Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:46:03 UTC

Unusual Outbound Traffic

High Open
ALR-00023 · 2026-10-10T12:49:39Z

Description

Unusual outbound traffic pattern from SRV-FILE-01 to IP in Eastern Europe. 450MB transferred over non-standard port. Flagged by SOC365 Engine.

Alert Metadata

Alert ID
ALR-00023
Timestamp
2026-10-10T12:49:39Z
Severity
High
Status
Open
Detection Source
SOC365 Engine
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-FILE-01
User Account
a.wilson
Source IP
194.137.62.180
Destination IP
10.2.52.207
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1041
Reference
attack.mitre.org/techniques/T1041

Investigation Timeline

12:49:39 Event ingested by SOC365 Engine
12:49:40 EmilyAI triage started — correlation enrichment
12:49:53 EmilyAI confidence: 94% — escalated to human analyst
12:50:12 Alert assigned to analyst: James Okonkwo
12:51:41 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00467 6h ago Rogue DHCP Server Low Escalated SRV-FILE-01
ALR-00101 10h ago Failed MFA Challenge Informational Resolved SRV-FILE-01
ALR-00322 12h ago DLP Policy Violation Low Escalated SRV-FILE-01
ALR-00042 14h ago Unusual Outbound Traffic Medium Escalated VM-DEV-01
ALR-00173 21h ago Suspicious PowerShell Execution Informational Resolved SRV-FILE-01