Failed MFA Challenge
Medium
False Positive
ALR-00016 · 2026-07-11T17:19:33Z
Description
Multiple failed MFA challenges for user 'p.thomas' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. EmilyAI Triage locked account.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:19:33
Event ingested by SOC365 Engine
17:19:37
EmilyAI triage started — correlation enrichment
17:19:47
EmilyAI confidence: 92% — escalated to human analyst
17:20:17
Alert assigned to analyst: Sarah Chen
17:21:24
Investigation started — querying SIEM and threat intelligence
17:27:47
Containment action taken — endpoint isolated
17:37:19
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00406 | 4h ago | Credential Stuffing Attempt | High | Open | SRV-BACKUP-01 |
| ALR-00310 | 5h ago | Failed MFA Challenge | Low | Open | FW-EDGE-01 |
| ALR-00097 | 6h ago | Failed MFA Challenge | Informational | Open | WS-LAP-011 |
| ALR-00302 | 10h ago | Malware Signature Match | Low | Investigating | SRV-BACKUP-01 |
| ALR-00433 | 10h ago | Failed MFA Challenge | Low | Resolved | WS-LAP-012 |