Phishing Email Blocked
Low
False Positive
ALR-00012 · 2026-07-04T19:10:20Z
Description
Phishing email targeting 'n.clark@company.co.uk' blocked by Network IDS. Payload: credential harvesting link mimicking Microsoft 365 login.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:10:20
Event ingested by SOC365 Engine
19:10:21
EmilyAI triage started — correlation enrichment
19:10:34
EmilyAI confidence: 78% — escalated to human analyst
19:11:05
Alert assigned to analyst: EmilyAI (auto)
19:11:21
Investigation started — querying SIEM and threat intelligence
19:16:09
Containment action taken — endpoint isolated
19:20:39
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00059 | 7h ago | Phishing Email Blocked | Low | Resolved | WS-PC-003 |
| ALR-00495 | 12h ago | Data Exfiltration Attempt | Low | Escalated | SRV-FILE-01 |
| ALR-00364 | 16h ago | Phishing Email Blocked | Critical | Escalated | VM-DEV-01 |
| ALR-00474 | 18h ago | Certificate Anomaly | Low | Escalated | SRV-FILE-01 |
| ALR-00075 | 19h ago | Phishing Email Blocked | Informational | Open | SRV-DC-01 |