Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:45:25 UTC

Insider Threat Indicator

Low False Positive
ALR-00016 · 2026-10-09T18:59:35Z

Description

Anomalous after-hours access by 'c.williams' on SRV-MAIL-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by DecoyPulse.

Alert Metadata

Alert ID
ALR-00016
Timestamp
2026-10-09T18:59:35Z
Severity
Low
Status
False Positive
Detection Source
DecoyPulse
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-MAIL-01
User Account
c.williams
Source IP
45.94.148.13
Destination IP
10.0.173.38
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

18:59:35 Event ingested by SOC365 Engine
18:59:38 EmilyAI triage started — correlation enrichment
18:59:47 EmilyAI confidence: 98% — escalated to human analyst
19:00:12 Alert assigned to analyst: EmilyAI (auto)
19:00:52 Investigation started — querying SIEM and threat intelligence
19:06:16 Containment action taken — endpoint isolated
19:12:40 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00036 46m ago Insider Threat Indicator Informational Investigating SRV-FILE-01
ALR-00196 6h ago Port Scan Detected Low Open SRV-MAIL-01
ALR-00249 10h ago Port Scan Detected Medium False Positive SRV-MAIL-01
ALR-00355 18h ago Insider Threat Indicator Medium Open WS-PC-002
ALR-00428 18h ago Insider Threat Indicator Medium Resolved WS-PC-002