SIEM Alert [CRITICAL]: GuardDuty + CloudTrail Correlation | 03:12:44 UTC: IAM service account `svc-mlflow-ci@fintech-prod` issued 47 S3:GetObject calls and 3 MLflow Model Registry API calls (POST /api/2.0/mlflow/registered-models/transition-stage) within 4 minutes, 18x above the 72-hour rolling baseline of 2.6 calls/min. Source IP: 185.220.101.47 (known Tor exit node, AbuseIPDB confidence 97%). User-Agent string: `python-requests/2.28.1`, deviating from the expected `mlflow-python-client/2.11.1`. CloudTrail shows the credential last authenticated legitimately from `10.42.3.18` (internal CI runner) 6 hours ago. One model transition targeted `fraud-detection-v3` from Staging -> Production.

3:12 AM: Compromised Service Account Accessing MLflow Tracking Server

You are an on-call ML security analyst at a mid-size fintech company. Your team operates a self-hosted MLflow tracking server (v2.11.1) on AWS EC2, backed by S3 for artifact storage and RDS PostgreSQL for experiment metadata. The server is used by data science teams to log model runs, register production models, and store training artifacts including feature pipelines and serialized preprocessors.

SIEM ALERT [CRITICAL], 2024-06-14T03:12:44Z | Rule: "MLflow API Access from Anomalous Source IP"
Source IP: 185.220.101.47 (Tor exit node, AS50581) | User-Agent: python-requests/2.31.0
IAM Principal: svc-mlflow-cicd@prod.internal | Auth method: JWT bearer token
Events in last 15 min: GET /api/2.0/mlflow/runs/search (47x), GET /api/2.0/mlflow/registered-models/list (12x), GET /api/2.0/mlflow/artifacts/list (89x)
MinIO access log: s3:GetObject on bucket ml-prod-artifacts, 2.3 GB transferred to external presigned URL (TTL: 3600s) | Destination resolved to 185.220.101.47
Baseline for svc-mlflow-cicd: 0 requests between 01:00-05:00 UTC (30-day rolling average). No CI/CD pipelines scheduled tonight.

3:12 AM: Suspicious IAM Credential Access to MLflow Tracking Server

You are an on-call ML security analyst at a mid-sized fintech company. Your team operates a self-hosted MLflow tracking server (v2.11) running on an internal Kubernetes cluster, used by data scientists to log experiments, register models, and store artifacts in an S3-compatible bucket (MinIO). The server is not publicly exposed, all access is expected via internal VPN or CI/CD service accounts.

SIEM Rule [ML-CRED-007] fired at 03:12:44 UTC: Service account `svc-mlflow-cicd@corp-ml-prod.iam` authenticated successfully from IP 185.220.101.47 (Tor exit node, AS51430), outside any known CI/CD egress range (expected: 10.14.0.0/16). In the 11 minutes following auth, CloudTrail/K8s audit logs show: 47 calls to `mlflow.artifacts.list`, 12 calls to `mlflow.registered-models.list`, and 3 calls to `mlflow.artifacts.download` targeting model `fraud-detection-v4` (artifact size: 2.3 GB). IAM last-used for this SA prior to today: 2024-11-03. Alert threshold: any auth from non-RFC1918 IP for ML-tier service accounts.

You are an on-call ML platform security analyst at a mid-sized financial services firm. The environment hosts a production MLflow tracking server (v2.11.1) on an internal Kubernetes cluster, used by ~40 data scientists to log experiments, register models, and store artifacts in an S3-compatible object store. The MLflow server is not exposed to the public internet but is reachable from the corporate VPN and internal CI/CD runners.