Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:00 UTC

Phishing Email Blocked

Medium Investigating
ALR-00014 · 2026-10-06T00:52:55Z

Description

Phishing email targeting 'p.thomas@company.co.uk' blocked by Endpoint Agent. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID
ALR-00014
Timestamp
2026-10-06T00:52:55Z
Severity
Medium
Status
Investigating
Detection Source
Endpoint Agent
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
WS-PC-003
User Account
p.thomas
Source IP
45.82.148.18
Destination IP
10.2.250.215
Origin Country
FR France

MITRE ATT&CK Mapping

Tactic
Initial Access
Technique
T1566.001
Reference
attack.mitre.org/techniques/T1566.001

Investigation Timeline

00:52:55 Event ingested by SOC365 Engine
00:52:58 EmilyAI triage started — correlation enrichment
00:53:08 EmilyAI confidence: 79% — escalated to human analyst
00:53:35 Alert assigned to analyst: Anika Patel
00:54:36 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00473 6h ago Phishing Email Blocked Low Escalated WS-PC-003
ALR-00297 7h ago Shadow IT Discovery Informational Resolved WS-PC-003
ALR-00087 17h ago DLP Policy Violation Informational Resolved WS-PC-003
ALR-00274 1d ago Phishing Email Blocked Informational False Positive SW-CORE-01
ALR-00028 1d ago Phishing Email Blocked Informational Investigating WS-PC-004