Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 02:44:55 UTC

Brute Force SSH

Low Investigating
ALR-00003 · 2026-10-08T04:22:48Z

Description

Multiple failed SSH login attempts detected on WS-PC-006 from external IP. Email Gateway flagged 47 attempts in 5 minutes targeting user 'k.brown'.

Alert Metadata

Alert ID
ALR-00003
Timestamp
2026-10-08T04:22:48Z
Severity
Low
Status
Investigating
Detection Source
Email Gateway
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-PC-006
User Account
k.brown
Source IP
185.189.220.73
Destination IP
10.3.242.27
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.001
Reference
attack.mitre.org/techniques/T1110.001

Investigation Timeline

04:22:48 Event ingested by SOC365 Engine
04:22:49 EmilyAI triage started — correlation enrichment
04:22:53 EmilyAI confidence: 86% — escalated to human analyst
04:23:11 Alert assigned to analyst: EmilyAI (auto)
04:24:24 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00126 4h ago Rogue DHCP Server Low Investigating WS-PC-006
ALR-00404 7h ago Data Exfiltration Attempt Informational Escalated WS-PC-006
ALR-00004 13h ago Suspicious Scheduled Task Low Escalated WS-PC-006
ALR-00216 14h ago Brute Force SSH Medium Open AP-WIFI-03
ALR-00376 18h ago Brute Force SSH Medium False Positive SRV-MAIL-01