":17290,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17290-iam-block","performedAt":"2026-05-15T20:52:27.382473Z"},{"id":853,"userId":"compromised-user-mocksiemkasperskyedr-17255","actionType":"BLOCK","incidentId":17255,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17255-iam-block","performedAt":"2026-05-15T20:52:26.725684Z"},{"id":852,"userId":"compromised-user-mocksiemkasperskyedr-17228","actionType":"BLOCK","incidentId":17228,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17228-iam-block","performedAt":"2026-05-15T20:52:26.188792Z"},{"id":851,"userId":"compromised-user-mocksiemkasperskyedr-17218","actionType":"BLOCK","incidentId":17218,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17218-iam-block","performedAt":"2026-05-15T20:52:25.932155Z"},{"id":850,"userId":"compromised-user-mocksiemkasperskyedr-17205","actionType":"BLOCK","incidentId":17205,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17205-iam-block","performedAt":"2026-05-15T20:52:25.699487Z"},{"id":849,"userId":"compromised-user-mocksiemkasperskyedr-17204","actionType":"BLOCK","incidentId":17204,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17204-iam-block","performedAt":"2026-05-15T20:52:25.673064Z"},{"id":848,"userId":"compromised-user-mocksiemkasperskyedr-17199","actionType":"BLOCK","incidentId":17199,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17199-iam-block","performedAt":"2026-05-15T20:52:25.554536Z"},{"id":847,"userId":"compromised-user-mocksiemkasperskyedr-17186","actionType":"BLOCK","incidentId":17186,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17186-iam-block","performedAt":"2026-05-15T20:52:25.294055Z"},{"id":846,"userId":"compromised-user-mocksiemkasperskyedr-17170","actionType":"BLOCK","incidentId":17170,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17170-iam-block","performedAt":"2026-05-15T20:52:25.009554Z"},{"id":845,"userId":"compromised-user-mocksiemkasperskyedr-17165","actionType":"BLOCK","incidentId":17165,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17165-iam-block","performedAt":"2026-05-15T20:52:24.904631Z"},{"id":844,"userId":"compromised-user-mocksiemkasperskyedr-17136","actionType":"BLOCK","incidentId":17136,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17136-iam-block","performedAt":"2026-05-15T20:52:24.231139Z"},{"id":843,"userId":"compromised-user-mocksiemkasperskyedr-17112","actionType":"BLOCK","incidentId":17112,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17112-iam-block","performedAt":"2026-05-15T20:52:23.722690Z"},{"id":842,"userId":"compromised-user-mocksiemkasperskyedr-17106","actionType":"BLOCK","incidentId":17106,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17106-iam-block","performedAt":"2026-05-15T20:52:23.581238Z"},{"id":841,"userId":"compromised-user-mocksiemkasperskyedr-17095","actionType":"BLOCK","incidentId":17095,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17095-iam-block","performedAt":"2026-05-15T20:52:23.334189Z"},{"id":840,"userId":"compromised-user-mocksiemkasperskyedr-17073","actionType":"BLOCK","incidentId":17073,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17073-iam-block","performedAt":"2026-05-15T20:52:22.839592Z"},{"id":839,"userId":"compromised-user-mocksiemkasperskyedr-17072","actionType":"BLOCK","incidentId":17072,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17072-iam-block","performedAt":"2026-05-15T20:52:22.803932Z"},{"id":838,"userId":"compromised-user-mocksiemkasperskyedr-17058","actionType":"BLOCK","incidentId":17058,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17058-iam-block","performedAt":"2026-05-15T20:52:22.539082Z"},{"id":837,"userId":"compromised-user-mocksiemkasperskyedr-17051","actionType":"BLOCK","incidentId":17051,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17051-iam-block","performedAt":"2026-05-15T20:52:22.400044Z"},{"id":836,"userId":"compromised-user-mocksiemkasperskyedr-17050","actionType":"BLOCK","incidentId":17050,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17050-iam-block","performedAt":"2026-05-15T20:52:22.377009Z"},{"id":835,"userId":"compromised-user-mocksiemkasperskyedr-17037","actionType":"BLOCK","incidentId":17037,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17037-iam-block","performedAt":"2026-05-15T20:52:22.136527Z"},{"id":834,"userId":"compromised-user-mocksiemkasperskyedr-17036","actionType":"BLOCK","incidentId":17036,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17036-iam-block","performedAt":"2026-05-15T20:52:22.093326Z"},{"id":833,"userId":"compromised-user-mocksiemkasperskyedr-17027","actionType":"BLOCK","incidentId":17027,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-17027-iam-block","performedAt":"2026-05-15T20:52:21.913490Z"},{"id":832,"userId":"compromised-user-mocksiemkasperskyedr-17026","actionType":"BLOCK","incidentId":17026,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-17026-iam-block","performedAt":"2026-05-15T20:52:21.890387Z"},{"id":831,"userId":"compromised-user-mocksiemkasperskyedr-16998","actionType":"BLOCK","incidentId":16998,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16998-iam-block","performedAt":"2026-05-15T20:52:21.360384Z"},{"id":830,"userId":"compromised-user-mocksiemkasperskyedr-16994","actionType":"BLOCK","incidentId":16994,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16994-iam-block","performedAt":"2026-05-15T20:52:21.254984Z"},{"id":829,"userId":"compromised-user-mocksiemkasperskyedr-16992","actionType":"BLOCK","incidentId":16992,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16992-iam-block","performedAt":"2026-05-15T20:52:21.208482Z"},{"id":828,"userId":"compromised-user-mocksiemkasperskyedr-16989","actionType":"BLOCK","incidentId":16989,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16989-iam-block","performedAt":"2026-05-15T20:52:21.126698Z"},{"id":827,"userId":"compromised-user-mocksiemkasperskyedr-16974","actionType":"BLOCK","incidentId":16974,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16974-iam-block","performedAt":"2026-05-15T20:52:20.786878Z"},{"id":826,"userId":"compromised-user-mocksiemkasperskyedr-16934","actionType":"BLOCK","incidentId":16934,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16934-iam-block","performedAt":"2026-05-15T20:52:19.943427Z"},{"id":825,"userId":"compromised-user-mocksiemkasperskyedr-16919","actionType":"BLOCK","incidentId":16919,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16919-iam-block","performedAt":"2026-05-15T20:52:19.614856Z"},{"id":824,"userId":"compromised-user-mocksiemkasperskyedr-16885","actionType":"BLOCK","incidentId":16885,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16885-iam-block","performedAt":"2026-05-15T20:52:18.833679Z"},{"id":823,"userId":"compromised-user-mocksiemkasperskyedr-16877","actionType":"BLOCK","incidentId":16877,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16877-iam-block","performedAt":"2026-05-15T20:52:18.672709Z"},{"id":822,"userId":"compromised-user-mocksiemkasperskyedr-16852","actionType":"BLOCK","incidentId":16852,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16852-iam-block","performedAt":"2026-05-15T20:52:18.200255Z"},{"id":821,"userId":"compromised-user-mocksiemkasperskyedr-16840","actionType":"BLOCK","incidentId":16840,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16840-iam-block","performedAt":"2026-05-15T20:52:17.875564Z"},{"id":820,"userId":"compromised-user-mocksiemkasperskyedr-16835","actionType":"BLOCK","incidentId":16835,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16835-iam-block","performedAt":"2026-05-15T20:52:17.755510Z"},{"id":819,"userId":"compromised-user-mocksiemkasperskyedr-16804","actionType":"BLOCK","incidentId":16804,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16804-iam-block","performedAt":"2026-05-15T20:52:17.151327Z"},{"id":818,"userId":"compromised-user-mocksiemkasperskyedr-16802","actionType":"BLOCK","incidentId":16802,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16802-iam-block","performedAt":"2026-05-15T20:52:17.081023Z"},{"id":817,"userId":"compromised-user-mocksiemkasperskyedr-16787","actionType":"BLOCK","incidentId":16787,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16787-iam-block","performedAt":"2026-05-15T20:52:16.382441Z"},{"id":816,"userId":"compromised-user-mocksiemkasperskyedr-16728","actionType":"BLOCK","incidentId":16728,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16728-iam-block","performedAt":"2026-05-15T20:52:14.798680Z"},{"id":815,"userId":"compromised-user-mocksiemkasperskyedr-16724","actionType":"BLOCK","incidentId":16724,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16724-iam-block","performedAt":"2026-05-15T20:52:14.723974Z"},{"id":814,"userId":"compromised-user-mocksiemkasperskyedr-16721","actionType":"BLOCK","incidentId":16721,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16721-iam-block","performedAt":"2026-05-15T20:52:14.660981Z"},{"id":813,"userId":"compromised-user-mocksiemkasperskyedr-16717","actionType":"BLOCK","incidentId":16717,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16717-iam-block","performedAt":"2026-05-15T20:52:14.570679Z"},{"id":812,"userId":"compromised-user-mocksiemkasperskyedr-16702","actionType":"BLOCK","incidentId":16702,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16702-iam-block","performedAt":"2026-05-15T20:52:14.305898Z"},{"id":811,"userId":"compromised-user-mocksiemkasperskyedr-16694","actionType":"BLOCK","incidentId":16694,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16694-iam-block","performedAt":"2026-05-15T20:52:14.181701Z"},{"id":810,"userId":"compromised-user-mocksiemkasperskyedr-16672","actionType":"BLOCK","incidentId":16672,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16672-iam-block","performedAt":"2026-05-15T20:52:13.781116Z"},{"id":809,"userId":"compromised-user-mocksiemkasperskyedr-16667","actionType":"BLOCK","incidentId":16667,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16667-iam-block","performedAt":"2026-05-15T20:52:13.697080Z"},{"id":808,"userId":"compromised-user-mocksiemkasperskyedr-16666","actionType":"BLOCK","incidentId":16666,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16666-iam-block","performedAt":"2026-05-15T20:52:13.669102Z"},{"id":807,"userId":"compromised-user-mocksiemkasperskyedr-16660","actionType":"BLOCK","incidentId":16660,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16660-iam-block","performedAt":"2026-05-15T20:52:13.525015Z"},{"id":806,"userId":"compromised-user-mocksiemkasperskyedr-16622","actionType":"BLOCK","incidentId":16622,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16622-iam-block","performedAt":"2026-05-15T20:52:12.758226Z"},{"id":805,"userId":"compromised-user-mocksiemkasperskyedr-16595","actionType":"BLOCK","incidentId":16595,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16595-iam-block","performedAt":"2026-05-15T20:52:12.000538Z"},{"id":804,"userId":"compromised-user-mocksiemkasperskyedr-16579","actionType":"BLOCK","incidentId":16579,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16579-iam-block","performedAt":"2026-05-15T20:52:11.523056Z"},{"id":803,"userId":"compromised-user-mocksiemkasperskyedr-16573","actionType":"BLOCK","incidentId":16573,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16573-iam-block","performedAt":"2026-05-15T20:52:11.385744Z"},{"id":802,"userId":"compromised-user-mocksiemkasperskyedr-16564","actionType":"BLOCK","incidentId":16564,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16564-iam-block","performedAt":"2026-05-15T20:52:11.177719Z"},{"id":801,"userId":"compromised-user-mocksiemkasperskyedr-16538","actionType":"BLOCK","incidentId":16538,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16538-iam-block","performedAt":"2026-05-15T20:52:10.670022Z"},{"id":800,"userId":"compromised-user-mocksiemkasperskyedr-16530","actionType":"BLOCK","incidentId":16530,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16530-iam-block","performedAt":"2026-05-15T20:52:10.509876Z"},{"id":799,"userId":"compromised-user-mocksiemkasperskyedr-16525","actionType":"BLOCK","incidentId":16525,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16525-iam-block","performedAt":"2026-05-15T20:52:10.396998Z"},{"id":798,"userId":"compromised-user-mocksiemkasperskyedr-16517","actionType":"BLOCK","incidentId":16517,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16517-iam-block","performedAt":"2026-05-15T20:52:10.223011Z"},{"id":797,"userId":"compromised-user-mocksiemkasperskyedr-16515","actionType":"BLOCK","incidentId":16515,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16515-iam-block","performedAt":"2026-05-15T20:52:10.182729Z"},{"id":796,"userId":"compromised-user-mocksiemkasperskyedr-16480","actionType":"BLOCK","incidentId":16480,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16480-iam-block","performedAt":"2026-05-15T20:52:09.449897Z"},{"id":795,"userId":"compromised-user-mocksiemkasperskyedr-16479","actionType":"BLOCK","incidentId":16479,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16479-iam-block","performedAt":"2026-05-15T20:52:09.416588Z"},{"id":794,"userId":"compromised-user-mocksiemkasperskyedr-16472","actionType":"BLOCK","incidentId":16472,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16472-iam-block","performedAt":"2026-05-15T20:52:09.285745Z"},{"id":793,"userId":"compromised-user-mocksiemkasperskyedr-16464","actionType":"BLOCK","incidentId":16464,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16464-iam-block","performedAt":"2026-05-15T20:52:09.089808Z"},{"id":792,"userId":"compromised-user-mocksiemkasperskyedr-16418","actionType":"BLOCK","incidentId":16418,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16418-iam-block","performedAt":"2026-05-15T20:52:08.203463Z"},{"id":791,"userId":"compromised-user-mocksiemkasperskyedr-16413","actionType":"BLOCK","incidentId":16413,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16413-iam-block","performedAt":"2026-05-15T20:52:08.091998Z"},{"id":790,"userId":"compromised-user-mocksiemkasperskyedr-16393","actionType":"BLOCK","incidentId":16393,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16393-iam-block","performedAt":"2026-05-15T20:52:07.659127Z"},{"id":789,"userId":"compromised-user-mocksiemkasperskyedr-16392","actionType":"BLOCK","incidentId":16392,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16392-iam-block","performedAt":"2026-05-15T20:52:07.619364Z"},{"id":788,"userId":"compromised-user-mocksiemkasperskyedr-16384","actionType":"BLOCK","incidentId":16384,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16384-iam-block","performedAt":"2026-05-15T20:52:07.484498Z"},{"id":787,"userId":"compromised-user-mocksiemkasperskyedr-16367","actionType":"BLOCK","incidentId":16367,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16367-iam-block","performedAt":"2026-05-15T20:52:07.174150Z"},{"id":786,"userId":"compromised-user-mocksiemkasperskyedr-16340","actionType":"BLOCK","incidentId":16340,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16340-iam-block","performedAt":"2026-05-15T20:52:06.686886Z"},{"id":785,"userId":"compromised-user-mocksiemkasperskyedr-16318","actionType":"BLOCK","incidentId":16318,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16318-iam-block","performedAt":"2026-05-15T20:52:06.068647Z"},{"id":784,"userId":"compromised-user-mocksiemkasperskyedr-16310","actionType":"BLOCK","incidentId":16310,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16310-iam-block","performedAt":"2026-05-15T20:52:05.709307Z"},{"id":783,"userId":"compromised-user-mocksiemkasperskyedr-16287","actionType":"BLOCK","incidentId":16287,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16287-iam-block","performedAt":"2026-05-15T20:52:05.210217Z"},{"id":782,"userId":"compromised-user-mocksiemkasperskyedr-16273","actionType":"BLOCK","incidentId":16273,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16273-iam-block","performedAt":"2026-05-15T20:52:04.945785Z"},{"id":781,"userId":"compromised-user-mocksiemkasperskyedr-16209","actionType":"BLOCK","incidentId":16209,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16209-iam-block","performedAt":"2026-05-15T20:52:03.747367Z"},{"id":780,"userId":"compromised-user-mocksiemkasperskyedr-16207","actionType":"BLOCK","incidentId":16207,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16207-iam-block","performedAt":"2026-05-15T20:52:03.705734Z"},{"id":779,"userId":"compromised-user-mocksiemkasperskyedr-16202","actionType":"BLOCK","incidentId":16202,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16202-iam-block","performedAt":"2026-05-15T20:52:03.572120Z"},{"id":778,"userId":"compromised-user-mocksiemkasperskyedr-16187","actionType":"BLOCK","incidentId":16187,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16187-iam-block","performedAt":"2026-05-15T20:52:03.027966Z"},{"id":777,"userId":"compromised-user-mocksiemkasperskyedr-16130","actionType":"BLOCK","incidentId":16130,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16130-iam-block","performedAt":"2026-05-15T20:52:01.675589Z"},{"id":776,"userId":"compromised-user-mocksiemkasperskyedr-16032","actionType":"BLOCK","incidentId":16032,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16032-iam-block","performedAt":"2026-05-15T20:51:59.617619Z"},{"id":775,"userId":"compromised-user-mocksiemkasperskyedr-16024","actionType":"BLOCK","incidentId":16024,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16024-iam-block","performedAt":"2026-05-15T20:51:59.387926Z"},{"id":774,"userId":"compromised-user-mocksiemkasperskyedr-16021","actionType":"BLOCK","incidentId":16021,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-16021-iam-block","performedAt":"2026-05-15T20:51:59.298389Z"},{"id":773,"userId":"compromised-user-mocksiemkasperskyedr-16020","actionType":"BLOCK","incidentId":16020,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-16020-iam-block","performedAt":"2026-05-15T20:51:59.268013Z"},{"id":772,"userId":"compromised-user-mocksiemkasperskyedr-15997","actionType":"BLOCK","incidentId":15997,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15997-iam-block","performedAt":"2026-05-15T20:51:58.665252Z"},{"id":771,"userId":"compromised-user-mocksiemkasperskyedr-15994","actionType":"BLOCK","incidentId":15994,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15994-iam-block","performedAt":"2026-05-15T20:51:58.587825Z"},{"id":770,"userId":"compromised-user-mocksiemkasperskyedr-15982","actionType":"BLOCK","incidentId":15982,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15982-iam-block","performedAt":"2026-05-15T20:51:58.335964Z"},{"id":769,"userId":"compromised-user-mocksiemkasperskyedr-15971","actionType":"BLOCK","incidentId":15971,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15971-iam-block","performedAt":"2026-05-15T20:51:58.065372Z"},{"id":768,"userId":"compromised-user-mocksiemkasperskyedr-15906","actionType":"BLOCK","incidentId":15906,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15906-iam-block","performedAt":"2026-05-15T20:51:56.726512Z"},{"id":767,"userId":"compromised-user-mocksiemkasperskyedr-15902","actionType":"BLOCK","incidentId":15902,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15902-iam-block","performedAt":"2026-05-15T20:51:56.616922Z"},{"id":766,"userId":"compromised-user-mocksiemkasperskyedr-15874","actionType":"BLOCK","incidentId":15874,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15874-iam-block","performedAt":"2026-05-15T20:51:55.908955Z"},{"id":765,"userId":"compromised-user-mocksiemkasperskyedr-15861","actionType":"BLOCK","incidentId":15861,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15861-iam-block","performedAt":"2026-05-15T20:51:55.612943Z"},{"id":764,"userId":"compromised-user-mocksiemkasperskyedr-15851","actionType":"BLOCK","incidentId":15851,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15851-iam-block","performedAt":"2026-05-15T20:51:55.378846Z"},{"id":763,"userId":"compromised-user-mocksiemkasperskyedr-15825","actionType":"BLOCK","incidentId":15825,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15825-iam-block","performedAt":"2026-05-15T20:51:54.731627Z"},{"id":762,"userId":"compromised-user-mocksiemkasperskyedr-15810","actionType":"BLOCK","incidentId":15810,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15810-iam-block","performedAt":"2026-05-15T20:51:54.439881Z"},{"id":761,"userId":"compromised-user-mocksiemkasperskyedr-15807","actionType":"BLOCK","incidentId":15807,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15807-iam-block","performedAt":"2026-05-15T20:51:54.382354Z"},{"id":760,"userId":"compromised-user-mocksiemkasperskyedr-15802","actionType":"BLOCK","incidentId":15802,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15802-iam-block","performedAt":"2026-05-15T20:51:54.269408Z"},{"id":759,"userId":"compromised-user-mocksiemkasperskyedr-15794","actionType":"BLOCK","incidentId":15794,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15794-iam-block","performedAt":"2026-05-15T20:51:54.109441Z"},{"id":758,"userId":"compromised-user-mocksiemkasperskyedr-15792","actionType":"BLOCK","incidentId":15792,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15792-iam-block","performedAt":"2026-05-15T20:51:54.039769Z"},{"id":757,"userId":"compromised-user-mocksiemkasperskyedr-15781","actionType":"BLOCK","incidentId":15781,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15781-iam-block","performedAt":"2026-05-15T20:51:53.758747Z"},{"id":756,"userId":"compromised-user-mocksiemkasperskyedr-15776","actionType":"BLOCK","incidentId":15776,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15776-iam-block","performedAt":"2026-05-15T20:51:53.669635Z"},{"id":755,"userId":"compromised-user-mocksiemkasperskyedr-15764","actionType":"BLOCK","incidentId":15764,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15764-iam-block","performedAt":"2026-05-15T20:51:53.433727Z"},{"id":754,"userId":"compromised-user-mocksiemkasperskyedr-15763","actionType":"BLOCK","incidentId":15763,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15763-iam-block","performedAt":"2026-05-15T20:51:53.402920Z"},{"id":753,"userId":"compromised-user-mocksiemkasperskyedr-15757","actionType":"BLOCK","incidentId":15757,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15757-iam-block","performedAt":"2026-05-15T20:51:53.222909Z"},{"id":752,"userId":"compromised-user-mocksiemkasperskyedr-15733","actionType":"BLOCK","incidentId":15733,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15733-iam-block","performedAt":"2026-05-15T20:51:52.743075Z"},{"id":751,"userId":"compromised-user-mocksiemkasperskyedr-15727","actionType":"BLOCK","incidentId":15727,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15727-iam-block","performedAt":"2026-05-15T20:51:52.621654Z"},{"id":750,"userId":"compromised-user-mocksiemkasperskyedr-15660","actionType":"BLOCK","incidentId":15660,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15660-iam-block","performedAt":"2026-05-15T20:51:51.166781Z"},{"id":749,"userId":"compromised-user-mocksiemkasperskyedr-15658","actionType":"BLOCK","incidentId":15658,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15658-iam-block","performedAt":"2026-05-15T20:51:51.092133Z"},{"id":748,"userId":"compromised-user-mocksiemkasperskyedr-15653","actionType":"BLOCK","incidentId":15653,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15653-iam-block","performedAt":"2026-05-15T20:51:50.932129Z"},{"id":747,"userId":"compromised-user-mocksiemkasperskyedr-15629","actionType":"BLOCK","incidentId":15629,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15629-iam-block","performedAt":"2026-05-15T20:51:50.382481Z"},{"id":746,"userId":"compromised-user-mocksiemkasperskyedr-15626","actionType":"BLOCK","incidentId":15626,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15626-iam-block","performedAt":"2026-05-15T20:51:50.315532Z"},{"id":745,"userId":"compromised-user-mocksiemkasperskyedr-15604","actionType":"BLOCK","incidentId":15604,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15604-iam-block","performedAt":"2026-05-15T20:51:49.874124Z"},{"id":744,"userId":"compromised-user-mocksiemkasperskyedr-15603","actionType":"BLOCK","incidentId":15603,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15603-iam-block","performedAt":"2026-05-15T20:51:49.822840Z"},{"id":743,"userId":"compromised-user-mocksiemkasperskyedr-15599","actionType":"BLOCK","incidentId":15599,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15599-iam-block","performedAt":"2026-05-15T20:51:49.709078Z"},{"id":742,"userId":"compromised-user-mocksiemkasperskyedr-15557","actionType":"BLOCK","incidentId":15557,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15557-iam-block","performedAt":"2026-05-15T20:51:48.783104Z"},{"id":741,"userId":"compromised-user-mocksiemkasperskyedr-15549","actionType":"BLOCK","incidentId":15549,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15549-iam-block","performedAt":"2026-05-15T20:51:48.625707Z"},{"id":740,"userId":"compromised-user-mocksiemkasperskyedr-15532","actionType":"BLOCK","incidentId":15532,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15532-iam-block","performedAt":"2026-05-15T20:51:48.254792Z"},{"id":739,"userId":"compromised-user-mocksiemkasperskyedr-15531","actionType":"BLOCK","incidentId":15531,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15531-iam-block","performedAt":"2026-05-15T20:51:48.216203Z"},{"id":738,"userId":"compromised-user-mocksiemkasperskyedr-15518","actionType":"BLOCK","incidentId":15518,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15518-iam-block","performedAt":"2026-05-15T20:51:47.865061Z"},{"id":737,"userId":"compromised-user-mocksiemkasperskyedr-15517","actionType":"BLOCK","incidentId":15517,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15517-iam-block","performedAt":"2026-05-15T20:51:47.821018Z"},{"id":736,"userId":"compromised-user-mocksiemkasperskyedr-15500","actionType":"BLOCK","incidentId":15500,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15500-iam-block","performedAt":"2026-05-15T20:51:47.472489Z"},{"id":735,"userId":"compromised-user-mocksiemkasperskyedr-15496","actionType":"BLOCK","incidentId":15496,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15496-iam-block","performedAt":"2026-05-15T20:51:47.379416Z"},{"id":734,"userId":"compromised-user-mocksiemkasperskyedr-15466","actionType":"BLOCK","incidentId":15466,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15466-iam-block","performedAt":"2026-05-15T20:51:46.756439Z"},{"id":733,"userId":"compromised-user-mocksiemkasperskyedr-15443","actionType":"BLOCK","incidentId":15443,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15443-iam-block","performedAt":"2026-05-15T20:51:46.276599Z"},{"id":732,"userId":"compromised-user-mocksiemkasperskyedr-15436","actionType":"BLOCK","incidentId":15436,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15436-iam-block","performedAt":"2026-05-15T20:51:46.150899Z"},{"id":731,"userId":"compromised-user-mocksiemkasperskyedr-15426","actionType":"BLOCK","incidentId":15426,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15426-iam-block","performedAt":"2026-05-15T20:51:45.936339Z"},{"id":730,"userId":"compromised-user-mocksiemkasperskyedr-15408","actionType":"BLOCK","incidentId":15408,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15408-iam-block","performedAt":"2026-05-15T20:51:45.580962Z"},{"id":729,"userId":"compromised-user-mocksiemkasperskyedr-15397","actionType":"BLOCK","incidentId":15397,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15397-iam-block","performedAt":"2026-05-15T20:51:45.375239Z"},{"id":728,"userId":"compromised-user-mocksiemkasperskyedr-15367","actionType":"BLOCK","incidentId":15367,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15367-iam-block","performedAt":"2026-05-15T20:51:44.683646Z"},{"id":727,"userId":"compromised-user-mocksiemkasperskyedr-15342","actionType":"BLOCK","incidentId":15342,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15342-iam-block","performedAt":"2026-05-15T20:51:44.154574Z"},{"id":726,"userId":"compromised-user-mocksiemkasperskyedr-15331","actionType":"BLOCK","incidentId":15331,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15331-iam-block","performedAt":"2026-05-15T20:51:43.939107Z"},{"id":725,"userId":"compromised-user-mocksiemkasperskyedr-15321","actionType":"BLOCK","incidentId":15321,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15321-iam-block","performedAt":"2026-05-15T20:51:43.744891Z"},{"id":724,"userId":"compromised-user-mocksiemkasperskyedr-15316","actionType":"BLOCK","incidentId":15316,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15316-iam-block","performedAt":"2026-05-15T20:51:43.657902Z"},{"id":723,"userId":"compromised-user-mocksiemkasperskyedr-15292","actionType":"BLOCK","incidentId":15292,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15292-iam-block","performedAt":"2026-05-15T20:51:43.089477Z"},{"id":722,"userId":"compromised-user-mocksiemkasperskyedr-15289","actionType":"BLOCK","incidentId":15289,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15289-iam-block","performedAt":"2026-05-15T20:51:43.024968Z"},{"id":721,"userId":"compromised-user-mocksiemkasperskyedr-15288","actionType":"BLOCK","incidentId":15288,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15288-iam-block","performedAt":"2026-05-15T20:51:42.981630Z"},{"id":720,"userId":"compromised-user-mocksiemkasperskyedr-15272","actionType":"BLOCK","incidentId":15272,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15272-iam-block","performedAt":"2026-05-15T20:51:42.718112Z"},{"id":719,"userId":"compromised-user-mocksiemkasperskyedr-15260","actionType":"BLOCK","incidentId":15260,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15260-iam-block","performedAt":"2026-05-15T20:51:42.473917Z"},{"id":718,"userId":"compromised-user-mocksiemkasperskyedr-15259","actionType":"BLOCK","incidentId":15259,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15259-iam-block","performedAt":"2026-05-15T20:51:42.439161Z"},{"id":717,"userId":"compromised-user-mocksiemkasperskyedr-15257","actionType":"BLOCK","incidentId":15257,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15257-iam-block","performedAt":"2026-05-15T20:51:42.393007Z"},{"id":716,"userId":"compromised-user-mocksiemkasperskyedr-15244","actionType":"BLOCK","incidentId":15244,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15244-iam-block","performedAt":"2026-05-15T20:51:42.146533Z"},{"id":715,"userId":"compromised-user-mocksiemkasperskyedr-15217","actionType":"BLOCK","incidentId":15217,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15217-iam-block","performedAt":"2026-05-15T20:51:41.619626Z"},{"id":714,"userId":"compromised-user-mocksiemkasperskyedr-15175","actionType":"BLOCK","incidentId":15175,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15175-iam-block","performedAt":"2026-05-15T20:51:40.885557Z"},{"id":713,"userId":"compromised-user-mocksiemkasperskyedr-15170","actionType":"BLOCK","incidentId":15170,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15170-iam-block","performedAt":"2026-05-15T20:51:40.772524Z"},{"id":712,"userId":"compromised-user-mocksiemkasperskyedr-15129","actionType":"BLOCK","incidentId":15129,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15129-iam-block","performedAt":"2026-05-15T20:51:40.065569Z"},{"id":711,"userId":"compromised-user-mocksiemkasperskyedr-15123","actionType":"BLOCK","incidentId":15123,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15123-iam-block","performedAt":"2026-05-15T20:51:39.882471Z"},{"id":710,"userId":"compromised-user-mocksiemkasperskyedr-15109","actionType":"BLOCK","incidentId":15109,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15109-iam-block","performedAt":"2026-05-15T20:51:39.558209Z"},{"id":709,"userId":"compromised-user-mocksiemkasperskyedr-15098","actionType":"BLOCK","incidentId":15098,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15098-iam-block","performedAt":"2026-05-15T20:51:39.274898Z"},{"id":708,"userId":"compromised-user-mocksiemkasperskyedr-15097","actionType":"BLOCK","incidentId":15097,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15097-iam-block","performedAt":"2026-05-15T20:51:39.243245Z"},{"id":707,"userId":"compromised-user-mocksiemkasperskyedr-15095","actionType":"BLOCK","incidentId":15095,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15095-iam-block","performedAt":"2026-05-15T20:51:39.183889Z"},{"id":706,"userId":"compromised-user-mocksiemkasperskyedr-15094","actionType":"BLOCK","incidentId":15094,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15094-iam-block","performedAt":"2026-05-15T20:51:39.141828Z"},{"id":705,"userId":"compromised-user-mocksiemkasperskyedr-15069","actionType":"BLOCK","incidentId":15069,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-15069-iam-block","performedAt":"2026-05-15T20:51:38.662429Z"},{"id":704,"userId":"compromised-user-mocksiemkasperskyedr-15065","actionType":"BLOCK","incidentId":15065,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15065-iam-block","performedAt":"2026-05-15T20:51:38.570819Z"},{"id":703,"userId":"compromised-user-mocksiemkasperskyedr-15060","actionType":"BLOCK","incidentId":15060,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15060-iam-block","performedAt":"2026-05-15T20:51:38.430726Z"},{"id":702,"userId":"compromised-user-mocksiemkasperskyedr-15057","actionType":"BLOCK","incidentId":15057,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15057-iam-block","performedAt":"2026-05-15T20:51:38.315464Z"},{"id":701,"userId":"compromised-user-mocksiemkasperskyedr-15024","actionType":"BLOCK","incidentId":15024,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15024-iam-block","performedAt":"2026-05-15T20:51:37.430432Z"},{"id":700,"userId":"compromised-user-mocksiemkasperskyedr-15016","actionType":"BLOCK","incidentId":15016,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-15016-iam-block","performedAt":"2026-05-15T20:51:37.263361Z"},{"id":699,"userId":"compromised-user-mocksiemkasperskyedr-14990","actionType":"BLOCK","incidentId":14990,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14990-iam-block","performedAt":"2026-05-15T20:51:36.715412Z"},{"id":698,"userId":"compromised-user-mocksiemkasperskyedr-14941","actionType":"BLOCK","incidentId":14941,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14941-iam-block","performedAt":"2026-05-15T20:51:35.764078Z"},{"id":697,"userId":"compromised-user-mocksiemkasperskyedr-14907","actionType":"BLOCK","incidentId":14907,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14907-iam-block","performedAt":"2026-05-15T20:51:35.121541Z"},{"id":696,"userId":"compromised-user-mocksiemkasperskyedr-14901","actionType":"BLOCK","incidentId":14901,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14901-iam-block","performedAt":"2026-05-15T20:51:34.925598Z"},{"id":695,"userId":"compromised-user-mocksiemkasperskyedr-14890","actionType":"BLOCK","incidentId":14890,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14890-iam-block","performedAt":"2026-05-15T20:51:34.679427Z"},{"id":694,"userId":"compromised-user-mocksiemkasperskyedr-14878","actionType":"BLOCK","incidentId":14878,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14878-iam-block","performedAt":"2026-05-15T20:51:34.411857Z"},{"id":693,"userId":"compromised-user-mocksiemkasperskyedr-14871","actionType":"BLOCK","incidentId":14871,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14871-iam-block","performedAt":"2026-05-15T20:51:34.268038Z"},{"id":692,"userId":"compromised-user-mocksiemkasperskyedr-14855","actionType":"BLOCK","incidentId":14855,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14855-iam-block","performedAt":"2026-05-15T20:51:33.773931Z"},{"id":691,"userId":"compromised-user-mocksiemkasperskyedr-14848","actionType":"BLOCK","incidentId":14848,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14848-iam-block","performedAt":"2026-05-15T20:51:33.630601Z"},{"id":690,"userId":"compromised-user-mocksiemkasperskyedr-14840","actionType":"BLOCK","incidentId":14840,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14840-iam-block","performedAt":"2026-05-15T20:51:33.416736Z"},{"id":689,"userId":"compromised-user-mocksiemkasperskyedr-14839","actionType":"BLOCK","incidentId":14839,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14839-iam-block","performedAt":"2026-05-15T20:51:33.362591Z"},{"id":688,"userId":"compromised-user-mocksiemkasperskyedr-14813","actionType":"BLOCK","incidentId":14813,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14813-iam-block","performedAt":"2026-05-15T20:51:32.780134Z"},{"id":687,"userId":"compromised-user-mocksiemkasperskyedr-14811","actionType":"BLOCK","incidentId":14811,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14811-iam-block","performedAt":"2026-05-15T20:51:32.718112Z"},{"id":686,"userId":"compromised-user-mocksiemkasperskyedr-14810","actionType":"BLOCK","incidentId":14810,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14810-iam-block","performedAt":"2026-05-15T20:51:32.689479Z"},{"id":685,"userId":"compromised-user-mocksiemkasperskyedr-14801","actionType":"BLOCK","incidentId":14801,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14801-iam-block","performedAt":"2026-05-15T20:51:32.458089Z"},{"id":684,"userId":"compromised-user-mocksiemkasperskyedr-14759","actionType":"BLOCK","incidentId":14759,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14759-iam-block","performedAt":"2026-05-15T20:51:31.591615Z"},{"id":683,"userId":"compromised-user-mocksiemkasperskyedr-14751","actionType":"BLOCK","incidentId":14751,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14751-iam-block","performedAt":"2026-05-15T20:51:31.431348Z"},{"id":682,"userId":"compromised-user-mocksiemkasperskyedr-14708","actionType":"BLOCK","incidentId":14708,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14708-iam-block","performedAt":"2026-05-15T20:51:30.573341Z"},{"id":681,"userId":"compromised-user-mocksiemkasperskyedr-14700","actionType":"BLOCK","incidentId":14700,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14700-iam-block","performedAt":"2026-05-15T20:51:30.415905Z"},{"id":680,"userId":"compromised-user-mocksiemkasperskyedr-14690","actionType":"BLOCK","incidentId":14690,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14690-iam-block","performedAt":"2026-05-15T20:51:30.191122Z"},{"id":679,"userId":"compromised-user-mocksiemkasperskyedr-14687","actionType":"BLOCK","incidentId":14687,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14687-iam-block","performedAt":"2026-05-15T20:51:30.098255Z"},{"id":678,"userId":"compromised-user-mocksiemkasperskyedr-14662","actionType":"BLOCK","incidentId":14662,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14662-iam-block","performedAt":"2026-05-15T20:51:29.553322Z"},{"id":677,"userId":"compromised-user-mocksiemkasperskyedr-14649","actionType":"BLOCK","incidentId":14649,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14649-iam-block","performedAt":"2026-05-15T20:51:29.060954Z"},{"id":676,"userId":"compromised-user-mocksiemkasperskyedr-14645","actionType":"BLOCK","incidentId":14645,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14645-iam-block","performedAt":"2026-05-15T20:51:28.914572Z"},{"id":675,"userId":"compromised-user-mocksiemkasperskyedr-14628","actionType":"BLOCK","incidentId":14628,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14628-iam-block","performedAt":"2026-05-15T20:51:28.384932Z"},{"id":674,"userId":"compromised-user-mocksiemkasperskyedr-14624","actionType":"BLOCK","incidentId":14624,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14624-iam-block","performedAt":"2026-05-15T20:51:28.226022Z"},{"id":673,"userId":"compromised-user-mocksiemkasperskyedr-14615","actionType":"BLOCK","incidentId":14615,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14615-iam-block","performedAt":"2026-05-15T20:51:27.889118Z"},{"id":672,"userId":"compromised-user-mocksiemkasperskyedr-14608","actionType":"BLOCK","incidentId":14608,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14608-iam-block","performedAt":"2026-05-15T20:51:27.716737Z"},{"id":671,"userId":"compromised-user-mocksiemkasperskyedr-14550","actionType":"BLOCK","incidentId":14550,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14550-iam-block","performedAt":"2026-05-15T20:51:26.517382Z"},{"id":670,"userId":"compromised-user-mocksiemkasperskyedr-14539","actionType":"BLOCK","incidentId":14539,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14539-iam-block","performedAt":"2026-05-15T20:51:26.312100Z"},{"id":669,"userId":"compromised-user-mocksiemkasperskyedr-14536","actionType":"BLOCK","incidentId":14536,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14536-iam-block","performedAt":"2026-05-15T20:51:26.254458Z"},{"id":668,"userId":"compromised-user-mocksiemkasperskyedr-14492","actionType":"BLOCK","incidentId":14492,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14492-iam-block","performedAt":"2026-05-15T20:51:25.387904Z"},{"id":667,"userId":"compromised-user-mocksiemkasperskyedr-14491","actionType":"BLOCK","incidentId":14491,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14491-iam-block","performedAt":"2026-05-15T20:51:25.340307Z"},{"id":666,"userId":"compromised-user-mocksiemkasperskyedr-14487","actionType":"BLOCK","incidentId":14487,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14487-iam-block","performedAt":"2026-05-15T20:51:25.223774Z"},{"id":665,"userId":"compromised-user-mocksiemkasperskyedr-14469","actionType":"BLOCK","incidentId":14469,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14469-iam-block","performedAt":"2026-05-15T20:51:24.913472Z"},{"id":664,"userId":"compromised-user-mocksiemkasperskyedr-14467","actionType":"BLOCK","incidentId":14467,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14467-iam-block","performedAt":"2026-05-15T20:51:24.847494Z"},{"id":663,"userId":"compromised-user-mocksiemkasperskyedr-14448","actionType":"BLOCK","incidentId":14448,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14448-iam-block","performedAt":"2026-05-15T20:51:24.426728Z"},{"id":662,"userId":"compromised-user-mocksiemkasperskyedr-14443","actionType":"BLOCK","incidentId":14443,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14443-iam-block","performedAt":"2026-05-15T20:51:24.316589Z"},{"id":661,"userId":"compromised-user-mocksiemkasperskyedr-14441","actionType":"BLOCK","incidentId":14441,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14441-iam-block","performedAt":"2026-05-15T20:51:24.257701Z"},{"id":660,"userId":"compromised-user-mocksiemkasperskyedr-14408","actionType":"BLOCK","incidentId":14408,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14408-iam-block","performedAt":"2026-05-15T20:51:23.519780Z"},{"id":659,"userId":"compromised-user-mocksiemkasperskyedr-14402","actionType":"BLOCK","incidentId":14402,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14402-iam-block","performedAt":"2026-05-15T20:51:23.358857Z"},{"id":658,"userId":"compromised-user-mocksiemkasperskyedr-14379","actionType":"BLOCK","incidentId":14379,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14379-iam-block","performedAt":"2026-05-15T20:51:22.749482Z"},{"id":657,"userId":"compromised-user-mocksiemkasperskyedr-14372","actionType":"BLOCK","incidentId":14372,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14372-iam-block","performedAt":"2026-05-15T20:51:22.593838Z"},{"id":656,"userId":"compromised-user-mocksiemkasperskyedr-14371","actionType":"BLOCK","incidentId":14371,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14371-iam-block","performedAt":"2026-05-15T20:51:22.554023Z"},{"id":655,"userId":"compromised-user-mocksiemkasperskyedr-14343","actionType":"BLOCK","incidentId":14343,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14343-iam-block","performedAt":"2026-05-15T20:51:22.053129Z"},{"id":654,"userId":"compromised-user-mocksiemkasperskyedr-14341","actionType":"BLOCK","incidentId":14341,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14341-iam-block","performedAt":"2026-05-15T20:51:22.013507Z"},{"id":653,"userId":"compromised-user-mocksiemkasperskyedr-14335","actionType":"BLOCK","incidentId":14335,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14335-iam-block","performedAt":"2026-05-15T20:51:21.866014Z"},{"id":652,"userId":"compromised-user-mocksiemkasperskyedr-14334","actionType":"BLOCK","incidentId":14334,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14334-iam-block","performedAt":"2026-05-15T20:51:21.814626Z"},{"id":651,"userId":"compromised-user-mocksiemkasperskyedr-14313","actionType":"BLOCK","incidentId":14313,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14313-iam-block","performedAt":"2026-05-15T20:51:21.352028Z"},{"id":650,"userId":"compromised-user-mocksiemkasperskyedr-14289","actionType":"BLOCK","incidentId":14289,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14289-iam-block","performedAt":"2026-05-15T20:51:20.871061Z"},{"id":649,"userId":"compromised-user-mocksiemkasperskyedr-14273","actionType":"BLOCK","incidentId":14273,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14273-iam-block","performedAt":"2026-05-15T20:51:20.515440Z"},{"id":648,"userId":"compromised-user-mocksiemkasperskyedr-14260","actionType":"BLOCK","incidentId":14260,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14260-iam-block","performedAt":"2026-05-15T20:51:20.229890Z"},{"id":647,"userId":"compromised-user-mocksiemkasperskyedr-14251","actionType":"BLOCK","incidentId":14251,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14251-iam-block","performedAt":"2026-05-15T20:51:20.036149Z"},{"id":646,"userId":"compromised-user-mocksiemkasperskyedr-14250","actionType":"BLOCK","incidentId":14250,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14250-iam-block","performedAt":"2026-05-15T20:51:19.989095Z"},{"id":645,"userId":"compromised-user-mocksiemkasperskyedr-14233","actionType":"BLOCK","incidentId":14233,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14233-iam-block","performedAt":"2026-05-15T20:51:19.646343Z"},{"id":644,"userId":"compromised-user-mocksiemkasperskyedr-14221","actionType":"BLOCK","incidentId":14221,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14221-iam-block","performedAt":"2026-05-15T20:51:19.415870Z"},{"id":643,"userId":"compromised-user-mocksiemkasperskyedr-14219","actionType":"BLOCK","incidentId":14219,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14219-iam-block","performedAt":"2026-05-15T20:51:19.371601Z"},{"id":642,"userId":"compromised-user-mocksiemkasperskyedr-14204","actionType":"BLOCK","incidentId":14204,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14204-iam-block","performedAt":"2026-05-15T20:51:19.031320Z"},{"id":641,"userId":"compromised-user-mocksiemkasperskyedr-14200","actionType":"BLOCK","incidentId":14200,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14200-iam-block","performedAt":"2026-05-15T20:51:18.856691Z"},{"id":640,"userId":"compromised-user-mocksiemkasperskyedr-14178","actionType":"BLOCK","incidentId":14178,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14178-iam-block","performedAt":"2026-05-15T20:51:18.410051Z"},{"id":639,"userId":"compromised-user-mocksiemkasperskyedr-14140","actionType":"BLOCK","incidentId":14140,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14140-iam-block","performedAt":"2026-05-15T20:51:17.747699Z"},{"id":638,"userId":"compromised-user-mocksiemkasperskyedr-14137","actionType":"BLOCK","incidentId":14137,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14137-iam-block","performedAt":"2026-05-15T20:51:17.683635Z"},{"id":637,"userId":"compromised-user-mocksiemkasperskyedr-14131","actionType":"BLOCK","incidentId":14131,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14131-iam-block","performedAt":"2026-05-15T20:51:17.558807Z"},{"id":636,"userId":"compromised-user-mocksiemkasperskyedr-14097","actionType":"BLOCK","incidentId":14097,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14097-iam-block","performedAt":"2026-05-15T20:51:16.932412Z"},{"id":635,"userId":"compromised-user-mocksiemkasperskyedr-14086","actionType":"BLOCK","incidentId":14086,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14086-iam-block","performedAt":"2026-05-15T20:51:16.700692Z"},{"id":634,"userId":"compromised-user-mocksiemkasperskyedr-14083","actionType":"BLOCK","incidentId":14083,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14083-iam-block","performedAt":"2026-05-15T20:51:16.566722Z"},{"id":633,"userId":"compromised-user-mocksiemkasperskyedr-14048","actionType":"BLOCK","incidentId":14048,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14048-iam-block","performedAt":"2026-05-15T20:51:15.911201Z"},{"id":632,"userId":"compromised-user-mocksiemkasperskyedr-14039","actionType":"BLOCK","incidentId":14039,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-14039-iam-block","performedAt":"2026-05-15T20:51:15.729960Z"},{"id":631,"userId":"compromised-user-mocksiemkasperskyedr-14008","actionType":"BLOCK","incidentId":14008,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-14008-iam-block","performedAt":"2026-05-15T20:51:15.010031Z"},{"id":630,"userId":"compromised-user-mocksiemkasperskyedr-13995","actionType":"BLOCK","incidentId":13995,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13995-iam-block","performedAt":"2026-05-15T20:51:14.739015Z"},{"id":629,"userId":"compromised-user-mocksiemkasperskyedr-13990","actionType":"BLOCK","incidentId":13990,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13990-iam-block","performedAt":"2026-05-15T20:51:14.649388Z"},{"id":628,"userId":"compromised-user-mocksiemkasperskyedr-13983","actionType":"BLOCK","incidentId":13983,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13983-iam-block","performedAt":"2026-05-15T20:51:14.490722Z"},{"id":627,"userId":"compromised-user-mocksiemkasperskyedr-13972","actionType":"BLOCK","incidentId":13972,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13972-iam-block","performedAt":"2026-05-15T20:51:14.275324Z"},{"id":626,"userId":"compromised-user-mocksiemkasperskyedr-13956","actionType":"BLOCK","incidentId":13956,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13956-iam-block","performedAt":"2026-05-15T20:51:13.858888Z"},{"id":625,"userId":"compromised-user-mocksiemkasperskyedr-13953","actionType":"BLOCK","incidentId":13953,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13953-iam-block","performedAt":"2026-05-15T20:51:13.763838Z"},{"id":624,"userId":"compromised-user-mocksiemkasperskyedr-13948","actionType":"BLOCK","incidentId":13948,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13948-iam-block","performedAt":"2026-05-15T20:51:13.669502Z"},{"id":623,"userId":"compromised-user-mocksiemkasperskyedr-13944","actionType":"BLOCK","incidentId":13944,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13944-iam-block","performedAt":"2026-05-15T20:51:13.573679Z"},{"id":622,"userId":"compromised-user-mocksiemkasperskyedr-13935","actionType":"BLOCK","incidentId":13935,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13935-iam-block","performedAt":"2026-05-15T20:51:13.393786Z"},{"id":621,"userId":"compromised-user-mocksiemkasperskyedr-13933","actionType":"BLOCK","incidentId":13933,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13933-iam-block","performedAt":"2026-05-15T20:51:13.333527Z"},{"id":620,"userId":"compromised-user-mocksiemkasperskyedr-13913","actionType":"BLOCK","incidentId":13913,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13913-iam-block","performedAt":"2026-05-15T20:51:12.786414Z"},{"id":619,"userId":"compromised-user-mocksiemkasperskyedr-13869","actionType":"BLOCK","incidentId":13869,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13869-iam-block","performedAt":"2026-05-15T20:51:11.595030Z"},{"id":618,"userId":"compromised-user-mocksiemkasperskyedr-13841","actionType":"BLOCK","incidentId":13841,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13841-iam-block","performedAt":"2026-05-15T20:51:11.072691Z"},{"id":617,"userId":"compromised-user-mocksiemkasperskyedr-13839","actionType":"BLOCK","incidentId":13839,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13839-iam-block","performedAt":"2026-05-15T20:51:11.010401Z"},{"id":616,"userId":"compromised-user-mocksiemkasperskyedr-13828","actionType":"BLOCK","incidentId":13828,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13828-iam-block","performedAt":"2026-05-15T20:51:10.784531Z"},{"id":615,"userId":"compromised-user-mocksiemkasperskyedr-13827","actionType":"BLOCK","incidentId":13827,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13827-iam-block","performedAt":"2026-05-15T20:51:10.755878Z"},{"id":614,"userId":"compromised-user-mocksiemkasperskyedr-13810","actionType":"BLOCK","incidentId":13810,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13810-iam-block","performedAt":"2026-05-15T20:51:10.397823Z"},{"id":613,"userId":"compromised-user-mocksiemkasperskyedr-13799","actionType":"BLOCK","incidentId":13799,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13799-iam-block","performedAt":"2026-05-15T20:51:10.180817Z"},{"id":612,"userId":"compromised-user-mocksiemkasperskyedr-13792","actionType":"BLOCK","incidentId":13792,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13792-iam-block","performedAt":"2026-05-15T20:51:10.012871Z"},{"id":611,"userId":"compromised-user-mocksiemkasperskyedr-13784","actionType":"BLOCK","incidentId":13784,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13784-iam-block","performedAt":"2026-05-15T20:51:09.854927Z"},{"id":610,"userId":"compromised-user-mocksiemkasperskyedr-13782","actionType":"BLOCK","incidentId":13782,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13782-iam-block","performedAt":"2026-05-15T20:51:09.794805Z"},{"id":609,"userId":"compromised-user-mocksiemkasperskyedr-13730","actionType":"BLOCK","incidentId":13730,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13730-iam-block","performedAt":"2026-05-15T20:51:08.686488Z"},{"id":608,"userId":"compromised-user-mocksiemkasperskyedr-13729","actionType":"BLOCK","incidentId":13729,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13729-iam-block","performedAt":"2026-05-15T20:51:08.606934Z"},{"id":607,"userId":"compromised-user-mocksiemkasperskyedr-13717","actionType":"BLOCK","incidentId":13717,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13717-iam-block","performedAt":"2026-05-15T20:51:08.361426Z"},{"id":606,"userId":"compromised-user-mocksiemkasperskyedr-13697","actionType":"BLOCK","incidentId":13697,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13697-iam-block","performedAt":"2026-05-15T20:51:07.958940Z"},{"id":605,"userId":"compromised-user-mocksiemkasperskyedr-13684","actionType":"BLOCK","incidentId":13684,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13684-iam-block","performedAt":"2026-05-15T20:51:07.714130Z"},{"id":604,"userId":"compromised-user-mocksiemkasperskyedr-13671","actionType":"BLOCK","incidentId":13671,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13671-iam-block","performedAt":"2026-05-15T20:51:07.481831Z"},{"id":603,"userId":"compromised-user-mocksiemkasperskyedr-13666","actionType":"BLOCK","incidentId":13666,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13666-iam-block","performedAt":"2026-05-15T20:51:07.388058Z"},{"id":602,"userId":"compromised-user-mocksiemkasperskyedr-13665","actionType":"BLOCK","incidentId":13665,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13665-iam-block","performedAt":"2026-05-15T20:51:07.360074Z"},{"id":601,"userId":"compromised-user-mocksiemkasperskyedr-13662","actionType":"BLOCK","incidentId":13662,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13662-iam-block","performedAt":"2026-05-15T20:51:07.291494Z"},{"id":600,"userId":"compromised-user-mocksiemkasperskyedr-13633","actionType":"BLOCK","incidentId":13633,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13633-iam-block","performedAt":"2026-05-15T20:51:06.810403Z"},{"id":599,"userId":"compromised-user-mocksiemkasperskyedr-13629","actionType":"BLOCK","incidentId":13629,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13629-iam-block","performedAt":"2026-05-15T20:51:06.702457Z"},{"id":598,"userId":"compromised-user-mocksiemkasperskyedr-13597","actionType":"BLOCK","incidentId":13597,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13597-iam-block","performedAt":"2026-05-15T20:51:05.872646Z"},{"id":597,"userId":"compromised-user-mocksiemkasperskyedr-13591","actionType":"BLOCK","incidentId":13591,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13591-iam-block","performedAt":"2026-05-15T20:51:05.742977Z"},{"id":596,"userId":"compromised-user-mocksiemkasperskyedr-13576","actionType":"BLOCK","incidentId":13576,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13576-iam-block","performedAt":"2026-05-15T20:51:05.453638Z"},{"id":595,"userId":"compromised-user-mocksiemkasperskyedr-13541","actionType":"BLOCK","incidentId":13541,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13541-iam-block","performedAt":"2026-05-15T20:51:04.810311Z"},{"id":594,"userId":"compromised-user-mocksiemkasperskyedr-13531","actionType":"BLOCK","incidentId":13531,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13531-iam-block","performedAt":"2026-05-15T20:51:04.587818Z"},{"id":593,"userId":"compromised-user-mocksiemkasperskyedr-13528","actionType":"BLOCK","incidentId":13528,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13528-iam-block","performedAt":"2026-05-15T20:51:04.529947Z"},{"id":592,"userId":"compromised-user-mocksiemkasperskyedr-13525","actionType":"BLOCK","incidentId":13525,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13525-iam-block","performedAt":"2026-05-15T20:51:04.419249Z"},{"id":591,"userId":"compromised-user-mocksiemkasperskyedr-13495","actionType":"BLOCK","incidentId":13495,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13495-iam-block","performedAt":"2026-05-15T20:51:03.782647Z"},{"id":590,"userId":"compromised-user-mocksiemkasperskyedr-13483","actionType":"BLOCK","incidentId":13483,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13483-iam-block","performedAt":"2026-05-15T20:51:03.545864Z"},{"id":589,"userId":"compromised-user-mocksiemkasperskyedr-13472","actionType":"BLOCK","incidentId":13472,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13472-iam-block","performedAt":"2026-05-15T20:51:03.280490Z"},{"id":588,"userId":"compromised-user-mocksiemkasperskyedr-13468","actionType":"BLOCK","incidentId":13468,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13468-iam-block","performedAt":"2026-05-15T20:51:03.188348Z"},{"id":587,"userId":"compromised-user-mocksiemkasperskyedr-13458","actionType":"BLOCK","incidentId":13458,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13458-iam-block","performedAt":"2026-05-15T20:51:02.993082Z"},{"id":586,"userId":"compromised-user-mocksiemkasperskyedr-13453","actionType":"BLOCK","incidentId":13453,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13453-iam-block","performedAt":"2026-05-15T20:51:02.872019Z"},{"id":585,"userId":"compromised-user-mocksiemkasperskyedr-13450","actionType":"BLOCK","incidentId":13450,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13450-iam-block","performedAt":"2026-05-15T20:51:02.786952Z"},{"id":584,"userId":"compromised-user-mocksiemkasperskyedr-13430","actionType":"BLOCK","incidentId":13430,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13430-iam-block","performedAt":"2026-05-15T20:51:02.332765Z"},{"id":583,"userId":"compromised-user-mocksiemkasperskyedr-13429","actionType":"BLOCK","incidentId":13429,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13429-iam-block","performedAt":"2026-05-15T20:51:02.294064Z"},{"id":582,"userId":"compromised-user-mocksiemkasperskyedr-13408","actionType":"BLOCK","incidentId":13408,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13408-iam-block","performedAt":"2026-05-15T20:51:01.895476Z"},{"id":581,"userId":"compromised-user-mocksiemkasperskyedr-13405","actionType":"BLOCK","incidentId":13405,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13405-iam-block","performedAt":"2026-05-15T20:51:01.768102Z"},{"id":580,"userId":"compromised-user-mocksiemkasperskyedr-13403","actionType":"BLOCK","incidentId":13403,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13403-iam-block","performedAt":"2026-05-15T20:51:01.709286Z"},{"id":579,"userId":"compromised-user-mocksiemkasperskyedr-13331","actionType":"BLOCK","incidentId":13331,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13331-iam-block","performedAt":"2026-05-15T20:51:00.214359Z"},{"id":578,"userId":"compromised-user-mocksiemkasperskyedr-13308","actionType":"BLOCK","incidentId":13308,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13308-iam-block","performedAt":"2026-05-15T20:50:59.716867Z"},{"id":577,"userId":"compromised-user-mocksiemkasperskyedr-13291","actionType":"BLOCK","incidentId":13291,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13291-iam-block","performedAt":"2026-05-15T20:50:59.397102Z"},{"id":576,"userId":"compromised-user-mocksiemkasperskyedr-13263","actionType":"BLOCK","incidentId":13263,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13263-iam-block","performedAt":"2026-05-15T20:50:58.829514Z"},{"id":575,"userId":"compromised-user-mocksiemkasperskyedr-13240","actionType":"BLOCK","incidentId":13240,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13240-iam-block","performedAt":"2026-05-15T20:50:58.392892Z"},{"id":574,"userId":"compromised-user-mocksiemkasperskyedr-13221","actionType":"BLOCK","incidentId":13221,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13221-iam-block","performedAt":"2026-05-15T20:50:57.926332Z"},{"id":573,"userId":"compromised-user-mocksiemkasperskyedr-13215","actionType":"BLOCK","incidentId":13215,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13215-iam-block","performedAt":"2026-05-15T20:50:57.752986Z"},{"id":572,"userId":"compromised-user-mocksiemkasperskyedr-13178","actionType":"BLOCK","incidentId":13178,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13178-iam-block","performedAt":"2026-05-15T20:50:56.998301Z"},{"id":571,"userId":"compromised-user-mocksiemkasperskyedr-13168","actionType":"BLOCK","incidentId":13168,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13168-iam-block","performedAt":"2026-05-15T20:50:56.788094Z"},{"id":570,"userId":"compromised-user-mocksiemkasperskyedr-13126","actionType":"BLOCK","incidentId":13126,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13126-iam-block","performedAt":"2026-05-15T20:50:55.878616Z"},{"id":569,"userId":"compromised-user-mocksiemkasperskyedr-13105","actionType":"BLOCK","incidentId":13105,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13105-iam-block","performedAt":"2026-05-15T20:50:55.428572Z"},{"id":568,"userId":"compromised-user-mocksiemkasperskyedr-13093","actionType":"BLOCK","incidentId":13093,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13093-iam-block","performedAt":"2026-05-15T20:50:55.159134Z"},{"id":567,"userId":"compromised-user-mocksiemkasperskyedr-13092","actionType":"BLOCK","incidentId":13092,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13092-iam-block","performedAt":"2026-05-15T20:50:55.117837Z"},{"id":566,"userId":"compromised-user-mocksiemkasperskyedr-13080","actionType":"BLOCK","incidentId":13080,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13080-iam-block","performedAt":"2026-05-15T20:50:54.843442Z"},{"id":565,"userId":"compromised-user-mocksiemkasperskyedr-13062","actionType":"BLOCK","incidentId":13062,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13062-iam-block","performedAt":"2026-05-15T20:50:54.515412Z"},{"id":564,"userId":"compromised-user-mocksiemkasperskyedr-13060","actionType":"BLOCK","incidentId":13060,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13060-iam-block","performedAt":"2026-05-15T20:50:54.446639Z"},{"id":563,"userId":"compromised-user-mocksiemkasperskyedr-13048","actionType":"BLOCK","incidentId":13048,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13048-iam-block","performedAt":"2026-05-15T20:50:54.212978Z"},{"id":562,"userId":"compromised-user-mocksiemkasperskyedr-13038","actionType":"BLOCK","incidentId":13038,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13038-iam-block","performedAt":"2026-05-15T20:50:53.998204Z"},{"id":561,"userId":"compromised-user-mocksiemkasperskyedr-13028","actionType":"BLOCK","incidentId":13028,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13028-iam-block","performedAt":"2026-05-15T20:50:53.717467Z"},{"id":560,"userId":"compromised-user-mocksiemkasperskyedr-13020","actionType":"BLOCK","incidentId":13020,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13020-iam-block","performedAt":"2026-05-15T20:50:53.439638Z"},{"id":559,"userId":"compromised-user-mocksiemkasperskyedr-13017","actionType":"BLOCK","incidentId":13017,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-13017-iam-block","performedAt":"2026-05-15T20:50:53.363544Z"},{"id":558,"userId":"compromised-user-mocksiemkasperskyedr-13013","actionType":"BLOCK","incidentId":13013,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-13013-iam-block","performedAt":"2026-05-15T20:50:53.278153Z"},{"id":557,"userId":"compromised-user-mocksiemkasperskyedr-12981","actionType":"BLOCK","incidentId":12981,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12981-iam-block","performedAt":"2026-05-15T20:50:52.543718Z"},{"id":556,"userId":"compromised-user-mocksiemkasperskyedr-12971","actionType":"BLOCK","incidentId":12971,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12971-iam-block","performedAt":"2026-05-15T20:50:52.356136Z"},{"id":555,"userId":"compromised-user-mocksiemkasperskyedr-12968","actionType":"BLOCK","incidentId":12968,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12968-iam-block","performedAt":"2026-05-15T20:50:52.283928Z"},{"id":554,"userId":"compromised-user-mocksiemkasperskyedr-12952","actionType":"BLOCK","incidentId":12952,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12952-iam-block","performedAt":"2026-05-15T20:50:51.949535Z"},{"id":553,"userId":"compromised-user-mocksiemkasperskyedr-12941","actionType":"BLOCK","incidentId":12941,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12941-iam-block","performedAt":"2026-05-15T20:50:51.706220Z"},{"id":552,"userId":"compromised-user-mocksiemkasperskyedr-12919","actionType":"BLOCK","incidentId":12919,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12919-iam-block","performedAt":"2026-05-15T20:50:51.107438Z"},{"id":551,"userId":"compromised-user-mocksiemkasperskyedr-12899","actionType":"BLOCK","incidentId":12899,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12899-iam-block","performedAt":"2026-05-15T20:50:50.450705Z"},{"id":550,"userId":"compromised-user-mocksiemkasperskyedr-12894","actionType":"BLOCK","incidentId":12894,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12894-iam-block","performedAt":"2026-05-15T20:50:50.361627Z"},{"id":549,"userId":"compromised-user-mocksiemkasperskyedr-12891","actionType":"BLOCK","incidentId":12891,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12891-iam-block","performedAt":"2026-05-15T20:50:50.284107Z"},{"id":548,"userId":"compromised-user-mocksiemkasperskyedr-12885","actionType":"BLOCK","incidentId":12885,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12885-iam-block","performedAt":"2026-05-15T20:50:50.169578Z"},{"id":547,"userId":"compromised-user-mocksiemkasperskyedr-12872","actionType":"BLOCK","incidentId":12872,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12872-iam-block","performedAt":"2026-05-15T20:50:49.912877Z"},{"id":546,"userId":"compromised-user-mocksiemkasperskyedr-12841","actionType":"BLOCK","incidentId":12841,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12841-iam-block","performedAt":"2026-05-15T20:50:49.271240Z"},{"id":545,"userId":"compromised-user-mocksiemkasperskyedr-12840","actionType":"BLOCK","incidentId":12840,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12840-iam-block","performedAt":"2026-05-15T20:50:49.240391Z"},{"id":544,"userId":"compromised-user-mocksiemkasperskyedr-12829","actionType":"BLOCK","incidentId":12829,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12829-iam-block","performedAt":"2026-05-15T20:50:49.011804Z"},{"id":543,"userId":"compromised-user-mocksiemkasperskyedr-12819","actionType":"BLOCK","incidentId":12819,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12819-iam-block","performedAt":"2026-05-15T20:50:48.754818Z"},{"id":542,"userId":"compromised-user-mocksiemkasperskyedr-12817","actionType":"BLOCK","incidentId":12817,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12817-iam-block","performedAt":"2026-05-15T20:50:48.698369Z"},{"id":541,"userId":"compromised-user-mocksiemkasperskyedr-12760","actionType":"BLOCK","incidentId":12760,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12760-iam-block","performedAt":"2026-05-15T20:50:46.712328Z"},{"id":540,"userId":"compromised-user-mocksiemkasperskyedr-12753","actionType":"BLOCK","incidentId":12753,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12753-iam-block","performedAt":"2026-05-15T20:50:46.530722Z"},{"id":539,"userId":"compromised-user-mocksiemkasperskyedr-12749","actionType":"BLOCK","incidentId":12749,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12749-iam-block","performedAt":"2026-05-15T20:50:46.430712Z"},{"id":538,"userId":"compromised-user-mocksiemkasperskyedr-12717","actionType":"BLOCK","incidentId":12717,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12717-iam-block","performedAt":"2026-05-15T20:50:45.848666Z"},{"id":537,"userId":"compromised-user-mocksiemkasperskyedr-12696","actionType":"BLOCK","incidentId":12696,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12696-iam-block","performedAt":"2026-05-15T20:50:45.288358Z"},{"id":536,"userId":"compromised-user-mocksiemkasperskyedr-12687","actionType":"BLOCK","incidentId":12687,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12687-iam-block","performedAt":"2026-05-15T20:50:45.074458Z"},{"id":535,"userId":"compromised-user-mocksiemkasperskyedr-12675","actionType":"BLOCK","incidentId":12675,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12675-iam-block","performedAt":"2026-05-15T20:50:44.844084Z"},{"id":534,"userId":"compromised-user-mocksiemkasperskyedr-12614","actionType":"BLOCK","incidentId":12614,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12614-iam-block","performedAt":"2026-05-15T20:50:43.716018Z"},{"id":533,"userId":"compromised-user-mocksiemkasperskyedr-12607","actionType":"BLOCK","incidentId":12607,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12607-iam-block","performedAt":"2026-05-15T20:50:43.556051Z"},{"id":532,"userId":"compromised-user-mocksiemkasperskyedr-12565","actionType":"BLOCK","incidentId":12565,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12565-iam-block","performedAt":"2026-05-15T20:50:42.670697Z"},{"id":531,"userId":"compromised-user-mocksiemkasperskyedr-12558","actionType":"BLOCK","incidentId":12558,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12558-iam-block","performedAt":"2026-05-15T20:50:42.422276Z"},{"id":530,"userId":"compromised-user-mocksiemkasperskyedr-12547","actionType":"BLOCK","incidentId":12547,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12547-iam-block","performedAt":"2026-05-15T20:50:42.190403Z"},{"id":529,"userId":"compromised-user-mocksiemkasperskyedr-12535","actionType":"BLOCK","incidentId":12535,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12535-iam-block","performedAt":"2026-05-15T20:50:41.898474Z"},{"id":528,"userId":"compromised-user-mocksiemkasperskyedr-12507","actionType":"BLOCK","incidentId":12507,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12507-iam-block","performedAt":"2026-05-15T20:50:41.355400Z"},{"id":527,"userId":"compromised-user-mocksiemkasperskyedr-12505","actionType":"BLOCK","incidentId":12505,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12505-iam-block","performedAt":"2026-05-15T20:50:41.289894Z"},{"id":526,"userId":"compromised-user-mocksiemkasperskyedr-12488","actionType":"BLOCK","incidentId":12488,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12488-iam-block","performedAt":"2026-05-15T20:50:40.941030Z"},{"id":525,"userId":"compromised-user-mocksiemkasperskyedr-12471","actionType":"BLOCK","incidentId":12471,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12471-iam-block","performedAt":"2026-05-15T20:50:40.607781Z"},{"id":524,"userId":"compromised-user-mocksiemkasperskyedr-12465","actionType":"BLOCK","incidentId":12465,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12465-iam-block","performedAt":"2026-05-15T20:50:40.431440Z"},{"id":523,"userId":"compromised-user-mocksiemkasperskyedr-12463","actionType":"BLOCK","incidentId":12463,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12463-iam-block","performedAt":"2026-05-15T20:50:40.383758Z"},{"id":522,"userId":"compromised-user-mocksiemkasperskyedr-12454","actionType":"BLOCK","incidentId":12454,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12454-iam-block","performedAt":"2026-05-15T20:50:40.129377Z"},{"id":521,"userId":"compromised-user-mocksiemkasperskyedr-12433","actionType":"BLOCK","incidentId":12433,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12433-iam-block","performedAt":"2026-05-15T20:50:39.547487Z"},{"id":520,"userId":"compromised-user-mocksiemkasperskyedr-12427","actionType":"BLOCK","incidentId":12427,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12427-iam-block","performedAt":"2026-05-15T20:50:39.377981Z"},{"id":519,"userId":"compromised-user-mocksiemkasperskyedr-12423","actionType":"BLOCK","incidentId":12423,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12423-iam-block","performedAt":"2026-05-15T20:50:39.255221Z"},{"id":518,"userId":"compromised-user-mocksiemkasperskyedr-12381","actionType":"BLOCK","incidentId":12381,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12381-iam-block","performedAt":"2026-05-15T20:50:38.368606Z"},{"id":517,"userId":"compromised-user-mocksiemkasperskyedr-12368","actionType":"BLOCK","incidentId":12368,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12368-iam-block","performedAt":"2026-05-15T20:50:38.096393Z"},{"id":516,"userId":"compromised-user-mocksiemkasperskyedr-12341","actionType":"BLOCK","incidentId":12341,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12341-iam-block","performedAt":"2026-05-15T20:50:37.580397Z"},{"id":515,"userId":"compromised-user-mocksiemkasperskyedr-12340","actionType":"BLOCK","incidentId":12340,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12340-iam-block","performedAt":"2026-05-15T20:50:37.553362Z"},{"id":514,"userId":"compromised-user-mocksiemkasperskyedr-12327","actionType":"BLOCK","incidentId":12327,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12327-iam-block","performedAt":"2026-05-15T20:50:37.271064Z"},{"id":513,"userId":"compromised-user-mocksiemkasperskyedr-12317","actionType":"BLOCK","incidentId":12317,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12317-iam-block","performedAt":"2026-05-15T20:50:37.072949Z"},{"id":512,"userId":"compromised-user-mocksiemkasperskyedr-12298","actionType":"BLOCK","incidentId":12298,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12298-iam-block","performedAt":"2026-05-15T20:50:36.540069Z"},{"id":511,"userId":"compromised-user-mocksiemkasperskyedr-12296","actionType":"BLOCK","incidentId":12296,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12296-iam-block","performedAt":"2026-05-15T20:50:36.496534Z"},{"id":510,"userId":"compromised-user-mocksiemkasperskyedr-12291","actionType":"BLOCK","incidentId":12291,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12291-iam-block","performedAt":"2026-05-15T20:50:36.350212Z"},{"id":509,"userId":"compromised-user-mocksiemkasperskyedr-12290","actionType":"BLOCK","incidentId":12290,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12290-iam-block","performedAt":"2026-05-15T20:50:36.293487Z"},{"id":508,"userId":"compromised-user-mocksiemkasperskyedr-12271","actionType":"BLOCK","incidentId":12271,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12271-iam-block","performedAt":"2026-05-15T20:50:35.871674Z"},{"id":507,"userId":"compromised-user-mocksiemkasperskyedr-12252","actionType":"BLOCK","incidentId":12252,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12252-iam-block","performedAt":"2026-05-15T20:50:35.400360Z"},{"id":506,"userId":"compromised-user-mocksiemkasperskyedr-12240","actionType":"BLOCK","incidentId":12240,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12240-iam-block","performedAt":"2026-05-15T20:50:35.136167Z"},{"id":505,"userId":"compromised-user-mocksiemkasperskyedr-12223","actionType":"BLOCK","incidentId":12223,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12223-iam-block","performedAt":"2026-05-15T20:50:34.751830Z"},{"id":504,"userId":"compromised-user-mocksiemkasperskyedr-12221","actionType":"BLOCK","incidentId":12221,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12221-iam-block","performedAt":"2026-05-15T20:50:34.710004Z"},{"id":503,"userId":"compromised-user-mocksiemkasperskyedr-12194","actionType":"BLOCK","incidentId":12194,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12194-iam-block","performedAt":"2026-05-15T20:50:34.105424Z"},{"id":502,"userId":"compromised-user-mocksiemkasperskyedr-12182","actionType":"BLOCK","incidentId":12182,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12182-iam-block","performedAt":"2026-05-15T20:50:33.891438Z"},{"id":501,"userId":"compromised-user-mocksiemkasperskyedr-12178","actionType":"BLOCK","incidentId":12178,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12178-iam-block","performedAt":"2026-05-15T20:50:33.754857Z"},{"id":500,"userId":"compromised-user-mocksiemkasperskyedr-12158","actionType":"BLOCK","incidentId":12158,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12158-iam-block","performedAt":"2026-05-15T20:50:33.310421Z"},{"id":499,"userId":"compromised-user-mocksiemkasperskyedr-12146","actionType":"BLOCK","incidentId":12146,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12146-iam-block","performedAt":"2026-05-15T20:50:32.880443Z"},{"id":498,"userId":"compromised-user-mocksiemkasperskyedr-12143","actionType":"BLOCK","incidentId":12143,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12143-iam-block","performedAt":"2026-05-15T20:50:32.703736Z"},{"id":497,"userId":"compromised-user-mocksiemkasperskyedr-12107","actionType":"BLOCK","incidentId":12107,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12107-iam-block","performedAt":"2026-05-15T20:50:31.681406Z"},{"id":496,"userId":"compromised-user-mocksiemkasperskyedr-12103","actionType":"BLOCK","incidentId":12103,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12103-iam-block","performedAt":"2026-05-15T20:50:31.596874Z"},{"id":495,"userId":"compromised-user-mocksiemkasperskyedr-12097","actionType":"BLOCK","incidentId":12097,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12097-iam-block","performedAt":"2026-05-15T20:50:31.486630Z"},{"id":494,"userId":"compromised-user-mocksiemkasperskyedr-12073","actionType":"BLOCK","incidentId":12073,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12073-iam-block","performedAt":"2026-05-15T20:50:31.031627Z"},{"id":493,"userId":"compromised-user-mocksiemkasperskyedr-12052","actionType":"BLOCK","incidentId":12052,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12052-iam-block","performedAt":"2026-05-15T20:50:30.580437Z"},{"id":492,"userId":"compromised-user-mocksiemkasperskyedr-12043","actionType":"BLOCK","incidentId":12043,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12043-iam-block","performedAt":"2026-05-15T20:50:30.405746Z"},{"id":491,"userId":"compromised-user-mocksiemkasperskyedr-12033","actionType":"BLOCK","incidentId":12033,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12033-iam-block","performedAt":"2026-05-15T20:50:30.208280Z"},{"id":490,"userId":"compromised-user-mocksiemkasperskyedr-12030","actionType":"BLOCK","incidentId":12030,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12030-iam-block","performedAt":"2026-05-15T20:50:30.124219Z"},{"id":489,"userId":"compromised-user-mocksiemkasperskyedr-12021","actionType":"BLOCK","incidentId":12021,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12021-iam-block","performedAt":"2026-05-15T20:50:29.910563Z"},{"id":488,"userId":"compromised-user-mocksiemkasperskyedr-12013","actionType":"BLOCK","incidentId":12013,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-12013-iam-block","performedAt":"2026-05-15T20:50:29.721210Z"},{"id":487,"userId":"compromised-user-mocksiemkasperskyedr-12011","actionType":"BLOCK","incidentId":12011,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-12011-iam-block","performedAt":"2026-05-15T20:50:29.646554Z"},{"id":486,"userId":"compromised-user-mocksiemkasperskyedr-11999","actionType":"BLOCK","incidentId":11999,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11999-iam-block","performedAt":"2026-05-15T20:50:29.399700Z"},{"id":485,"userId":"compromised-user-mocksiemkasperskyedr-11987","actionType":"BLOCK","incidentId":11987,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11987-iam-block","performedAt":"2026-05-15T20:50:29.041717Z"},{"id":484,"userId":"compromised-user-mocksiemkasperskyedr-11986","actionType":"BLOCK","incidentId":11986,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11986-iam-block","performedAt":"2026-05-15T20:50:28.977376Z"},{"id":483,"userId":"compromised-user-mocksiemkasperskyedr-11962","actionType":"BLOCK","incidentId":11962,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11962-iam-block","performedAt":"2026-05-15T20:50:28.531555Z"},{"id":482,"userId":"compromised-user-mocksiemkasperskyedr-11959","actionType":"BLOCK","incidentId":11959,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11959-iam-block","performedAt":"2026-05-15T20:50:28.414010Z"},{"id":481,"userId":"compromised-user-mocksiemkasperskyedr-11958","actionType":"BLOCK","incidentId":11958,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11958-iam-block","performedAt":"2026-05-15T20:50:28.378297Z"},{"id":480,"userId":"compromised-user-mocksiemkasperskyedr-11952","actionType":"BLOCK","incidentId":11952,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11952-iam-block","performedAt":"2026-05-15T20:50:28.231884Z"},{"id":479,"userId":"compromised-user-mocksiemkasperskyedr-11927","actionType":"BLOCK","incidentId":11927,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11927-iam-block","performedAt":"2026-05-15T20:50:27.750802Z"},{"id":478,"userId":"compromised-user-mocksiemkasperskyedr-11926","actionType":"BLOCK","incidentId":11926,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11926-iam-block","performedAt":"2026-05-15T20:50:27.712601Z"},{"id":477,"userId":"compromised-user-mocksiemkasperskyedr-11912","actionType":"BLOCK","incidentId":11912,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11912-iam-block","performedAt":"2026-05-15T20:50:27.292679Z"},{"id":476,"userId":"compromised-user-mocksiemkasperskyedr-11910","actionType":"BLOCK","incidentId":11910,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11910-iam-block","performedAt":"2026-05-15T20:50:27.248318Z"},{"id":475,"userId":"compromised-user-mocksiemkasperskyedr-11907","actionType":"BLOCK","incidentId":11907,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11907-iam-block","performedAt":"2026-05-15T20:50:27.184394Z"},{"id":474,"userId":"compromised-user-mocksiemkasperskyedr-11866","actionType":"BLOCK","incidentId":11866,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11866-iam-block","performedAt":"2026-05-15T20:50:26.171102Z"},{"id":473,"userId":"compromised-user-mocksiemkasperskyedr-11862","actionType":"BLOCK","incidentId":11862,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11862-iam-block","performedAt":"2026-05-15T20:50:26.052288Z"},{"id":472,"userId":"compromised-user-mocksiemkasperskyedr-11861","actionType":"BLOCK","incidentId":11861,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11861-iam-block","performedAt":"2026-05-15T20:50:25.977362Z"},{"id":471,"userId":"compromised-user-mocksiemkasperskyedr-11848","actionType":"BLOCK","incidentId":11848,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11848-iam-block","performedAt":"2026-05-15T20:50:25.579076Z"},{"id":470,"userId":"compromised-user-mocksiemkasperskyedr-11828","actionType":"BLOCK","incidentId":11828,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11828-iam-block","performedAt":"2026-05-15T20:50:25.147452Z"},{"id":469,"userId":"compromised-user-mocksiemkasperskyedr-11824","actionType":"BLOCK","incidentId":11824,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11824-iam-block","performedAt":"2026-05-15T20:50:25.033545Z"},{"id":468,"userId":"compromised-user-mocksiemkasperskyedr-11805","actionType":"BLOCK","incidentId":11805,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11805-iam-block","performedAt":"2026-05-15T20:50:24.336565Z"},{"id":467,"userId":"compromised-user-mocksiemkasperskyedr-11803","actionType":"BLOCK","incidentId":11803,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11803-iam-block","performedAt":"2026-05-15T20:50:24.272588Z"},{"id":466,"userId":"compromised-user-mocksiemkasperskyedr-11787","actionType":"BLOCK","incidentId":11787,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11787-iam-block","performedAt":"2026-05-15T20:50:23.852928Z"},{"id":465,"userId":"compromised-user-mocksiemkasperskyedr-11782","actionType":"BLOCK","incidentId":11782,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11782-iam-block","performedAt":"2026-05-15T20:50:23.739384Z"},{"id":464,"userId":"compromised-user-mocksiemkasperskyedr-11765","actionType":"BLOCK","incidentId":11765,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11765-iam-block","performedAt":"2026-05-15T20:50:23.402781Z"},{"id":463,"userId":"compromised-user-mocksiemkasperskyedr-11757","actionType":"BLOCK","incidentId":11757,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11757-iam-block","performedAt":"2026-05-15T20:50:23.206355Z"},{"id":462,"userId":"compromised-user-mocksiemkasperskyedr-11747","actionType":"BLOCK","incidentId":11747,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11747-iam-block","performedAt":"2026-05-15T20:50:22.895970Z"},{"id":461,"userId":"compromised-user-mocksiemkasperskyedr-11733","actionType":"BLOCK","incidentId":11733,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11733-iam-block","performedAt":"2026-05-15T20:50:22.515861Z"},{"id":460,"userId":"compromised-user-mocksiemkasperskyedr-11730","actionType":"BLOCK","incidentId":11730,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11730-iam-block","performedAt":"2026-05-15T20:50:22.432591Z"},{"id":459,"userId":"compromised-user-mocksiemkasperskyedr-11718","actionType":"BLOCK","incidentId":11718,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11718-iam-block","performedAt":"2026-05-15T20:50:22.232241Z"},{"id":458,"userId":"compromised-user-mocksiemkasperskyedr-11712","actionType":"BLOCK","incidentId":11712,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11712-iam-block","performedAt":"2026-05-15T20:50:22.067279Z"},{"id":457,"userId":"compromised-user-mocksiemkasperskyedr-11700","actionType":"BLOCK","incidentId":11700,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11700-iam-block","performedAt":"2026-05-15T20:50:21.755627Z"},{"id":456,"userId":"compromised-user-mocksiemkasperskyedr-11691","actionType":"BLOCK","incidentId":11691,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11691-iam-block","performedAt":"2026-05-15T20:50:21.563569Z"},{"id":455,"userId":"compromised-user-mocksiemkasperskyedr-11656","actionType":"BLOCK","incidentId":11656,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11656-iam-block","performedAt":"2026-05-15T20:50:20.844415Z"},{"id":454,"userId":"compromised-user-mocksiemkasperskyedr-11639","actionType":"BLOCK","incidentId":11639,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11639-iam-block","performedAt":"2026-05-15T20:50:20.536236Z"},{"id":453,"userId":"compromised-user-mocksiemkasperskyedr-11638","actionType":"BLOCK","incidentId":11638,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11638-iam-block","performedAt":"2026-05-15T20:50:20.508554Z"},{"id":452,"userId":"compromised-user-mocksiemkasperskyedr-11627","actionType":"BLOCK","incidentId":11627,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11627-iam-block","performedAt":"2026-05-15T20:50:20.262093Z"},{"id":451,"userId":"compromised-user-mocksiemkasperskyedr-11619","actionType":"BLOCK","incidentId":11619,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11619-iam-block","performedAt":"2026-05-15T20:50:20.064513Z"},{"id":450,"userId":"compromised-user-mocksiemkasperskyedr-11617","actionType":"BLOCK","incidentId":11617,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11617-iam-block","performedAt":"2026-05-15T20:50:19.995378Z"},{"id":449,"userId":"compromised-user-mocksiemkasperskyedr-11584","actionType":"BLOCK","incidentId":11584,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11584-iam-block","performedAt":"2026-05-15T20:50:19.301649Z"},{"id":448,"userId":"compromised-user-mocksiemkasperskyedr-11553","actionType":"BLOCK","incidentId":11553,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11553-iam-block","performedAt":"2026-05-15T20:50:18.459830Z"},{"id":447,"userId":"compromised-user-mocksiemkasperskyedr-11548","actionType":"BLOCK","incidentId":11548,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11548-iam-block","performedAt":"2026-05-15T20:50:18.370687Z"},{"id":446,"userId":"compromised-user-mocksiemkasperskyedr-11541","actionType":"BLOCK","incidentId":11541,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11541-iam-block","performedAt":"2026-05-15T20:50:18.210986Z"},{"id":445,"userId":"compromised-user-mocksiemkasperskyedr-11531","actionType":"BLOCK","incidentId":11531,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11531-iam-block","performedAt":"2026-05-15T20:50:17.935820Z"},{"id":444,"userId":"compromised-user-mocksiemkasperskyedr-11516","actionType":"BLOCK","incidentId":11516,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11516-iam-block","performedAt":"2026-05-15T20:50:17.673504Z"},{"id":443,"userId":"compromised-user-mocksiemkasperskyedr-11511","actionType":"BLOCK","incidentId":11511,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11511-iam-block","performedAt":"2026-05-15T20:50:17.509871Z"},{"id":442,"userId":"compromised-user-mocksiemkasperskyedr-11507","actionType":"BLOCK","incidentId":11507,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11507-iam-block","performedAt":"2026-05-15T20:50:17.416355Z"},{"id":441,"userId":"compromised-user-mocksiemkasperskyedr-11492","actionType":"BLOCK","incidentId":11492,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11492-iam-block","performedAt":"2026-05-15T20:50:17.139147Z"},{"id":440,"userId":"compromised-user-mocksiemkasperskyedr-11480","actionType":"BLOCK","incidentId":11480,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11480-iam-block","performedAt":"2026-05-15T20:50:16.908812Z"},{"id":439,"userId":"compromised-user-mocksiemkasperskyedr-11473","actionType":"BLOCK","incidentId":11473,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11473-iam-block","performedAt":"2026-05-15T20:50:16.782643Z"},{"id":438,"userId":"compromised-user-mocksiemkasperskyedr-11435","actionType":"BLOCK","incidentId":11435,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11435-iam-block","performedAt":"2026-05-15T20:50:16.063262Z"},{"id":437,"userId":"compromised-user-mocksiemkasperskyedr-11431","actionType":"BLOCK","incidentId":11431,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11431-iam-block","performedAt":"2026-05-15T20:50:15.989523Z"},{"id":436,"userId":"compromised-user-mocksiemkasperskyedr-11410","actionType":"BLOCK","incidentId":11410,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11410-iam-block","performedAt":"2026-05-15T20:50:15.640294Z"},{"id":435,"userId":"compromised-user-mocksiemkasperskyedr-11407","actionType":"BLOCK","incidentId":11407,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11407-iam-block","performedAt":"2026-05-15T20:50:15.570618Z"},{"id":434,"userId":"compromised-user-mocksiemkasperskyedr-11397","actionType":"BLOCK","incidentId":11397,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11397-iam-block","performedAt":"2026-05-15T20:50:15.370413Z"},{"id":433,"userId":"compromised-user-mocksiemkasperskyedr-11363","actionType":"BLOCK","incidentId":11363,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11363-iam-block","performedAt":"2026-05-15T20:50:14.588105Z"},{"id":432,"userId":"compromised-user-mocksiemkasperskyedr-11335","actionType":"BLOCK","incidentId":11335,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11335-iam-block","performedAt":"2026-05-15T20:50:13.935719Z"},{"id":431,"userId":"compromised-user-mocksiemkasperskyedr-11313","actionType":"BLOCK","incidentId":11313,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11313-iam-block","performedAt":"2026-05-15T20:50:13.384878Z"},{"id":430,"userId":"compromised-user-mocksiemkasperskyedr-11292","actionType":"BLOCK","incidentId":11292,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11292-iam-block","performedAt":"2026-05-15T20:50:12.938975Z"},{"id":429,"userId":"compromised-user-mocksiemkasperskyedr-11273","actionType":"BLOCK","incidentId":11273,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11273-iam-block","performedAt":"2026-05-15T20:50:12.271094Z"},{"id":428,"userId":"compromised-user-mocksiemkasperskyedr-11262","actionType":"BLOCK","incidentId":11262,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11262-iam-block","performedAt":"2026-05-15T20:50:11.929020Z"},{"id":427,"userId":"compromised-user-mocksiemkasperskyedr-11246","actionType":"BLOCK","incidentId":11246,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11246-iam-block","performedAt":"2026-05-15T20:50:11.595639Z"},{"id":426,"userId":"compromised-user-mocksiemkasperskyedr-11240","actionType":"BLOCK","incidentId":11240,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11240-iam-block","performedAt":"2026-05-15T20:50:11.453313Z"},{"id":425,"userId":"compromised-user-mocksiemkasperskyedr-11231","actionType":"BLOCK","incidentId":11231,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11231-iam-block","performedAt":"2026-05-15T20:50:11.218951Z"},{"id":424,"userId":"compromised-user-mocksiemkasperskyedr-11225","actionType":"BLOCK","incidentId":11225,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11225-iam-block","performedAt":"2026-05-15T20:50:11.074867Z"},{"id":423,"userId":"compromised-user-mocksiemkasperskyedr-11214","actionType":"BLOCK","incidentId":11214,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11214-iam-block","performedAt":"2026-05-15T20:50:10.677802Z"},{"id":422,"userId":"compromised-user-mocksiemkasperskyedr-11211","actionType":"BLOCK","incidentId":11211,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11211-iam-block","performedAt":"2026-05-15T20:50:10.582383Z"},{"id":421,"userId":"compromised-user-mocksiemkasperskyedr-11206","actionType":"BLOCK","incidentId":11206,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11206-iam-block","performedAt":"2026-05-15T20:50:10.476119Z"},{"id":420,"userId":"compromised-user-mocksiemkasperskyedr-11204","actionType":"BLOCK","incidentId":11204,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11204-iam-block","performedAt":"2026-05-15T20:50:10.420867Z"},{"id":419,"userId":"compromised-user-mocksiemkasperskyedr-11193","actionType":"BLOCK","incidentId":11193,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11193-iam-block","performedAt":"2026-05-15T20:50:10.210075Z"},{"id":418,"userId":"compromised-user-mocksiemkasperskyedr-11184","actionType":"BLOCK","incidentId":11184,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11184-iam-block","performedAt":"2026-05-15T20:50:10.045507Z"},{"id":417,"userId":"compromised-user-mocksiemkasperskyedr-11165","actionType":"BLOCK","incidentId":11165,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11165-iam-block","performedAt":"2026-05-15T20:50:09.638601Z"},{"id":416,"userId":"compromised-user-mocksiemkasperskyedr-11158","actionType":"BLOCK","incidentId":11158,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11158-iam-block","performedAt":"2026-05-15T20:50:09.449975Z"},{"id":415,"userId":"compromised-user-mocksiemkasperskyedr-11146","actionType":"BLOCK","incidentId":11146,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11146-iam-block","performedAt":"2026-05-15T20:50:09.204955Z"},{"id":414,"userId":"compromised-user-mocksiemkasperskyedr-11116","actionType":"BLOCK","incidentId":11116,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11116-iam-block","performedAt":"2026-05-15T20:50:08.557046Z"},{"id":413,"userId":"compromised-user-mocksiemkasperskyedr-11114","actionType":"BLOCK","incidentId":11114,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11114-iam-block","performedAt":"2026-05-15T20:50:08.507572Z"},{"id":412,"userId":"compromised-user-mocksiemkasperskyedr-11067","actionType":"BLOCK","incidentId":11067,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-11067-iam-block","performedAt":"2026-05-15T20:50:07.309297Z"},{"id":411,"userId":"compromised-user-mocksiemkasperskyedr-11056","actionType":"BLOCK","incidentId":11056,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-11056-iam-block","performedAt":"2026-05-15T20:50:07.060620Z"},{"id":410,"userId":"compromised-user-mocksiemkasperskyedr-10997","actionType":"BLOCK","incidentId":10997,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10997-iam-block","performedAt":"2026-05-15T20:50:05.679024Z"},{"id":409,"userId":"compromised-user-mocksiemkasperskyedr-10996","actionType":"BLOCK","incidentId":10996,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10996-iam-block","performedAt":"2026-05-15T20:50:05.648352Z"},{"id":408,"userId":"compromised-user-mocksiemkasperskyedr-10992","actionType":"BLOCK","incidentId":10992,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10992-iam-block","performedAt":"2026-05-15T20:50:05.571202Z"},{"id":407,"userId":"compromised-user-mocksiemkasperskyedr-10969","actionType":"BLOCK","incidentId":10969,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10969-iam-block","performedAt":"2026-05-15T20:50:05.092682Z"},{"id":406,"userId":"compromised-user-mocksiemkasperskyedr-10967","actionType":"BLOCK","incidentId":10967,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10967-iam-block","performedAt":"2026-05-15T20:50:05.048633Z"},{"id":405,"userId":"compromised-user-mocksiemkasperskyedr-10955","actionType":"BLOCK","incidentId":10955,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10955-iam-block","performedAt":"2026-05-15T20:50:04.824065Z"},{"id":404,"userId":"compromised-user-mocksiemkasperskyedr-10950","actionType":"BLOCK","incidentId":10950,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10950-iam-block","performedAt":"2026-05-15T20:50:04.719361Z"},{"id":403,"userId":"compromised-user-mocksiemkasperskyedr-10916","actionType":"BLOCK","incidentId":10916,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10916-iam-block","performedAt":"2026-05-15T20:50:03.939950Z"},{"id":402,"userId":"compromised-user-mocksiemkasperskyedr-10905","actionType":"BLOCK","incidentId":10905,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10905-iam-block","performedAt":"2026-05-15T20:50:03.748929Z"},{"id":401,"userId":"compromised-user-mocksiemkasperskyedr-10898","actionType":"BLOCK","incidentId":10898,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10898-iam-block","performedAt":"2026-05-15T20:50:03.591654Z"},{"id":400,"userId":"compromised-user-mocksiemkasperskyedr-10876","actionType":"BLOCK","incidentId":10876,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10876-iam-block","performedAt":"2026-05-15T20:50:03.184335Z"},{"id":399,"userId":"compromised-user-mocksiemkasperskyedr-10864","actionType":"BLOCK","incidentId":10864,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10864-iam-block","performedAt":"2026-05-15T20:50:02.909718Z"},{"id":398,"userId":"compromised-user-mocksiemkasperskyedr-10863","actionType":"BLOCK","incidentId":10863,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10863-iam-block","performedAt":"2026-05-15T20:50:02.878020Z"},{"id":397,"userId":"compromised-user-mocksiemkasperskyedr-10859","actionType":"BLOCK","incidentId":10859,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10859-iam-block","performedAt":"2026-05-15T20:50:02.775592Z"},{"id":396,"userId":"compromised-user-mocksiemkasperskyedr-10819","actionType":"BLOCK","incidentId":10819,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10819-iam-block","performedAt":"2026-05-15T20:50:02.088372Z"},{"id":395,"userId":"compromised-user-mocksiemkasperskyedr-10794","actionType":"BLOCK","incidentId":10794,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10794-iam-block","performedAt":"2026-05-15T20:50:01.586084Z"},{"id":394,"userId":"compromised-user-mocksiemkasperskyedr-10789","actionType":"BLOCK","incidentId":10789,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10789-iam-block","performedAt":"2026-05-15T20:50:01.419421Z"},{"id":393,"userId":"compromised-user-mocksiemkasperskyedr-10787","actionType":"BLOCK","incidentId":10787,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10787-iam-block","performedAt":"2026-05-15T20:50:01.374615Z"},{"id":392,"userId":"compromised-user-mocksiemkasperskyedr-10770","actionType":"BLOCK","incidentId":10770,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10770-iam-block","performedAt":"2026-05-15T20:50:01.053475Z"},{"id":391,"userId":"compromised-user-mocksiemkasperskyedr-10742","actionType":"BLOCK","incidentId":10742,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10742-iam-block","performedAt":"2026-05-15T20:50:00.440334Z"},{"id":390,"userId":"compromised-user-mocksiemkasperskyedr-10727","actionType":"BLOCK","incidentId":10727,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10727-iam-block","performedAt":"2026-05-15T20:50:00.096633Z"},{"id":389,"userId":"compromised-user-mocksiemkasperskyedr-10711","actionType":"BLOCK","incidentId":10711,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10711-iam-block","performedAt":"2026-05-15T20:49:59.764681Z"},{"id":388,"userId":"compromised-user-mocksiemkasperskyedr-10694","actionType":"BLOCK","incidentId":10694,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10694-iam-block","performedAt":"2026-05-15T20:49:59.415044Z"},{"id":387,"userId":"compromised-user-mocksiemkasperskyedr-10674","actionType":"BLOCK","incidentId":10674,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10674-iam-block","performedAt":"2026-05-15T20:49:58.981950Z"},{"id":386,"userId":"compromised-user-mocksiemkasperskyedr-10666","actionType":"BLOCK","incidentId":10666,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10666-iam-block","performedAt":"2026-05-15T20:49:58.790872Z"},{"id":385,"userId":"compromised-user-mocksiemkasperskyedr-10664","actionType":"BLOCK","incidentId":10664,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10664-iam-block","performedAt":"2026-05-15T20:49:58.743238Z"},{"id":384,"userId":"compromised-user-mocksiemkasperskyedr-10657","actionType":"BLOCK","incidentId":10657,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10657-iam-block","performedAt":"2026-05-15T20:49:58.607722Z"},{"id":383,"userId":"compromised-user-mocksiemkasperskyedr-10652","actionType":"BLOCK","incidentId":10652,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10652-iam-block","performedAt":"2026-05-15T20:49:58.486680Z"},{"id":382,"userId":"compromised-user-mocksiemkasperskyedr-10620","actionType":"BLOCK","incidentId":10620,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10620-iam-block","performedAt":"2026-05-15T20:49:57.884237Z"},{"id":381,"userId":"compromised-user-mocksiemkasperskyedr-10618","actionType":"BLOCK","incidentId":10618,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10618-iam-block","performedAt":"2026-05-15T20:49:57.832707Z"},{"id":380,"userId":"compromised-user-mocksiemkasperskyedr-10597","actionType":"BLOCK","incidentId":10597,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10597-iam-block","performedAt":"2026-05-15T20:49:57.252405Z"},{"id":379,"userId":"compromised-user-mocksiemkasperskyedr-10576","actionType":"BLOCK","incidentId":10576,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10576-iam-block","performedAt":"2026-05-15T20:49:56.526335Z"},{"id":378,"userId":"compromised-user-mocksiemkasperskyedr-10575","actionType":"BLOCK","incidentId":10575,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10575-iam-block","performedAt":"2026-05-15T20:49:56.476138Z"},{"id":377,"userId":"compromised-user-mocksiemkasperskyedr-10514","actionType":"BLOCK","incidentId":10514,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10514-iam-block","performedAt":"2026-05-15T20:49:55.089063Z"},{"id":376,"userId":"compromised-user-mocksiemkasperskyedr-10488","actionType":"BLOCK","incidentId":10488,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10488-iam-block","performedAt":"2026-05-15T20:49:54.455665Z"},{"id":375,"userId":"compromised-user-mocksiemkasperskyedr-10487","actionType":"BLOCK","incidentId":10487,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10487-iam-block","performedAt":"2026-05-15T20:49:54.418475Z"},{"id":374,"userId":"compromised-user-mocksiemkasperskyedr-10483","actionType":"BLOCK","incidentId":10483,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10483-iam-block","performedAt":"2026-05-15T20:49:54.341603Z"},{"id":373,"userId":"compromised-user-mocksiemkasperskyedr-10481","actionType":"BLOCK","incidentId":10481,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10481-iam-block","performedAt":"2026-05-15T20:49:54.279891Z"},{"id":372,"userId":"compromised-user-mocksiemkasperskyedr-10477","actionType":"BLOCK","incidentId":10477,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10477-iam-block","performedAt":"2026-05-15T20:49:54.165874Z"},{"id":371,"userId":"compromised-user-mocksiemkasperskyedr-10473","actionType":"BLOCK","incidentId":10473,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10473-iam-block","performedAt":"2026-05-15T20:49:54.044799Z"},{"id":370,"userId":"compromised-user-mocksiemkasperskyedr-10439","actionType":"BLOCK","incidentId":10439,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10439-iam-block","performedAt":"2026-05-15T20:49:53.267280Z"},{"id":369,"userId":"compromised-user-mocksiemkasperskyedr-10428","actionType":"BLOCK","incidentId":10428,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10428-iam-block","performedAt":"2026-05-15T20:49:52.995650Z"},{"id":368,"userId":"compromised-user-mocksiemkasperskyedr-10427","actionType":"BLOCK","incidentId":10427,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10427-iam-block","performedAt":"2026-05-15T20:49:52.938713Z"},{"id":367,"userId":"compromised-user-mocksiemkasperskyedr-10409","actionType":"BLOCK","incidentId":10409,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10409-iam-block","performedAt":"2026-05-15T20:49:52.416311Z"},{"id":366,"userId":"compromised-user-mocksiemkasperskyedr-10367","actionType":"BLOCK","incidentId":10367,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10367-iam-block","performedAt":"2026-05-15T20:49:51.297892Z"},{"id":365,"userId":"compromised-user-mocksiemkasperskyedr-10326","actionType":"BLOCK","incidentId":10326,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10326-iam-block","performedAt":"2026-05-15T20:49:50.298770Z"},{"id":364,"userId":"compromised-user-mocksiemkasperskyedr-10314","actionType":"BLOCK","incidentId":10314,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10314-iam-block","performedAt":"2026-05-15T20:49:49.937915Z"},{"id":363,"userId":"compromised-user-mocksiemkasperskyedr-10310","actionType":"BLOCK","incidentId":10310,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10310-iam-block","performedAt":"2026-05-15T20:49:49.811372Z"},{"id":362,"userId":"compromised-user-mocksiemkasperskyedr-10302","actionType":"BLOCK","incidentId":10302,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10302-iam-block","performedAt":"2026-05-15T20:49:49.618879Z"},{"id":361,"userId":"compromised-user-mocksiemkasperskyedr-10292","actionType":"BLOCK","incidentId":10292,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10292-iam-block","performedAt":"2026-05-15T20:49:49.329530Z"},{"id":360,"userId":"compromised-user-mocksiemkasperskyedr-10229","actionType":"BLOCK","incidentId":10229,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10229-iam-block","performedAt":"2026-05-15T20:49:47.922281Z"},{"id":359,"userId":"compromised-user-mocksiemkasperskyedr-10226","actionType":"BLOCK","incidentId":10226,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10226-iam-block","performedAt":"2026-05-15T20:49:47.857358Z"},{"id":358,"userId":"compromised-user-mocksiemkasperskyedr-10220","actionType":"BLOCK","incidentId":10220,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10220-iam-block","performedAt":"2026-05-15T20:49:47.726757Z"},{"id":357,"userId":"compromised-user-mocksiemkasperskyedr-10203","actionType":"BLOCK","incidentId":10203,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10203-iam-block","performedAt":"2026-05-15T20:49:47.225086Z"},{"id":356,"userId":"compromised-user-mocksiemkasperskyedr-10142","actionType":"BLOCK","incidentId":10142,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10142-iam-block","performedAt":"2026-05-15T20:49:45.385234Z"},{"id":355,"userId":"compromised-user-mocksiemkasperskyedr-10133","actionType":"BLOCK","incidentId":10133,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10133-iam-block","performedAt":"2026-05-15T20:49:45.108747Z"},{"id":354,"userId":"compromised-user-mocksiemkasperskyedr-10100","actionType":"BLOCK","incidentId":10100,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10100-iam-block","performedAt":"2026-05-15T20:49:44.355449Z"},{"id":353,"userId":"compromised-user-mocksiemkasperskyedr-10085","actionType":"BLOCK","incidentId":10085,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10085-iam-block","performedAt":"2026-05-15T20:49:43.890718Z"},{"id":352,"userId":"compromised-user-mocksiemkasperskyedr-10077","actionType":"BLOCK","incidentId":10077,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10077-iam-block","performedAt":"2026-05-15T20:49:43.687408Z"},{"id":351,"userId":"compromised-user-mocksiemkasperskyedr-10065","actionType":"BLOCK","incidentId":10065,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10065-iam-block","performedAt":"2026-05-15T20:49:43.447809Z"},{"id":350,"userId":"compromised-user-mocksiemkasperskyedr-10051","actionType":"BLOCK","incidentId":10051,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10051-iam-block","performedAt":"2026-05-15T20:49:43.089971Z"},{"id":349,"userId":"compromised-user-mocksiemkasperskyedr-10049","actionType":"BLOCK","incidentId":10049,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-10049-iam-block","performedAt":"2026-05-15T20:49:43.027962Z"},{"id":348,"userId":"compromised-user-mocksiemkasperskyedr-10047","actionType":"BLOCK","incidentId":10047,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10047-iam-block","performedAt":"2026-05-15T20:49:42.942038Z"},{"id":347,"userId":"compromised-user-mocksiemkasperskyedr-10011","actionType":"BLOCK","incidentId":10011,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-10011-iam-block","performedAt":"2026-05-15T20:49:42.210085Z"},{"id":346,"userId":"compromised-user-mocksiemkasperskyedr-9994","actionType":"BLOCK","incidentId":9994,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9994-iam-block","performedAt":"2026-05-15T20:49:41.888924Z"},{"id":345,"userId":"compromised-user-mocksiemkasperskyedr-9979","actionType":"BLOCK","incidentId":9979,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9979-iam-block","performedAt":"2026-05-15T20:49:41.568435Z"},{"id":344,"userId":"compromised-user-mocksiemkasperskyedr-9970","actionType":"BLOCK","incidentId":9970,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9970-iam-block","performedAt":"2026-05-15T20:49:41.253010Z"},{"id":343,"userId":"compromised-user-mocksiemkasperskyedr-9968","actionType":"BLOCK","incidentId":9968,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9968-iam-block","performedAt":"2026-05-15T20:49:41.194980Z"},{"id":342,"userId":"compromised-user-mocksiemkasperskyedr-9966","actionType":"BLOCK","incidentId":9966,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9966-iam-block","performedAt":"2026-05-15T20:49:41.133720Z"},{"id":341,"userId":"compromised-user-mocksiemkasperskyedr-9964","actionType":"BLOCK","incidentId":9964,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9964-iam-block","performedAt":"2026-05-15T20:49:41.065231Z"},{"id":340,"userId":"compromised-user-mocksiemkasperskyedr-9963","actionType":"BLOCK","incidentId":9963,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9963-iam-block","performedAt":"2026-05-15T20:49:41.005823Z"},{"id":339,"userId":"compromised-user-mocksiemkasperskyedr-9958","actionType":"BLOCK","incidentId":9958,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9958-iam-block","performedAt":"2026-05-15T20:49:40.771882Z"},{"id":338,"userId":"compromised-user-mocksiemkasperskyedr-9956","actionType":"BLOCK","incidentId":9956,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9956-iam-block","performedAt":"2026-05-15T20:49:40.703102Z"},{"id":337,"userId":"compromised-user-mocksiemkasperskyedr-9943","actionType":"BLOCK","incidentId":9943,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9943-iam-block","performedAt":"2026-05-15T20:49:40.394902Z"},{"id":336,"userId":"compromised-user-mocksiemkasperskyedr-9940","actionType":"BLOCK","incidentId":9940,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9940-iam-block","performedAt":"2026-05-15T20:49:40.261571Z"},{"id":335,"userId":"compromised-user-mocksiemkasperskyedr-9934","actionType":"BLOCK","incidentId":9934,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9934-iam-block","performedAt":"2026-05-15T20:49:40.043956Z"},{"id":334,"userId":"compromised-user-mocksiemkasperskyedr-9918","actionType":"BLOCK","incidentId":9918,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9918-iam-block","performedAt":"2026-05-15T20:49:39.577245Z"},{"id":333,"userId":"compromised-user-mocksiemkasperskyedr-9908","actionType":"BLOCK","incidentId":9908,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9908-iam-block","performedAt":"2026-05-15T20:49:39.363446Z"},{"id":332,"userId":"compromised-user-mocksiemkasperskyedr-9853","actionType":"BLOCK","incidentId":9853,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9853-iam-block","performedAt":"2026-05-15T20:49:38.291745Z"},{"id":331,"userId":"compromised-user-mocksiemkasperskyedr-9847","actionType":"BLOCK","incidentId":9847,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9847-iam-block","performedAt":"2026-05-15T20:49:38.178620Z"},{"id":330,"userId":"compromised-user-mocksiemkasperskyedr-9846","actionType":"BLOCK","incidentId":9846,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9846-iam-block","performedAt":"2026-05-15T20:49:38.135478Z"},{"id":329,"userId":"compromised-user-mocksiemkasperskyedr-9812","actionType":"BLOCK","incidentId":9812,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9812-iam-block","performedAt":"2026-05-15T20:49:37.243433Z"},{"id":328,"userId":"compromised-user-mocksiemkasperskyedr-9805","actionType":"BLOCK","incidentId":9805,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9805-iam-block","performedAt":"2026-05-15T20:49:37.028936Z"},{"id":327,"userId":"compromised-user-mocksiemkasperskyedr-9799","actionType":"BLOCK","incidentId":9799,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9799-iam-block","performedAt":"2026-05-15T20:49:36.888005Z"},{"id":326,"userId":"compromised-user-mocksiemkasperskyedr-9798","actionType":"BLOCK","incidentId":9798,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9798-iam-block","performedAt":"2026-05-15T20:49:36.855777Z"},{"id":325,"userId":"compromised-user-mocksiemkasperskyedr-9782","actionType":"BLOCK","incidentId":9782,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9782-iam-block","performedAt":"2026-05-15T20:49:36.485293Z"},{"id":324,"userId":"compromised-user-mocksiemkasperskyedr-9772","actionType":"BLOCK","incidentId":9772,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9772-iam-block","performedAt":"2026-05-15T20:49:36.284040Z"},{"id":323,"userId":"compromised-user-mocksiemkasperskyedr-9767","actionType":"BLOCK","incidentId":9767,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9767-iam-block","performedAt":"2026-05-15T20:49:36.133687Z"},{"id":322,"userId":"compromised-user-mocksiemkasperskyedr-9754","actionType":"BLOCK","incidentId":9754,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9754-iam-block","performedAt":"2026-05-15T20:49:35.784239Z"},{"id":321,"userId":"compromised-user-mocksiemkasperskyedr-9751","actionType":"BLOCK","incidentId":9751,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9751-iam-block","performedAt":"2026-05-15T20:49:35.704552Z"},{"id":320,"userId":"compromised-user-mocksiemkasperskyedr-9742","actionType":"BLOCK","incidentId":9742,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9742-iam-block","performedAt":"2026-05-15T20:49:35.426488Z"},{"id":319,"userId":"compromised-user-mocksiemkasperskyedr-9731","actionType":"BLOCK","incidentId":9731,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9731-iam-block","performedAt":"2026-05-15T20:49:35.193949Z"},{"id":318,"userId":"compromised-user-mocksiemkasperskyedr-9711","actionType":"BLOCK","incidentId":9711,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9711-iam-block","performedAt":"2026-05-15T20:49:34.686861Z"},{"id":317,"userId":"compromised-user-mocksiemkasperskyedr-9706","actionType":"BLOCK","incidentId":9706,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9706-iam-block","performedAt":"2026-05-15T20:49:34.560195Z"},{"id":316,"userId":"compromised-user-mocksiemkasperskyedr-9694","actionType":"BLOCK","incidentId":9694,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9694-iam-block","performedAt":"2026-05-15T20:49:34.293812Z"},{"id":315,"userId":"compromised-user-mocksiemkasperskyedr-9689","actionType":"BLOCK","incidentId":9689,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9689-iam-block","performedAt":"2026-05-15T20:49:34.150045Z"},{"id":314,"userId":"compromised-user-mocksiemkasperskyedr-9655","actionType":"BLOCK","incidentId":9655,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9655-iam-block","performedAt":"2026-05-15T20:49:33.122685Z"},{"id":313,"userId":"compromised-user-mocksiemkasperskyedr-9648","actionType":"BLOCK","incidentId":9648,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9648-iam-block","performedAt":"2026-05-15T20:49:32.965454Z"},{"id":312,"userId":"compromised-user-mocksiemkasperskyedr-9642","actionType":"BLOCK","incidentId":9642,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9642-iam-block","performedAt":"2026-05-15T20:49:32.820038Z"},{"id":311,"userId":"compromised-user-mocksiemkasperskyedr-9614","actionType":"BLOCK","incidentId":9614,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9614-iam-block","performedAt":"2026-05-15T20:49:32.259634Z"},{"id":310,"userId":"compromised-user-mocksiemkasperskyedr-9600","actionType":"BLOCK","incidentId":9600,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9600-iam-block","performedAt":"2026-05-15T20:49:31.862981Z"},{"id":309,"userId":"compromised-user-mocksiemkasperskyedr-9577","actionType":"BLOCK","incidentId":9577,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9577-iam-block","performedAt":"2026-05-15T20:49:31.246143Z"},{"id":308,"userId":"compromised-user-mocksiemkasperskyedr-9538","actionType":"BLOCK","incidentId":9538,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9538-iam-block","performedAt":"2026-05-15T20:49:30.367390Z"},{"id":307,"userId":"compromised-user-mocksiemkasperskyedr-9532","actionType":"BLOCK","incidentId":9532,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9532-iam-block","performedAt":"2026-05-15T20:49:30.174456Z"},{"id":306,"userId":"compromised-user-mocksiemkasperskyedr-9531","actionType":"BLOCK","incidentId":9531,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9531-iam-block","performedAt":"2026-05-15T20:49:30.122378Z"},{"id":305,"userId":"compromised-user-mocksiemkasperskyedr-9530","actionType":"BLOCK","incidentId":9530,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9530-iam-block","performedAt":"2026-05-15T20:49:30.088624Z"},{"id":304,"userId":"compromised-user-mocksiemkasperskyedr-9508","actionType":"BLOCK","incidentId":9508,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9508-iam-block","performedAt":"2026-05-15T20:49:29.646899Z"},{"id":303,"userId":"compromised-user-mocksiemkasperskyedr-9507","actionType":"BLOCK","incidentId":9507,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9507-iam-block","performedAt":"2026-05-15T20:49:29.596986Z"},{"id":302,"userId":"compromised-user-mocksiemkasperskyedr-9483","actionType":"BLOCK","incidentId":9483,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9483-iam-block","performedAt":"2026-05-15T20:49:29.072624Z"},{"id":301,"userId":"compromised-user-mocksiemkasperskyedr-9447","actionType":"BLOCK","incidentId":9447,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9447-iam-block","performedAt":"2026-05-15T20:49:27.958645Z"},{"id":300,"userId":"compromised-user-mocksiemkasperskyedr-9441","actionType":"BLOCK","incidentId":9441,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9441-iam-block","performedAt":"2026-05-15T20:49:27.778205Z"},{"id":299,"userId":"compromised-user-mocksiemkasperskyedr-9426","actionType":"BLOCK","incidentId":9426,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9426-iam-block","performedAt":"2026-05-15T20:49:27.410467Z"},{"id":298,"userId":"compromised-user-mocksiemkasperskyedr-9417","actionType":"BLOCK","incidentId":9417,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9417-iam-block","performedAt":"2026-05-15T20:49:27.160843Z"},{"id":297,"userId":"compromised-user-mocksiemkasperskyedr-9415","actionType":"BLOCK","incidentId":9415,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9415-iam-block","performedAt":"2026-05-15T20:49:27.090298Z"},{"id":296,"userId":"compromised-user-mocksiemkasperskyedr-9412","actionType":"BLOCK","incidentId":9412,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9412-iam-block","performedAt":"2026-05-15T20:49:27.023544Z"},{"id":295,"userId":"compromised-user-mocksiemkasperskyedr-9409","actionType":"BLOCK","incidentId":9409,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9409-iam-block","performedAt":"2026-05-15T20:49:26.941554Z"},{"id":294,"userId":"compromised-user-mocksiemkasperskyedr-9408","actionType":"BLOCK","incidentId":9408,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9408-iam-block","performedAt":"2026-05-15T20:49:26.888984Z"},{"id":293,"userId":"compromised-user-mocksiemkasperskyedr-9331","actionType":"BLOCK","incidentId":9331,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9331-iam-block","performedAt":"2026-05-15T20:49:24.893658Z"},{"id":292,"userId":"compromised-user-mocksiemkasperskyedr-9326","actionType":"BLOCK","incidentId":9326,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9326-iam-block","performedAt":"2026-05-15T20:49:24.695698Z"},{"id":291,"userId":"compromised-user-mocksiemkasperskyedr-9314","actionType":"BLOCK","incidentId":9314,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9314-iam-block","performedAt":"2026-05-15T20:49:24.411946Z"},{"id":290,"userId":"compromised-user-mocksiemkasperskyedr-9297","actionType":"BLOCK","incidentId":9297,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9297-iam-block","performedAt":"2026-05-15T20:49:24.064880Z"},{"id":289,"userId":"compromised-user-mocksiemkasperskyedr-9277","actionType":"BLOCK","incidentId":9277,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9277-iam-block","performedAt":"2026-05-15T20:49:23.600205Z"},{"id":288,"userId":"compromised-user-mocksiemkasperskyedr-9272","actionType":"BLOCK","incidentId":9272,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9272-iam-block","performedAt":"2026-05-15T20:49:23.481818Z"},{"id":287,"userId":"compromised-user-mocksiemkasperskyedr-9264","actionType":"BLOCK","incidentId":9264,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9264-iam-block","performedAt":"2026-05-15T20:49:23.271196Z"},{"id":286,"userId":"compromised-user-mocksiemkasperskyedr-9253","actionType":"BLOCK","incidentId":9253,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9253-iam-block","performedAt":"2026-05-15T20:49:22.987830Z"},{"id":285,"userId":"compromised-user-mocksiemkasperskyedr-9245","actionType":"BLOCK","incidentId":9245,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9245-iam-block","performedAt":"2026-05-15T20:49:22.760306Z"},{"id":284,"userId":"compromised-user-mocksiemkasperskyedr-9232","actionType":"BLOCK","incidentId":9232,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9232-iam-block","performedAt":"2026-05-15T20:49:22.531993Z"},{"id":283,"userId":"compromised-user-mocksiemkasperskyedr-9216","actionType":"BLOCK","incidentId":9216,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9216-iam-block","performedAt":"2026-05-15T20:49:22.184748Z"},{"id":282,"userId":"compromised-user-mocksiemkasperskyedr-9212","actionType":"BLOCK","incidentId":9212,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9212-iam-block","performedAt":"2026-05-15T20:49:22.065592Z"},{"id":281,"userId":"compromised-user-mocksiemkasperskyedr-9211","actionType":"BLOCK","incidentId":9211,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9211-iam-block","performedAt":"2026-05-15T20:49:22.015234Z"},{"id":280,"userId":"compromised-user-mocksiemkasperskyedr-9208","actionType":"BLOCK","incidentId":9208,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9208-iam-block","performedAt":"2026-05-15T20:49:21.919789Z"},{"id":279,"userId":"compromised-user-mocksiemkasperskyedr-9198","actionType":"BLOCK","incidentId":9198,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9198-iam-block","performedAt":"2026-05-15T20:49:21.727551Z"},{"id":278,"userId":"compromised-user-mocksiemkasperskyedr-9173","actionType":"BLOCK","incidentId":9173,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9173-iam-block","performedAt":"2026-05-15T20:49:21.152438Z"},{"id":277,"userId":"compromised-user-mocksiemkasperskyedr-9166","actionType":"BLOCK","incidentId":9166,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9166-iam-block","performedAt":"2026-05-15T20:49:21.031476Z"},{"id":276,"userId":"compromised-user-mocksiemkasperskyedr-9141","actionType":"BLOCK","incidentId":9141,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9141-iam-block","performedAt":"2026-05-15T20:49:20.472868Z"},{"id":275,"userId":"compromised-user-mocksiemkasperskyedr-9137","actionType":"BLOCK","incidentId":9137,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9137-iam-block","performedAt":"2026-05-15T20:49:20.398018Z"},{"id":274,"userId":"compromised-user-mocksiemkasperskyedr-9106","actionType":"BLOCK","incidentId":9106,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9106-iam-block","performedAt":"2026-05-15T20:49:19.716877Z"},{"id":273,"userId":"compromised-user-mocksiemkasperskyedr-9086","actionType":"BLOCK","incidentId":9086,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9086-iam-block","performedAt":"2026-05-15T20:49:19.275988Z"},{"id":272,"userId":"compromised-user-mocksiemkasperskyedr-9077","actionType":"BLOCK","incidentId":9077,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-9077-iam-block","performedAt":"2026-05-15T20:49:18.961873Z"},{"id":271,"userId":"compromised-user-mocksiemkasperskyedr-9018","actionType":"BLOCK","incidentId":9018,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9018-iam-block","performedAt":"2026-05-15T20:49:17.709817Z"},{"id":270,"userId":"compromised-user-mocksiemkasperskyedr-9003","actionType":"BLOCK","incidentId":9003,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-9003-iam-block","performedAt":"2026-05-15T20:49:17.311113Z"},{"id":269,"userId":"compromised-user-mocksiemkasperskyedr-8998","actionType":"BLOCK","incidentId":8998,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8998-iam-block","performedAt":"2026-05-15T20:49:17.176379Z"},{"id":268,"userId":"compromised-user-mocksiemkasperskyedr-8994","actionType":"BLOCK","incidentId":8994,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8994-iam-block","performedAt":"2026-05-15T20:49:17.064724Z"},{"id":267,"userId":"compromised-user-mocksiemkasperskyedr-8990","actionType":"BLOCK","incidentId":8990,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8990-iam-block","performedAt":"2026-05-15T20:49:16.971124Z"},{"id":266,"userId":"compromised-user-mocksiemkasperskyedr-8969","actionType":"BLOCK","incidentId":8969,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8969-iam-block","performedAt":"2026-05-15T20:49:16.420151Z"},{"id":265,"userId":"compromised-user-mocksiemkasperskyedr-8958","actionType":"BLOCK","incidentId":8958,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8958-iam-block","performedAt":"2026-05-15T20:49:16.195193Z"},{"id":264,"userId":"compromised-user-mocksiemkasperskyedr-8944","actionType":"BLOCK","incidentId":8944,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8944-iam-block","performedAt":"2026-05-15T20:49:15.885979Z"},{"id":263,"userId":"compromised-user-mocksiemkasperskyedr-8941","actionType":"BLOCK","incidentId":8941,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8941-iam-block","performedAt":"2026-05-15T20:49:15.799745Z"},{"id":262,"userId":"compromised-user-mocksiemkasperskyedr-8930","actionType":"BLOCK","incidentId":8930,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8930-iam-block","performedAt":"2026-05-15T20:49:15.563942Z"},{"id":261,"userId":"compromised-user-mocksiemkasperskyedr-8917","actionType":"BLOCK","incidentId":8917,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8917-iam-block","performedAt":"2026-05-15T20:49:15.153002Z"},{"id":260,"userId":"compromised-user-mocksiemkasperskyedr-8915","actionType":"BLOCK","incidentId":8915,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8915-iam-block","performedAt":"2026-05-15T20:49:14.988573Z"},{"id":259,"userId":"compromised-user-mocksiemkasperskyedr-8903","actionType":"BLOCK","incidentId":8903,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8903-iam-block","performedAt":"2026-05-15T20:49:14.660024Z"},{"id":258,"userId":"compromised-user-mocksiemkasperskyedr-8870","actionType":"BLOCK","incidentId":8870,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8870-iam-block","performedAt":"2026-05-15T20:49:13.743162Z"},{"id":257,"userId":"compromised-user-mocksiemkasperskyedr-8868","actionType":"BLOCK","incidentId":8868,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8868-iam-block","performedAt":"2026-05-15T20:49:13.686428Z"},{"id":256,"userId":"compromised-user-mocksiemkasperskyedr-8862","actionType":"BLOCK","incidentId":8862,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8862-iam-block","performedAt":"2026-05-15T20:49:13.491210Z"},{"id":255,"userId":"compromised-user-mocksiemkasperskyedr-8860","actionType":"BLOCK","incidentId":8860,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8860-iam-block","performedAt":"2026-05-15T20:49:13.405202Z"},{"id":254,"userId":"compromised-user-mocksiemkasperskyedr-8848","actionType":"BLOCK","incidentId":8848,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8848-iam-block","performedAt":"2026-05-15T20:49:13.028630Z"},{"id":253,"userId":"compromised-user-mocksiemkasperskyedr-8841","actionType":"BLOCK","incidentId":8841,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8841-iam-block","performedAt":"2026-05-15T20:49:12.774821Z"},{"id":252,"userId":"compromised-user-mocksiemkasperskyedr-8836","actionType":"BLOCK","incidentId":8836,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8836-iam-block","performedAt":"2026-05-15T20:49:12.591532Z"},{"id":251,"userId":"compromised-user-mocksiemkasperskyedr-8822","actionType":"BLOCK","incidentId":8822,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8822-iam-block","performedAt":"2026-05-15T20:49:12.112966Z"},{"id":250,"userId":"compromised-user-mocksiemkasperskyedr-8819","actionType":"BLOCK","incidentId":8819,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8819-iam-block","performedAt":"2026-05-15T20:49:11.983475Z"},{"id":249,"userId":"compromised-user-mocksiemkasperskyedr-8817","actionType":"BLOCK","incidentId":8817,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8817-iam-block","performedAt":"2026-05-15T20:49:11.908770Z"},{"id":248,"userId":"compromised-user-mocksiemkasperskyedr-8811","actionType":"BLOCK","incidentId":8811,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8811-iam-block","performedAt":"2026-05-15T20:49:11.714902Z"},{"id":247,"userId":"compromised-user-mocksiemkasperskyedr-8786","actionType":"BLOCK","incidentId":8786,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8786-iam-block","performedAt":"2026-05-15T20:49:10.744383Z"},{"id":246,"userId":"compromised-user-mocksiemkasperskyedr-8770","actionType":"BLOCK","incidentId":8770,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8770-iam-block","performedAt":"2026-05-15T20:49:10.261307Z"},{"id":245,"userId":"compromised-user-mocksiemkasperskyedr-8747","actionType":"BLOCK","incidentId":8747,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8747-iam-block","performedAt":"2026-05-15T20:49:09.563895Z"},{"id":244,"userId":"compromised-user-mocksiemkasperskyedr-8742","actionType":"BLOCK","incidentId":8742,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8742-iam-block","performedAt":"2026-05-15T20:49:09.422912Z"},{"id":243,"userId":"compromised-user-mocksiemkasperskyedr-8736","actionType":"BLOCK","incidentId":8736,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8736-iam-block","performedAt":"2026-05-15T20:49:09.209087Z"},{"id":242,"userId":"compromised-user-mocksiemkasperskyedr-8705","actionType":"BLOCK","incidentId":8705,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8705-iam-block","performedAt":"2026-05-15T20:49:08.489659Z"},{"id":241,"userId":"compromised-user-mocksiemkasperskyedr-8667","actionType":"BLOCK","incidentId":8667,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8667-iam-block","performedAt":"2026-05-15T20:49:07.625518Z"},{"id":240,"userId":"compromised-user-mocksiemkasperskyedr-8651","actionType":"BLOCK","incidentId":8651,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8651-iam-block","performedAt":"2026-05-15T20:49:07.196100Z"},{"id":239,"userId":"compromised-user-mocksiemkasperskyedr-8648","actionType":"BLOCK","incidentId":8648,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8648-iam-block","performedAt":"2026-05-15T20:49:07.125871Z"},{"id":238,"userId":"compromised-user-mocksiemkasperskyedr-8646","actionType":"BLOCK","incidentId":8646,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8646-iam-block","performedAt":"2026-05-15T20:49:07.068058Z"},{"id":237,"userId":"compromised-user-mocksiemkasperskyedr-8636","actionType":"BLOCK","incidentId":8636,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8636-iam-block","performedAt":"2026-05-15T20:49:06.794065Z"},{"id":236,"userId":"compromised-user-mocksiemkasperskyedr-8633","actionType":"BLOCK","incidentId":8633,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8633-iam-block","performedAt":"2026-05-15T20:49:06.706206Z"},{"id":235,"userId":"compromised-user-mocksiemkasperskyedr-8623","actionType":"BLOCK","incidentId":8623,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8623-iam-block","performedAt":"2026-05-15T20:49:06.500617Z"},{"id":234,"userId":"compromised-user-mocksiemkasperskyedr-8606","actionType":"BLOCK","incidentId":8606,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8606-iam-block","performedAt":"2026-05-15T20:49:06.053067Z"},{"id":233,"userId":"compromised-user-mocksiemkasperskyedr-8597","actionType":"BLOCK","incidentId":8597,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8597-iam-block","performedAt":"2026-05-15T20:49:05.787690Z"},{"id":232,"userId":"compromised-user-mocksiemkasperskyedr-8536","actionType":"BLOCK","incidentId":8536,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8536-iam-block","performedAt":"2026-05-15T20:49:04.411696Z"},{"id":231,"userId":"compromised-user-mocksiemkasperskyedr-8511","actionType":"BLOCK","incidentId":8511,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8511-iam-block","performedAt":"2026-05-15T20:49:03.756501Z"},{"id":230,"userId":"compromised-user-mocksiemkasperskyedr-8494","actionType":"BLOCK","incidentId":8494,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8494-iam-block","performedAt":"2026-05-15T20:49:03.358765Z"},{"id":229,"userId":"compromised-user-mocksiemkasperskyedr-8479","actionType":"BLOCK","incidentId":8479,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8479-iam-block","performedAt":"2026-05-15T20:49:03.013514Z"},{"id":228,"userId":"compromised-user-mocksiemkasperskyedr-8474","actionType":"BLOCK","incidentId":8474,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8474-iam-block","performedAt":"2026-05-15T20:49:02.895648Z"},{"id":227,"userId":"compromised-user-mocksiemkasperskyedr-8458","actionType":"BLOCK","incidentId":8458,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8458-iam-block","performedAt":"2026-05-15T20:49:02.559634Z"},{"id":226,"userId":"compromised-user-mocksiemkasperskyedr-8447","actionType":"BLOCK","incidentId":8447,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8447-iam-block","performedAt":"2026-05-15T20:49:02.305058Z"},{"id":225,"userId":"compromised-user-mocksiemkasperskyedr-8444","actionType":"BLOCK","incidentId":8444,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8444-iam-block","performedAt":"2026-05-15T20:49:02.233700Z"},{"id":224,"userId":"compromised-user-mocksiemkasperskyedr-8441","actionType":"BLOCK","incidentId":8441,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8441-iam-block","performedAt":"2026-05-15T20:49:02.165666Z"},{"id":223,"userId":"compromised-user-mocksiemkasperskyedr-8430","actionType":"BLOCK","incidentId":8430,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8430-iam-block","performedAt":"2026-05-15T20:49:01.911911Z"},{"id":222,"userId":"compromised-user-mocksiemkasperskyedr-8412","actionType":"BLOCK","incidentId":8412,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8412-iam-block","performedAt":"2026-05-15T20:49:01.546672Z"},{"id":221,"userId":"compromised-user-mocksiemkasperskyedr-8396","actionType":"BLOCK","incidentId":8396,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8396-iam-block","performedAt":"2026-05-15T20:49:01.179018Z"},{"id":220,"userId":"compromised-user-mocksiemkasperskyedr-8384","actionType":"BLOCK","incidentId":8384,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8384-iam-block","performedAt":"2026-05-15T20:49:00.891038Z"},{"id":219,"userId":"compromised-user-mocksiemkasperskyedr-8361","actionType":"BLOCK","incidentId":8361,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8361-iam-block","performedAt":"2026-05-15T20:49:00.339934Z"},{"id":218,"userId":"compromised-user-mocksiemkasperskyedr-8359","actionType":"BLOCK","incidentId":8359,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8359-iam-block","performedAt":"2026-05-15T20:49:00.189674Z"},{"id":217,"userId":"compromised-user-mocksiemkasperskyedr-8333","actionType":"BLOCK","incidentId":8333,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8333-iam-block","performedAt":"2026-05-15T20:48:59.509893Z"},{"id":216,"userId":"compromised-user-mocksiemkasperskyedr-8331","actionType":"BLOCK","incidentId":8331,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8331-iam-block","performedAt":"2026-05-15T20:48:59.455715Z"},{"id":215,"userId":"compromised-user-mocksiemkasperskyedr-8303","actionType":"BLOCK","incidentId":8303,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8303-iam-block","performedAt":"2026-05-15T20:48:58.730159Z"},{"id":214,"userId":"compromised-user-mocksiemkasperskyedr-8302","actionType":"BLOCK","incidentId":8302,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8302-iam-block","performedAt":"2026-05-15T20:48:58.698137Z"},{"id":213,"userId":"compromised-user-mocksiemkasperskyedr-8298","actionType":"BLOCK","incidentId":8298,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8298-iam-block","performedAt":"2026-05-15T20:48:58.598623Z"},{"id":212,"userId":"compromised-user-mocksiemkasperskyedr-8284","actionType":"BLOCK","incidentId":8284,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8284-iam-block","performedAt":"2026-05-15T20:48:58.265954Z"},{"id":211,"userId":"compromised-user-mocksiemkasperskyedr-8280","actionType":"BLOCK","incidentId":8280,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8280-iam-block","performedAt":"2026-05-15T20:48:58.173514Z"},{"id":210,"userId":"compromised-user-mocksiemkasperskyedr-8275","actionType":"BLOCK","incidentId":8275,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8275-iam-block","performedAt":"2026-05-15T20:48:58.029640Z"},{"id":209,"userId":"compromised-user-mocksiemkasperskyedr-8271","actionType":"BLOCK","incidentId":8271,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8271-iam-block","performedAt":"2026-05-15T20:48:57.905859Z"},{"id":208,"userId":"compromised-user-mocksiemkasperskyedr-8250","actionType":"BLOCK","incidentId":8250,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8250-iam-block","performedAt":"2026-05-15T20:48:57.425274Z"},{"id":207,"userId":"compromised-user-mocksiemkasperskyedr-8236","actionType":"BLOCK","incidentId":8236,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8236-iam-block","performedAt":"2026-05-15T20:48:57.052603Z"},{"id":206,"userId":"compromised-user-mocksiemkasperskyedr-8232","actionType":"BLOCK","incidentId":8232,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8232-iam-block","performedAt":"2026-05-15T20:48:56.924456Z"},{"id":205,"userId":"compromised-user-mocksiemkasperskyedr-8221","actionType":"BLOCK","incidentId":8221,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8221-iam-block","performedAt":"2026-05-15T20:48:56.690228Z"},{"id":204,"userId":"compromised-user-mocksiemkasperskyedr-8198","actionType":"BLOCK","incidentId":8198,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8198-iam-block","performedAt":"2026-05-15T20:48:56.119532Z"},{"id":203,"userId":"compromised-user-mocksiemkasperskyedr-8197","actionType":"BLOCK","incidentId":8197,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8197-iam-block","performedAt":"2026-05-15T20:48:56.069695Z"},{"id":202,"userId":"compromised-user-mocksiemkasperskyedr-8174","actionType":"BLOCK","incidentId":8174,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8174-iam-block","performedAt":"2026-05-15T20:48:55.432472Z"},{"id":201,"userId":"compromised-user-mocksiemkasperskyedr-8150","actionType":"BLOCK","incidentId":8150,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8150-iam-block","performedAt":"2026-05-15T20:48:54.810545Z"},{"id":200,"userId":"compromised-user-mocksiemkasperskyedr-8120","actionType":"BLOCK","incidentId":8120,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-8120-iam-block","performedAt":"2026-05-15T20:48:54.059163Z"},{"id":199,"userId":"compromised-user-mocksiemkasperskyedr-8103","actionType":"BLOCK","incidentId":8103,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8103-iam-block","performedAt":"2026-05-15T20:48:53.673373Z"},{"id":198,"userId":"compromised-user-mocksiemkasperskyedr-8096","actionType":"BLOCK","incidentId":8096,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8096-iam-block","performedAt":"2026-05-15T20:48:53.527326Z"},{"id":197,"userId":"compromised-user-mocksiemkasperskyedr-8065","actionType":"BLOCK","incidentId":8065,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8065-iam-block","performedAt":"2026-05-15T20:48:52.410374Z"},{"id":196,"userId":"compromised-user-mocksiemkasperskyedr-8063","actionType":"BLOCK","incidentId":8063,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8063-iam-block","performedAt":"2026-05-15T20:48:52.288605Z"},{"id":195,"userId":"compromised-user-mocksiemkasperskyedr-8042","actionType":"BLOCK","incidentId":8042,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8042-iam-block","performedAt":"2026-05-15T20:48:51.768588Z"},{"id":194,"userId":"compromised-user-mocksiemkasperskyedr-8038","actionType":"BLOCK","incidentId":8038,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-8038-iam-block","performedAt":"2026-05-15T20:48:51.690158Z"},{"id":193,"userId":"compromised-user-mocksiemkasperskyedr-7987","actionType":"BLOCK","incidentId":7987,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7987-iam-block","performedAt":"2026-05-15T20:48:50.409771Z"},{"id":192,"userId":"compromised-user-mocksiemkasperskyedr-7972","actionType":"BLOCK","incidentId":7972,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7972-iam-block","performedAt":"2026-05-15T20:48:50.101107Z"},{"id":191,"userId":"compromised-user-mocksiemkasperskyedr-7970","actionType":"BLOCK","incidentId":7970,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7970-iam-block","performedAt":"2026-05-15T20:48:50.051522Z"},{"id":190,"userId":"compromised-user-mocksiemkasperskyedr-7946","actionType":"BLOCK","incidentId":7946,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7946-iam-block","performedAt":"2026-05-15T20:48:49.542754Z"},{"id":189,"userId":"compromised-user-mocksiemkasperskyedr-7944","actionType":"BLOCK","incidentId":7944,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7944-iam-block","performedAt":"2026-05-15T20:48:49.485142Z"},{"id":188,"userId":"compromised-user-mocksiemkasperskyedr-7940","actionType":"BLOCK","incidentId":7940,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7940-iam-block","performedAt":"2026-05-15T20:48:49.373368Z"},{"id":187,"userId":"compromised-user-mocksiemkasperskyedr-7933","actionType":"BLOCK","incidentId":7933,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7933-iam-block","performedAt":"2026-05-15T20:48:49.227556Z"},{"id":186,"userId":"compromised-user-mocksiemkasperskyedr-7928","actionType":"BLOCK","incidentId":7928,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7928-iam-block","performedAt":"2026-05-15T20:48:49.087721Z"},{"id":185,"userId":"compromised-user-mocksiemkasperskyedr-7889","actionType":"BLOCK","incidentId":7889,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7889-iam-block","performedAt":"2026-05-15T20:48:47.942364Z"},{"id":184,"userId":"compromised-user-mocksiemkasperskyedr-7872","actionType":"BLOCK","incidentId":7872,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7872-iam-block","performedAt":"2026-05-15T20:48:47.283814Z"},{"id":183,"userId":"compromised-user-mocksiemkasperskyedr-7784","actionType":"BLOCK","incidentId":7784,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7784-iam-block","performedAt":"2026-05-15T20:48:44.607230Z"},{"id":182,"userId":"compromised-user-mocksiemkasperskyedr-7773","actionType":"BLOCK","incidentId":7773,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7773-iam-block","performedAt":"2026-05-15T20:48:44.362724Z"},{"id":181,"userId":"compromised-user-mocksiemkasperskyedr-7770","actionType":"BLOCK","incidentId":7770,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7770-iam-block","performedAt":"2026-05-15T20:48:44.265334Z"},{"id":180,"userId":"compromised-user-mocksiemkasperskyedr-7769","actionType":"BLOCK","incidentId":7769,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7769-iam-block","performedAt":"2026-05-15T20:48:44.228839Z"},{"id":179,"userId":"compromised-user-mocksiemkasperskyedr-7752","actionType":"BLOCK","incidentId":7752,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7752-iam-block","performedAt":"2026-05-15T20:48:43.773485Z"},{"id":178,"userId":"compromised-user-mocksiemkasperskyedr-7732","actionType":"BLOCK","incidentId":7732,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7732-iam-block","performedAt":"2026-05-15T20:48:43.342876Z"},{"id":177,"userId":"compromised-user-mocksiemkasperskyedr-7731","actionType":"BLOCK","incidentId":7731,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7731-iam-block","performedAt":"2026-05-15T20:48:43.292006Z"},{"id":176,"userId":"compromised-user-mocksiemkasperskyedr-7728","actionType":"BLOCK","incidentId":7728,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7728-iam-block","performedAt":"2026-05-15T20:48:43.223528Z"},{"id":175,"userId":"compromised-user-mocksiemkasperskyedr-7725","actionType":"BLOCK","incidentId":7725,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7725-iam-block","performedAt":"2026-05-15T20:48:43.137613Z"},{"id":174,"userId":"compromised-user-mocksiemkasperskyedr-7721","actionType":"BLOCK","incidentId":7721,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7721-iam-block","performedAt":"2026-05-15T20:48:43.018213Z"},{"id":173,"userId":"compromised-user-mocksiemkasperskyedr-7687","actionType":"BLOCK","incidentId":7687,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7687-iam-block","performedAt":"2026-05-15T20:48:42.116583Z"},{"id":172,"userId":"compromised-user-mocksiemkasperskyedr-7684","actionType":"BLOCK","incidentId":7684,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7684-iam-block","performedAt":"2026-05-15T20:48:41.976121Z"},{"id":171,"userId":"compromised-user-mocksiemkasperskyedr-7669","actionType":"BLOCK","incidentId":7669,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7669-iam-block","performedAt":"2026-05-15T20:48:41.439470Z"},{"id":170,"userId":"compromised-user-mocksiemkasperskyedr-7659","actionType":"BLOCK","incidentId":7659,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7659-iam-block","performedAt":"2026-05-15T20:48:40.992920Z"},{"id":169,"userId":"compromised-user-mocksiemkasperskyedr-7626","actionType":"BLOCK","incidentId":7626,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7626-iam-block","performedAt":"2026-05-15T20:48:39.464587Z"},{"id":168,"userId":"compromised-user-mocksiemkasperskyedr-7604","actionType":"BLOCK","incidentId":7604,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7604-iam-block","performedAt":"2026-05-15T20:48:38.137644Z"},{"id":167,"userId":"compromised-user-mocksiemkasperskyedr-7599","actionType":"BLOCK","incidentId":7599,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7599-iam-block","performedAt":"2026-05-15T20:48:37.732308Z"},{"id":166,"userId":"compromised-user-mocksiemkasperskyedr-7586","actionType":"BLOCK","incidentId":7586,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7586-iam-block","performedAt":"2026-05-15T20:48:36.963695Z"},{"id":165,"userId":"compromised-user-mocksiemkasperskyedr-7582","actionType":"BLOCK","incidentId":7582,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7582-iam-block","performedAt":"2026-05-15T20:48:36.726491Z"},{"id":164,"userId":"compromised-user-mocksiemkasperskyedr-7578","actionType":"BLOCK","incidentId":7578,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7578-iam-block","performedAt":"2026-05-15T20:48:06.639046Z"},{"id":163,"userId":"compromised-user-mocksiemkasperskyedr-7575","actionType":"BLOCK","incidentId":7575,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7575-iam-block","performedAt":"2026-05-15T20:48:03.613569Z"},{"id":162,"userId":"compromised-user-mocksiemkasperskyedr-7568","actionType":"BLOCK","incidentId":7568,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7568-iam-block","performedAt":"2026-05-15T20:47:56.617291Z"},{"id":161,"userId":"compromised-user-mocksiemkasperskyedr-7556","actionType":"BLOCK","incidentId":7556,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7556-iam-block","performedAt":"2026-05-15T20:47:44.630393Z"},{"id":160,"userId":"compromised-user-mocksiemkasperskyedr-7530","actionType":"BLOCK","incidentId":7530,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7530-iam-block","performedAt":"2026-05-15T20:47:37.924339Z"},{"id":159,"userId":"compromised-user-mocksiemkasperskyedr-7529","actionType":"BLOCK","incidentId":7529,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7529-iam-block","performedAt":"2026-05-15T20:47:37.876495Z"},{"id":158,"userId":"compromised-user-mocksiemkasperskyedr-7511","actionType":"BLOCK","incidentId":7511,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7511-iam-block","performedAt":"2026-05-15T20:47:37.258350Z"},{"id":157,"userId":"compromised-user-mocksiemkasperskyedr-7499","actionType":"BLOCK","incidentId":7499,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7499-iam-block","performedAt":"2026-05-15T20:47:36.989156Z"},{"id":156,"userId":"compromised-user-mocksiemkasperskyedr-7483","actionType":"BLOCK","incidentId":7483,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7483-iam-block","performedAt":"2026-05-15T20:47:36.575705Z"},{"id":155,"userId":"compromised-user-mocksiemkasperskyedr-7428","actionType":"BLOCK","incidentId":7428,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7428-iam-block","performedAt":"2026-05-15T20:47:15.618935Z"},{"id":154,"userId":"compromised-user-mocksiemkasperskyedr-7392","actionType":"BLOCK","incidentId":7392,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7392-iam-block","performedAt":"2026-05-15T20:46:39.614353Z"},{"id":153,"userId":"compromised-user-mocksiemkasperskyedr-7355","actionType":"BLOCK","incidentId":7355,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7355-iam-block","performedAt":"2026-05-15T20:46:02.611905Z"},{"id":152,"userId":"compromised-user-mocksiemkasperskyedr-7352","actionType":"BLOCK","incidentId":7352,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7352-iam-block","performedAt":"2026-05-15T20:45:59.611438Z"},{"id":151,"userId":"compromised-user-mocksiemkasperskyedr-7348","actionType":"BLOCK","incidentId":7348,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7348-iam-block","performedAt":"2026-05-15T20:45:55.624034Z"},{"id":150,"userId":"compromised-user-mocksiemkasperskyedr-7342","actionType":"BLOCK","incidentId":7342,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7342-iam-block","performedAt":"2026-05-15T20:45:49.610116Z"},{"id":149,"userId":"compromised-user-mocksiemkasperskyedr-7339","actionType":"BLOCK","incidentId":7339,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7339-iam-block","performedAt":"2026-05-15T20:45:46.663647Z"},{"id":148,"userId":"compromised-user-mocksiemkasperskyedr-7334","actionType":"BLOCK","incidentId":7334,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7334-iam-block","performedAt":"2026-05-15T20:45:41.608666Z"},{"id":147,"userId":"compromised-user-mocksiemkasperskyedr-7333","actionType":"BLOCK","incidentId":7333,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7333-iam-block","performedAt":"2026-05-15T20:45:40.630831Z"},{"id":146,"userId":"compromised-user-mocksiemkasperskyedr-7273","actionType":"BLOCK","incidentId":7273,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7273-iam-block","performedAt":"2026-05-15T20:44:40.615070Z"},{"id":145,"userId":"compromised-user-mocksiemkasperskyedr-7272","actionType":"BLOCK","incidentId":7272,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7272-iam-block","performedAt":"2026-05-15T20:44:39.613365Z"},{"id":144,"userId":"compromised-user-mocksiemkasperskyedr-7269","actionType":"BLOCK","incidentId":7269,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7269-iam-block","performedAt":"2026-05-15T20:44:36.613483Z"},{"id":143,"userId":"compromised-user-mocksiemkasperskyedr-7267","actionType":"BLOCK","incidentId":7267,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7267-iam-block","performedAt":"2026-05-15T20:44:34.644067Z"},{"id":142,"userId":"compromised-user-mocksiemkasperskyedr-7261","actionType":"BLOCK","incidentId":7261,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7261-iam-block","performedAt":"2026-05-15T20:44:28.622124Z"},{"id":141,"userId":"compromised-user-mocksiemkasperskyedr-7230","actionType":"BLOCK","incidentId":7230,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7230-iam-block","performedAt":"2026-05-15T20:43:57.621832Z"},{"id":140,"userId":"compromised-user-mocksiemkasperskyedr-7226","actionType":"BLOCK","incidentId":7226,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7226-iam-block","performedAt":"2026-05-15T20:43:53.606682Z"},{"id":139,"userId":"compromised-user-mocksiemkasperskyedr-7220","actionType":"BLOCK","incidentId":7220,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7220-iam-block","performedAt":"2026-05-15T20:43:47.617147Z"},{"id":138,"userId":"compromised-user-mocksiemkasperskyedr-7216","actionType":"BLOCK","incidentId":7216,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7216-iam-block","performedAt":"2026-05-15T20:43:43.606971Z"},{"id":137,"userId":"compromised-user-mocksiemkasperskyedr-7207","actionType":"BLOCK","incidentId":7207,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7207-iam-block","performedAt":"2026-05-15T20:43:34.612525Z"},{"id":136,"userId":"compromised-user-mocksiemkasperskyedr-7190","actionType":"BLOCK","incidentId":7190,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7190-iam-block","performedAt":"2026-05-15T20:43:17.606696Z"},{"id":135,"userId":"compromised-user-mocksiemkasperskyedr-7176","actionType":"BLOCK","incidentId":7176,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7176-iam-block","performedAt":"2026-05-15T20:43:03.666037Z"},{"id":134,"userId":"compromised-user-mocksiemkasperskyedr-7172","actionType":"BLOCK","incidentId":7172,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7172-iam-block","performedAt":"2026-05-15T20:42:59.657305Z"},{"id":133,"userId":"compromised-user-mocksiemkasperskyedr-7168","actionType":"BLOCK","incidentId":7168,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7168-iam-block","performedAt":"2026-05-15T20:42:55.610576Z"},{"id":132,"userId":"compromised-user-mocksiemkasperskyedr-7154","actionType":"BLOCK","incidentId":7154,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7154-iam-block","performedAt":"2026-05-15T20:42:41.622689Z"},{"id":131,"userId":"compromised-user-mocksiemkasperskyedr-7144","actionType":"BLOCK","incidentId":7144,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7144-iam-block","performedAt":"2026-05-15T20:42:31.639044Z"},{"id":130,"userId":"compromised-user-mocksiemkasperskyedr-7135","actionType":"BLOCK","incidentId":7135,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7135-iam-block","performedAt":"2026-05-15T20:42:22.607822Z"},{"id":129,"userId":"compromised-user-mocksiemkasperskyedr-7121","actionType":"BLOCK","incidentId":7121,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7121-iam-block","performedAt":"2026-05-15T20:42:08.603538Z"},{"id":128,"userId":"compromised-user-mocksiemkasperskyedr-7120","actionType":"BLOCK","incidentId":7120,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7120-iam-block","performedAt":"2026-05-15T20:42:07.627112Z"},{"id":127,"userId":"compromised-user-mocksiemkasperskyedr-7118","actionType":"BLOCK","incidentId":7118,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7118-iam-block","performedAt":"2026-05-15T20:42:05.615966Z"},{"id":126,"userId":"compromised-user-mocksiemkasperskyedr-7116","actionType":"BLOCK","incidentId":7116,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7116-iam-block","performedAt":"2026-05-15T20:42:03.617875Z"},{"id":125,"userId":"compromised-user-mocksiemkasperskyedr-7090","actionType":"BLOCK","incidentId":7090,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7090-iam-block","performedAt":"2026-05-15T20:41:37.628585Z"},{"id":124,"userId":"compromised-user-mocksiemkasperskyedr-7089","actionType":"BLOCK","incidentId":7089,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7089-iam-block","performedAt":"2026-05-15T20:41:36.614538Z"},{"id":123,"userId":"compromised-user-mocksiemkasperskyedr-7083","actionType":"BLOCK","incidentId":7083,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7083-iam-block","performedAt":"2026-05-15T20:41:30.619872Z"},{"id":122,"userId":"compromised-user-mocksiemkasperskyedr-7074","actionType":"BLOCK","incidentId":7074,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7074-iam-block","performedAt":"2026-05-15T20:41:21.617916Z"},{"id":121,"userId":"compromised-user-mocksiemkasperskyedr-7071","actionType":"BLOCK","incidentId":7071,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7071-iam-block","performedAt":"2026-05-15T20:41:18.625691Z"},{"id":120,"userId":"compromised-user-mocksiemkasperskyedr-7057","actionType":"BLOCK","incidentId":7057,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7057-iam-block","performedAt":"2026-05-15T20:41:04.636747Z"},{"id":119,"userId":"compromised-user-mocksiemkasperskyedr-7033","actionType":"BLOCK","incidentId":7033,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-7033-iam-block","performedAt":"2026-05-15T20:40:40.630237Z"},{"id":118,"userId":"compromised-user-mocksiemkasperskyedr-7030","actionType":"BLOCK","incidentId":7030,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7030-iam-block","performedAt":"2026-05-15T20:40:37.617967Z"},{"id":117,"userId":"compromised-user-mocksiemkasperskyedr-7009","actionType":"BLOCK","incidentId":7009,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-7009-iam-block","performedAt":"2026-05-15T20:40:16.625604Z"},{"id":116,"userId":"compromised-user-mocksiemkasperskyedr-6989","actionType":"BLOCK","incidentId":6989,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6989-iam-block","performedAt":"2026-05-15T20:39:56.618418Z"},{"id":115,"userId":"compromised-user-mocksiemkasperskyedr-6987","actionType":"BLOCK","incidentId":6987,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6987-iam-block","performedAt":"2026-05-15T20:39:54.617089Z"},{"id":114,"userId":"compromised-user-mocksiemkasperskyedr-6982","actionType":"BLOCK","incidentId":6982,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6982-iam-block","performedAt":"2026-05-15T20:39:49.645847Z"},{"id":113,"userId":"compromised-user-mocksiemkasperskyedr-6975","actionType":"BLOCK","incidentId":6975,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6975-iam-block","performedAt":"2026-05-15T20:39:42.608861Z"},{"id":112,"userId":"compromised-user-mocksiemkasperskyedr-6971","actionType":"BLOCK","incidentId":6971,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6971-iam-block","performedAt":"2026-05-15T20:39:38.622017Z"},{"id":111,"userId":"compromised-user-mocksiemkasperskyedr-6927","actionType":"BLOCK","incidentId":6927,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6927-iam-block","performedAt":"2026-05-15T20:38:54.615587Z"},{"id":110,"userId":"compromised-user-mocksiemkasperskyedr-6904","actionType":"BLOCK","incidentId":6904,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6904-iam-block","performedAt":"2026-05-15T20:38:31.630394Z"},{"id":109,"userId":"compromised-user-mocksiemkasperskyedr-6894","actionType":"BLOCK","incidentId":6894,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6894-iam-block","performedAt":"2026-05-15T20:38:21.615646Z"},{"id":108,"userId":"compromised-user-mocksiemkasperskyedr-6861","actionType":"BLOCK","incidentId":6861,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6861-iam-block","performedAt":"2026-05-15T20:37:48.650449Z"},{"id":107,"userId":"compromised-user-mocksiemkasperskyedr-6856","actionType":"BLOCK","incidentId":6856,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6856-iam-block","performedAt":"2026-05-15T20:37:36.293919Z"},{"id":106,"userId":"compromised-user-mocksiemkasperskyedr-6831","actionType":"BLOCK","incidentId":6831,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6831-iam-block","performedAt":"2026-05-15T20:37:11.276545Z"},{"id":105,"userId":"compromised-user-mocksiemkasperskyedr-6828","actionType":"BLOCK","incidentId":6828,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6828-iam-block","performedAt":"2026-05-15T20:37:08.267678Z"},{"id":104,"userId":"compromised-user-mocksiemkasperskyedr-6812","actionType":"BLOCK","incidentId":6812,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6812-iam-block","performedAt":"2026-05-15T20:36:52.255029Z"},{"id":103,"userId":"compromised-user-mocksiemkasperskyedr-6796","actionType":"BLOCK","incidentId":6796,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6796-iam-block","performedAt":"2026-05-15T20:36:36.284888Z"},{"id":102,"userId":"compromised-user-mocksiemkasperskyedr-6790","actionType":"BLOCK","incidentId":6790,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6790-iam-block","performedAt":"2026-05-15T20:36:30.275324Z"},{"id":101,"userId":"compromised-user-mocksiemkasperskyedr-6778","actionType":"BLOCK","incidentId":6778,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6778-iam-block","performedAt":"2026-05-15T20:36:18.263351Z"},{"id":100,"userId":"compromised-user-mocksiemkasperskyedr-6774","actionType":"BLOCK","incidentId":6774,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6774-iam-block","performedAt":"2026-05-15T20:36:14.274589Z"},{"id":99,"userId":"compromised-user-mocksiemkasperskyedr-6772","actionType":"BLOCK","incidentId":6772,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6772-iam-block","performedAt":"2026-05-15T20:36:12.268539Z"},{"id":98,"userId":"compromised-user-mocksiemkasperskyedr-6751","actionType":"BLOCK","incidentId":6751,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6751-iam-block","performedAt":"2026-05-15T20:35:51.287695Z"},{"id":97,"userId":"compromised-user-mocksiemkasperskyedr-6749","actionType":"BLOCK","incidentId":6749,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6749-iam-block","performedAt":"2026-05-15T20:35:49.259051Z"},{"id":96,"userId":"compromised-user-mocksiemkasperskyedr-6748","actionType":"BLOCK","incidentId":6748,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6748-iam-block","performedAt":"2026-05-15T20:35:48.271511Z"},{"id":95,"userId":"compromised-user-mocksiemkasperskyedr-6739","actionType":"BLOCK","incidentId":6739,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6739-iam-block","performedAt":"2026-05-15T20:35:39.281494Z"},{"id":94,"userId":"compromised-user-mocksiemkasperskyedr-6730","actionType":"BLOCK","incidentId":6730,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6730-iam-block","performedAt":"2026-05-15T20:35:30.269678Z"},{"id":93,"userId":"compromised-user-mocksiemkasperskyedr-6713","actionType":"BLOCK","incidentId":6713,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6713-iam-block","performedAt":"2026-05-15T20:35:13.261677Z"},{"id":92,"userId":"compromised-user-mocksiemkasperskyedr-6704","actionType":"BLOCK","incidentId":6704,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6704-iam-block","performedAt":"2026-05-15T20:35:04.272165Z"},{"id":91,"userId":"compromised-user-mocksiemkasperskyedr-6701","actionType":"BLOCK","incidentId":6701,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6701-iam-block","performedAt":"2026-05-15T20:35:01.263851Z"},{"id":90,"userId":"compromised-user-mocksiemkasperskyedr-6700","actionType":"BLOCK","incidentId":6700,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6700-iam-block","performedAt":"2026-05-15T20:35:00.268122Z"},{"id":89,"userId":"compromised-user-mocksiemkasperskyedr-6695","actionType":"BLOCK","incidentId":6695,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6695-iam-block","performedAt":"2026-05-15T20:34:55.296748Z"},{"id":88,"userId":"compromised-user-mocksiemkasperskyedr-6684","actionType":"BLOCK","incidentId":6684,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6684-iam-block","performedAt":"2026-05-15T20:34:44.263257Z"},{"id":87,"userId":"compromised-user-mocksiemkasperskyedr-6679","actionType":"BLOCK","incidentId":6679,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6679-iam-block","performedAt":"2026-05-15T20:34:39.285404Z"},{"id":86,"userId":"compromised-user-mocksiemkasperskyedr-6675","actionType":"BLOCK","incidentId":6675,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6675-iam-block","performedAt":"2026-05-15T20:34:35.266215Z"},{"id":85,"userId":"compromised-user-mocksiemkasperskyedr-6673","actionType":"BLOCK","incidentId":6673,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6673-iam-block","performedAt":"2026-05-15T20:34:33.283930Z"},{"id":84,"userId":"compromised-user-mocksiemkasperskyedr-6657","actionType":"BLOCK","incidentId":6657,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6657-iam-block","performedAt":"2026-05-15T20:34:17.263313Z"},{"id":83,"userId":"compromised-user-mocksiemkasperskyedr-6656","actionType":"BLOCK","incidentId":6656,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6656-iam-block","performedAt":"2026-05-15T20:34:16.285094Z"},{"id":82,"userId":"compromised-user-mocksiemkasperskyedr-6625","actionType":"BLOCK","incidentId":6625,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6625-iam-block","performedAt":"2026-05-15T20:33:45.263630Z"},{"id":81,"userId":"compromised-user-mocksiemkasperskyedr-6621","actionType":"BLOCK","incidentId":6621,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6621-iam-block","performedAt":"2026-05-15T20:33:41.256473Z"},{"id":80,"userId":"compromised-user-mocksiemkasperskyedr-6613","actionType":"BLOCK","incidentId":6613,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6613-iam-block","performedAt":"2026-05-15T20:33:33.285755Z"},{"id":79,"userId":"compromised-user-mocksiemkasperskyedr-6586","actionType":"BLOCK","incidentId":6586,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6586-iam-block","performedAt":"2026-05-15T20:33:06.262853Z"},{"id":78,"userId":"compromised-user-mocksiemkasperskyedr-6576","actionType":"BLOCK","incidentId":6576,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6576-iam-block","performedAt":"2026-05-15T20:32:56.262882Z"},{"id":77,"userId":"compromised-user-mocksiemkasperskyedr-6572","actionType":"BLOCK","incidentId":6572,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6572-iam-block","performedAt":"2026-05-15T20:32:52.260746Z"},{"id":76,"userId":"compromised-user-mocksiemkasperskyedr-6570","actionType":"BLOCK","incidentId":6570,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6570-iam-block","performedAt":"2026-05-15T20:32:50.265067Z"},{"id":75,"userId":"compromised-user-mocksiemkasperskyedr-6566","actionType":"BLOCK","incidentId":6566,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6566-iam-block","performedAt":"2026-05-15T20:32:46.263864Z"},{"id":74,"userId":"compromised-user-mocksiemkasperskyedr-6565","actionType":"BLOCK","incidentId":6565,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6565-iam-block","performedAt":"2026-05-15T20:32:45.272520Z"},{"id":73,"userId":"compromised-user-mocksiemkasperskyedr-6560","actionType":"BLOCK","incidentId":6560,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6560-iam-block","performedAt":"2026-05-15T20:32:40.280215Z"},{"id":72,"userId":"compromised-user-mocksiemkasperskyedr-6545","actionType":"BLOCK","incidentId":6545,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6545-iam-block","performedAt":"2026-05-15T20:32:25.293085Z"},{"id":71,"userId":"compromised-user-mocksiemkasperskyedr-6528","actionType":"BLOCK","incidentId":6528,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6528-iam-block","performedAt":"2026-05-15T20:32:08.272044Z"},{"id":70,"userId":"compromised-user-mocksiemkasperskyedr-6527","actionType":"BLOCK","incidentId":6527,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6527-iam-block","performedAt":"2026-05-15T20:32:07.263568Z"},{"id":69,"userId":"compromised-user-mocksiemkasperskyedr-6522","actionType":"BLOCK","incidentId":6522,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6522-iam-block","performedAt":"2026-05-15T20:32:02.274726Z"},{"id":68,"userId":"compromised-user-mocksiemkasperskyedr-6512","actionType":"BLOCK","incidentId":6512,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6512-iam-block","performedAt":"2026-05-15T20:31:52.276637Z"},{"id":67,"userId":"compromised-user-mocksiemkasperskyedr-6484","actionType":"BLOCK","incidentId":6484,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6484-iam-block","performedAt":"2026-05-15T20:31:24.278063Z"},{"id":66,"userId":"compromised-user-mocksiemkasperskyedr-6468","actionType":"BLOCK","incidentId":6468,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6468-iam-block","performedAt":"2026-05-15T20:30:56.932439Z"},{"id":65,"userId":"compromised-user-mocksiemkasperskyedr-6433","actionType":"BLOCK","incidentId":6433,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6433-iam-block","performedAt":"2026-05-15T20:30:21.920681Z"},{"id":64,"userId":"compromised-user-mocksiemkasperskyedr-6396","actionType":"BLOCK","incidentId":6396,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6396-iam-block","performedAt":"2026-05-15T20:29:44.946529Z"},{"id":63,"userId":"compromised-user-mocksiemkasperskyedr-6391","actionType":"BLOCK","incidentId":6391,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6391-iam-block","performedAt":"2026-05-15T20:29:39.954704Z"},{"id":62,"userId":"compromised-user-mocksiemkasperskyedr-6377","actionType":"BLOCK","incidentId":6377,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6377-iam-block","performedAt":"2026-05-15T20:29:25.941984Z"},{"id":61,"userId":"compromised-user-mocksiemkasperskyedr-6370","actionType":"BLOCK","incidentId":6370,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6370-iam-block","performedAt":"2026-05-15T20:29:18.935197Z"},{"id":60,"userId":"compromised-user-mocksiemkasperskyedr-6363","actionType":"BLOCK","incidentId":6363,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6363-iam-block","performedAt":"2026-05-15T20:29:11.930421Z"},{"id":59,"userId":"compromised-user-mocksiemkasperskyedr-6360","actionType":"BLOCK","incidentId":6360,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6360-iam-block","performedAt":"2026-05-15T20:29:08.933972Z"},{"id":58,"userId":"compromised-user-mocksiemkasperskyedr-6345","actionType":"BLOCK","incidentId":6345,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6345-iam-block","performedAt":"2026-05-15T20:28:53.927384Z"},{"id":57,"userId":"compromised-user-mocksiemkasperskyedr-6332","actionType":"BLOCK","incidentId":6332,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6332-iam-block","performedAt":"2026-05-15T20:28:40.949232Z"},{"id":56,"userId":"compromised-user-mocksiemkasperskyedr-6329","actionType":"BLOCK","incidentId":6329,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6329-iam-block","performedAt":"2026-05-15T20:28:37.938588Z"},{"id":55,"userId":"compromised-user-mocksiemkasperskyedr-6328","actionType":"BLOCK","incidentId":6328,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6328-iam-block","performedAt":"2026-05-15T20:28:36.941842Z"},{"id":54,"userId":"compromised-user-mocksiemkasperskyedr-6327","actionType":"BLOCK","incidentId":6327,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6327-iam-block","performedAt":"2026-05-15T20:28:35.955911Z"},{"id":53,"userId":"compromised-user-mocksiemkasperskyedr-6320","actionType":"BLOCK","incidentId":6320,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6320-iam-block","performedAt":"2026-05-15T20:28:28.949300Z"},{"id":52,"userId":"compromised-user-mocksiemkasperskyedr-6317","actionType":"BLOCK","incidentId":6317,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6317-iam-block","performedAt":"2026-05-15T20:28:25.944301Z"},{"id":51,"userId":"compromised-user-mocksiemkasperskyedr-6307","actionType":"BLOCK","incidentId":6307,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6307-iam-block","performedAt":"2026-05-15T20:28:15.941024Z"},{"id":50,"userId":"compromised-user-mocksiemkasperskyedr-6297","actionType":"BLOCK","incidentId":6297,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6297-iam-block","performedAt":"2026-05-15T20:28:05.941645Z"},{"id":49,"userId":"compromised-user-mocksiemkasperskyedr-6270","actionType":"BLOCK","incidentId":6270,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6270-iam-block","performedAt":"2026-05-15T20:27:38.940590Z"},{"id":48,"userId":"compromised-user-mocksiemkasperskyedr-6246","actionType":"BLOCK","incidentId":6246,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6246-iam-block","performedAt":"2026-05-15T20:27:14.996353Z"},{"id":47,"userId":"compromised-user-mocksiemkasperskyedr-6242","actionType":"BLOCK","incidentId":6242,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6242-iam-block","performedAt":"2026-05-15T20:27:10.953464Z"},{"id":46,"userId":"compromised-user-mocksiemkasperskyedr-6202","actionType":"BLOCK","incidentId":6202,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6202-iam-block","performedAt":"2026-05-15T20:26:30.926966Z"},{"id":45,"userId":"compromised-user-mocksiemkasperskyedr-6196","actionType":"BLOCK","incidentId":6196,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6196-iam-block","performedAt":"2026-05-15T20:26:24.940859Z"},{"id":44,"userId":"compromised-user-mocksiemkasperskyedr-6194","actionType":"BLOCK","incidentId":6194,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6194-iam-block","performedAt":"2026-05-15T20:26:22.929729Z"},{"id":43,"userId":"compromised-user-mocksiemkasperskyedr-6177","actionType":"BLOCK","incidentId":6177,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6177-iam-block","performedAt":"2026-05-15T20:26:05.946020Z"},{"id":42,"userId":"compromised-user-mocksiemkasperskyedr-6172","actionType":"BLOCK","incidentId":6172,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6172-iam-block","performedAt":"2026-05-15T20:26:00.960759Z"},{"id":41,"userId":"compromised-user-mocksiemkasperskyedr-6160","actionType":"BLOCK","incidentId":6160,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6160-iam-block","performedAt":"2026-05-15T20:25:48.932106Z"},{"id":40,"userId":"compromised-user-mocksiemkasperskyedr-6149","actionType":"BLOCK","incidentId":6149,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6149-iam-block","performedAt":"2026-05-15T20:25:37.947988Z"},{"id":39,"userId":"compromised-user-mocksiemkasperskyedr-6126","actionType":"BLOCK","incidentId":6126,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6126-iam-block","performedAt":"2026-05-15T20:25:14.947589Z"},{"id":38,"userId":"compromised-user-mocksiemkasperskyedr-6124","actionType":"BLOCK","incidentId":6124,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6124-iam-block","performedAt":"2026-05-15T20:25:12.938079Z"},{"id":37,"userId":"compromised-user-mocksiemkasperskyedr-6121","actionType":"BLOCK","incidentId":6121,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6121-iam-block","performedAt":"2026-05-15T20:25:09.937020Z"},{"id":36,"userId":"compromised-user-mocksiemkasperskyedr-6117","actionType":"BLOCK","incidentId":6117,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6117-iam-block","performedAt":"2026-05-15T20:25:05.945985Z"},{"id":35,"userId":"compromised-user-mocksiemkasperskyedr-6114","actionType":"BLOCK","incidentId":6114,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6114-iam-block","performedAt":"2026-05-15T20:25:02.932977Z"},{"id":34,"userId":"compromised-user-mocksiemkasperskyedr-6111","actionType":"BLOCK","incidentId":6111,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6111-iam-block","performedAt":"2026-05-15T20:24:59.940965Z"},{"id":33,"userId":"compromised-user-mocksiemkasperskyedr-6086","actionType":"BLOCK","incidentId":6086,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6086-iam-block","performedAt":"2026-05-15T20:24:34.961749Z"},{"id":32,"userId":"compromised-user-mocksiemkasperskyedr-6027","actionType":"BLOCK","incidentId":6027,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6027-iam-block","performedAt":"2026-05-15T20:23:35.962027Z"},{"id":31,"userId":"compromised-user-mocksiemkasperskyedr-6021","actionType":"BLOCK","incidentId":6021,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6021-iam-block","performedAt":"2026-05-15T20:23:29.943053Z"},{"id":30,"userId":"compromised-user-mocksiemkasperskyedr-6020","actionType":"BLOCK","incidentId":6020,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-6020-iam-block","performedAt":"2026-05-15T20:23:28.968007Z"},{"id":29,"userId":"compromised-user-mocksiemkasperskyedr-6003","actionType":"BLOCK","incidentId":6003,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-6003-iam-block","performedAt":"2026-05-15T20:23:11.943431Z"},{"id":28,"userId":"compromised-user-mocksiemkasperskyedr-5979","actionType":"BLOCK","incidentId":5979,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5979-iam-block","performedAt":"2026-05-15T20:22:47.937342Z"},{"id":27,"userId":"compromised-user-mocksiemkasperskyedr-5968","actionType":"BLOCK","incidentId":5968,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5968-iam-block","performedAt":"2026-05-15T20:22:36.940638Z"},{"id":26,"userId":"compromised-user-mocksiemkasperskyedr-5956","actionType":"BLOCK","incidentId":5956,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5956-iam-block","performedAt":"2026-05-15T20:22:24.935159Z"},{"id":25,"userId":"compromised-user-mocksiemkasperskyedr-5915","actionType":"BLOCK","incidentId":5915,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5915-iam-block","performedAt":"2026-05-15T20:21:43.953449Z"},{"id":24,"userId":"compromised-user-mocksiemkasperskyedr-5896","actionType":"BLOCK","incidentId":5896,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5896-iam-block","performedAt":"2026-05-15T20:21:24.953506Z"},{"id":23,"userId":"compromised-user-mocksiemkasperskyedr-5865","actionType":"BLOCK","incidentId":5865,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5865-iam-block","performedAt":"2026-05-15T20:20:53.955852Z"},{"id":22,"userId":"compromised-user-mocksiemkasperskyedr-5838","actionType":"BLOCK","incidentId":5838,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5838-iam-block","performedAt":"2026-05-15T20:20:26.974508Z"},{"id":21,"userId":"compromised-user-mocksiemkasperskyedr-5829","actionType":"BLOCK","incidentId":5829,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5829-iam-block","performedAt":"2026-05-15T20:20:17.970904Z"},{"id":20,"userId":"compromised-user-mocksiemkasperskyedr-5820","actionType":"BLOCK","incidentId":5820,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5820-iam-block","performedAt":"2026-05-15T20:20:08.943273Z"},{"id":19,"userId":"compromised-user-mocksiemkasperskyedr-5816","actionType":"BLOCK","incidentId":5816,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5816-iam-block","performedAt":"2026-05-15T20:20:04.928048Z"},{"id":18,"userId":"compromised-user-mocksiemkasperskyedr-5802","actionType":"BLOCK","incidentId":5802,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5802-iam-block","performedAt":"2026-05-15T20:19:50.948098Z"},{"id":17,"userId":"compromised-user-mocksiemkasperskyedr-5748","actionType":"BLOCK","incidentId":5748,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5748-iam-block","performedAt":"2026-05-15T20:18:56.985636Z"},{"id":16,"userId":"compromised-user-mocksiemkasperskyedr-5745","actionType":"BLOCK","incidentId":5745,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5745-iam-block","performedAt":"2026-05-15T20:18:53.941891Z"},{"id":15,"userId":"compromised-user-mocksiemkasperskyedr-5744","actionType":"BLOCK","incidentId":5744,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5744-iam-block","performedAt":"2026-05-15T20:18:52.967829Z"},{"id":14,"userId":"compromised-user-mocksiemkasperskyedr-5737","actionType":"BLOCK","incidentId":5737,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5737-iam-block","performedAt":"2026-05-15T20:18:45.956470Z"},{"id":13,"userId":"compromised-user-mocksiemkasperskyedr-5734","actionType":"BLOCK","incidentId":5734,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5734-iam-block","performedAt":"2026-05-15T20:18:42.946549Z"},{"id":12,"userId":"compromised-user-mocksiemkasperskyedr-5705","actionType":"BLOCK","incidentId":5705,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5705-iam-block","performedAt":"2026-05-15T20:18:13.950783Z"},{"id":11,"userId":"compromised-user-mocksiemkasperskyedr-5695","actionType":"BLOCK","incidentId":5695,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5695-iam-block","performedAt":"2026-05-15T20:18:03.947894Z"},{"id":10,"userId":"compromised-user-mocksiemkasperskyedr-5684","actionType":"BLOCK","incidentId":5684,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5684-iam-block","performedAt":"2026-05-15T20:17:52.942928Z"},{"id":9,"userId":"compromised-user-mocksiemkasperskyedr-5673","actionType":"BLOCK","incidentId":5673,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5673-iam-block","performedAt":"2026-05-15T20:17:41.957469Z"},{"id":8,"userId":"compromised-user-mocksiemkasperskyedr-5651","actionType":"BLOCK","incidentId":5651,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5651-iam-block","performedAt":"2026-05-15T20:17:24.758601Z"},{"id":7,"userId":"compromised-user-mocksiemkasperskyedr-5642","actionType":"BLOCK","incidentId":5642,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5642-iam-block","performedAt":"2026-05-15T20:17:24.062097Z"},{"id":6,"userId":"compromised-user-mocksiemkasperskyedr-5636","actionType":"BLOCK","incidentId":5636,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5636-iam-block","performedAt":"2026-05-15T20:17:23.674440Z"},{"id":5,"userId":"compromised-user-mocksiemkasperskyedr-5634","actionType":"BLOCK","incidentId":5634,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5634-iam-block","performedAt":"2026-05-15T20:17:23.545831Z"},{"id":4,"userId":"compromised-user-mocksiemkasperskyedr-5632","actionType":"BLOCK","incidentId":5632,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5632-iam-block","performedAt":"2026-05-15T20:17:23.367883Z"},{"id":3,"userId":"compromised-user-mocksiemkasperskyedr-5610","actionType":"BLOCK","incidentId":5610,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5610-iam-block","performedAt":"2026-05-15T20:17:21.573418Z"},{"id":2,"userId":"compromised-user-mocksiemkasperskyedr-5606","actionType":"BLOCK","incidentId":5606,"reason":"Auto-block: P1 INSIDER — [R-INS-02] Копирование на внешние носители","idempotencyKey":"incident-5606-iam-block","performedAt":"2026-05-15T20:17:21.269677Z"},{"id":1,"userId":"compromised-user-mocksiemkasperskyedr-5603","actionType":"BLOCK","incidentId":5603,"reason":"Auto-block: P1 UNAUTHORIZED_ACCESS — [R-UA-04] Эскалация привилегий","idempotencyKey":"incident-5603-iam-block","performedAt":"2026-05-15T20:17:20.099051Z"}]