Lateral Movement Detected
High
Investigating
ALR-00037 · 2026-07-11T18:25:16Z
Description
SOC365 Engine detected lateral movement from VM-DEV-01 to SRV-DC-01 using user 'r.davies' credentials. SMB admin shares accessed.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:25:16
Event ingested by SOC365 Engine
18:25:20
EmilyAI triage started — correlation enrichment
18:25:24
EmilyAI confidence: 91% — escalated to human analyst
18:25:57
Alert assigned to analyst: Marcus Webb
18:27:06
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00227 | 47m ago | Privilege Escalation Attempt | Medium | Investigating | VM-DEV-01 |
| ALR-00443 | 48m ago | Lateral Movement Detected | Informational | Investigating | WS-MAC-005 |
| ALR-00369 | 1h ago | Lateral Movement Detected | Low | Investigating | FW-EDGE-01 |
| ALR-00101 | 1h ago | Lateral Movement Detected | Informational | False Positive | VM-DEV-01 |
| ALR-00119 | 2h ago | Lateral Movement Detected | Low | Escalated | VM-DEV-01 |