Shadow IT Discovery
Medium
Escalated
ALR-00043 · 2026-07-09T17:12:18Z
Description
Attack Surface Scanner discovered unauthorised SaaS application (file sharing) used by 'n.clark'. 14GB of company data synced to unapproved cloud storage.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:12:18
Event ingested by SOC365 Engine
17:12:19
EmilyAI triage started — correlation enrichment
17:12:28
EmilyAI confidence: 96% — escalated to human analyst
17:13:03
Alert assigned to analyst: Emma Richardson
17:14:02
Investigation started — querying SIEM and threat intelligence
17:21:24
Containment action taken — endpoint isolated
17:22:42
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00318 | 2h ago | Brute Force SSH | Informational | Investigating | WS-LAP-010 |
| ALR-00331 | 19h ago | Shadow IT Discovery | Medium | False Positive | WS-PC-003 |
| ALR-00477 | 1d ago | Shadow IT Discovery | Low | Open | SRV-FILE-01 |
| ALR-00094 | 1d ago | Unauthorised USB Device | Low | Open | WS-LAP-010 |
| ALR-00236 | 1d ago | Shadow IT Discovery | Informational | Open | WS-LAP-010 |