Insider Threat Indicator
High
Escalated
ALR-00043 · 2026-10-08T08:58:33Z
Description
Anomalous after-hours access by 'r.davies' on SRV-DC-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Firewall.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:58:33
Event ingested by SOC365 Engine
08:58:35
EmilyAI triage started — correlation enrichment
08:58:39
EmilyAI confidence: 93% — escalated to human analyst
08:59:15
Alert assigned to analyst: Anika Patel
09:00:34
Investigation started — querying SIEM and threat intelligence
09:06:00
Containment action taken — endpoint isolated
09:16:12
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00036 | 46m ago | Insider Threat Indicator | Informational | Investigating | SRV-FILE-01 |
| ALR-00019 | 4h ago | Suspicious PowerShell Execution | Low | Investigating | SRV-DC-01 |
| ALR-00385 | 4h ago | Credential Stuffing Attempt | Informational | Open | SRV-DC-01 |
| ALR-00177 | 6h ago | Pass-the-Hash Detected | High | Escalated | SRV-DC-01 |
| ALR-00397 | 8h ago | Failed MFA Challenge | High | Investigating | SRV-DC-01 |