Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:44:19 UTC

Shadow IT Discovery

High Escalated
ALR-00032 · 2026-10-11T14:26:54Z

Description

EmilyAI Triage discovered unauthorised SaaS application (file sharing) used by 'e.evans'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00032
Timestamp
2026-10-11T14:26:54Z
Severity
High
Status
Escalated
Detection Source
EmilyAI Triage
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
WS-LAP-012
User Account
e.evans
Source IP
185.136.220.167
Destination IP
10.2.52.78
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

14:26:54 Event ingested by SOC365 Engine
14:26:58 EmilyAI triage started — correlation enrichment
14:27:05 EmilyAI confidence: 92% — escalated to human analyst
14:27:12 Alert assigned to analyst: James Okonkwo
14:28:09 Investigation started — querying SIEM and threat intelligence
14:34:48 Containment action taken — endpoint isolated
14:40:13 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00368 1h ago Shadow IT Discovery Informational False Positive SRV-BACKUP-01
ALR-00289 1h ago Shadow IT Discovery High Open SRV-FILE-01
ALR-00254 10h ago DLP Policy Violation Critical Investigating WS-LAP-012
ALR-00482 13h ago Shadow IT Discovery Informational False Positive VM-DEV-01
ALR-00192 16h ago Shadow IT Discovery Low False Positive SRV-BACKUP-01