Ransomware Behaviour Detected
Low
Investigating
ALR-00013 · 2026-05-23T00:30:56Z
Description
File encryption behaviour detected on WS-LAP-012. 142 files renamed with .locked extension in 30 seconds. DLP Module isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:30:56
Event ingested by SOC365 Engine
00:31:00
EmilyAI triage started — correlation enrichment
00:31:10
EmilyAI confidence: 88% — escalated to human analyst
00:31:41
Alert assigned to analyst: EmilyAI (auto)
00:33:54
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00396 | 1h ago | Ransomware Behaviour Detected | Low | False Positive | WS-LAP-010 |
| ALR-00481 | 1h ago | Ransomware Behaviour Detected | Low | Investigating | SW-CORE-01 |
| ALR-00415 | 2h ago | Ransomware Behaviour Detected | Low | False Positive | AP-WIFI-03 |
| ALR-00487 | 4h ago | Kerberoasting Attempt | High | Investigating | WS-LAP-012 |
| ALR-00267 | 8h ago | Ransomware Behaviour Detected | High | Escalated | WS-PC-003 |