Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:45:25 UTC

Insider Threat Indicator

Informational Investigating
ALR-00036 · 2026-10-12T02:59:16Z

Description

Anomalous after-hours access by 'c.williams' on SRV-FILE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Network IDS.

Alert Metadata

Alert ID
ALR-00036
Timestamp
2026-10-12T02:59:16Z
Severity
Informational
Status
Investigating
Detection Source
Network IDS
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-FILE-01
User Account
c.williams
Source IP
91.18.195.115
Destination IP
10.2.147.168
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

02:59:16 Event ingested by SOC365 Engine
02:59:17 EmilyAI triage started — correlation enrichment
02:59:23 EmilyAI confidence: 84% — escalated to human analyst
02:59:45 Alert assigned to analyst: EmilyAI (auto)
03:01:18 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00151 8m ago Kerberoasting Attempt Medium Resolved SRV-FILE-01
ALR-00162 5h ago Pass-the-Hash Detected Low Investigating SRV-FILE-01
ALR-00113 14h ago Unusual Outbound Traffic Medium Open SRV-FILE-01
ALR-00355 18h ago Insider Threat Indicator Medium Open WS-PC-002
ALR-00428 18h ago Insider Threat Indicator Medium Resolved WS-PC-002