Data Exfiltration Attempt
Low
Open
ALR-00045 · 2026-07-05T22:05:26Z
Description
Large data transfer (2.3GB) to cloud storage from VM-DEV-01 by user 'l.johnson'. Endpoint Agent DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
22:05:26
Event ingested by SOC365 Engine
22:05:27
EmilyAI triage started — correlation enrichment
22:05:40
EmilyAI confidence: 84% — escalated to human analyst
22:05:46
Alert assigned to analyst: EmilyAI (auto)
22:07:38
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00483 | 2h ago | Rogue DHCP Server | Low | Open | VM-DEV-01 |
| ALR-00323 | 3h ago | Pass-the-Hash Detected | Low | Open | VM-DEV-01 |
| ALR-00318 | 8h ago | Kerberoasting Attempt | Medium | Open | VM-DEV-01 |
| ALR-00387 | 11h ago | Data Exfiltration Attempt | Low | Resolved | WS-LAP-012 |
| ALR-00192 | 15h ago | Data Exfiltration Attempt | Medium | False Positive | WS-PC-003 |