Data Exfiltration Attempt

Medium Investigating

ALR-00008 · 2026-07-07T06:44:46Z

Description

Large data transfer (2.3GB) to cloud storage from WS-LAP-012 by user 'a.wilson'. Dark Web Monitor DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00008
Timestamp: 2026-07-07T06:44:46Z
Severity: Medium
Status: Investigating
Detection Source: Dark Web Monitor
Assigned Analyst: Sarah Chen

Endpoint Information

Hostname: WS-LAP-012
User Account: a.wilson
Source IP: 45.127.148.244
Destination IP: 10.2.211.202
Origin Country: NG Nigeria

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

06:44:46 Event ingested by SOC365 Engine

06:44:51 EmilyAI triage started — correlation enrichment

06:45:01 EmilyAI confidence: 86% — escalated to human analyst

06:45:31 Alert assigned to analyst: Sarah Chen

06:46:42 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00289	1h ago	Data Exfiltration Attempt	Low	Open	SRV-FILE-01
ALR-00460	2h ago	Certificate Anomaly	Informational	Escalated	WS-LAP-012
ALR-00444	8h ago	Malware Signature Match	Medium	Escalated	WS-LAP-012
ALR-00347	8h ago	DLP Policy Violation	Informational	Open	WS-LAP-012
ALR-00259	8h ago	Privilege Escalation Attempt	Medium	Escalated	WS-LAP-012