Unauthorised USB Device
Informational
False Positive
ALR-00035 · 2026-07-10T03:19:02Z
Description
Unauthorised USB mass storage device connected to WS-PC-004 by user 'p.thomas'. Device blocked by EmilyAI Triage endpoint policy.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
03:19:02
Event ingested by SOC365 Engine
03:19:03
EmilyAI triage started — correlation enrichment
03:19:15
EmilyAI confidence: 89% — escalated to human analyst
03:19:40
Alert assigned to analyst: EmilyAI (auto)
03:21:16
Investigation started — querying SIEM and threat intelligence
03:25:14
Containment action taken — endpoint isolated
03:34:31
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00351 | 13m ago | Unauthorised USB Device | Informational | Resolved | SRV-DC-01 |
| ALR-00303 | 2h ago | Unauthorised USB Device | High | Investigating | WS-LAP-010 |
| ALR-00426 | 3h ago | Privilege Escalation Attempt | High | Investigating | WS-PC-004 |
| ALR-00212 | 4h ago | Unauthorised USB Device | Low | Open | SRV-SQL-01 |
| ALR-00230 | 9h ago | Unauthorised USB Device | Critical | Open | SRV-FILE-01 |