Data Exfiltration Attempt
Low
Open
ALR-00003 · 2026-05-26T08:23:03Z
Description
Large data transfer (2.3GB) to cloud storage from WS-PC-006 by user 'l.johnson'. Network IDS DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:23:03
Event ingested by SOC365 Engine
08:23:04
EmilyAI triage started — correlation enrichment
08:23:16
EmilyAI confidence: 89% — escalated to human analyst
08:23:19
Alert assigned to analyst: EmilyAI (auto)
08:23:54
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00246 | 45m ago | DecoyPulse Honeypot Triggered | Low | False Positive | WS-PC-006 |
| ALR-00232 | 2h ago | Data Exfiltration Attempt | Low | Resolved | WS-MAC-005 |
| ALR-00155 | 13h ago | Data Exfiltration Attempt | Low | Investigating | WS-PC-001 |
| ALR-00407 | 20h ago | Data Exfiltration Attempt | Medium | Escalated | SRV-DC-01 |
| ALR-00055 | 1d ago | DecoyPulse Honeypot Triggered | High | Escalated | WS-PC-006 |