Shadow IT Discovery

Medium Escalated

ALR-00043 · 2026-07-09T17:12:18Z

Description

Attack Surface Scanner discovered unauthorised SaaS application (file sharing) used by 'n.clark'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID: ALR-00043
Timestamp: 2026-07-09T17:12:18Z
Severity: Medium
Status: Escalated
Detection Source: Attack Surface Scanner
Assigned Analyst: Emma Richardson

Endpoint Information

Hostname: WS-LAP-010
User Account: n.clark
Source IP: 91.147.195.77
Destination IP: 10.2.65.192
Origin Country: FR France

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567
Reference: attack.mitre.org/techniques/T1567

Investigation Timeline

17:12:18 Event ingested by SOC365 Engine

17:12:19 EmilyAI triage started — correlation enrichment

17:12:28 EmilyAI confidence: 96% — escalated to human analyst

17:13:03 Alert assigned to analyst: Emma Richardson

17:14:02 Investigation started — querying SIEM and threat intelligence

17:21:24 Containment action taken — endpoint isolated

17:22:42 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00318	2h ago	Brute Force SSH	Informational	Investigating	WS-LAP-010
ALR-00331	19h ago	Shadow IT Discovery	Medium	False Positive	WS-PC-003
ALR-00477	1d ago	Shadow IT Discovery	Low	Open	SRV-FILE-01
ALR-00094	1d ago	Unauthorised USB Device	Low	Open	WS-LAP-010
ALR-00236	1d ago	Shadow IT Discovery	Informational	Open	WS-LAP-010