Insider Threat Indicator
High
Escalated
ALR-00050 · 2026-07-09T02:33:53Z
Description
Anomalous after-hours access by 'system' on FW-EDGE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Firewall.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
02:33:53
Event ingested by SOC365 Engine
02:33:58
EmilyAI triage started — correlation enrichment
02:33:59
EmilyAI confidence: 90% — escalated to human analyst
02:34:18
Alert assigned to analyst: James Okonkwo
02:35:41
Investigation started — querying SIEM and threat intelligence
02:37:51
Containment action taken — endpoint isolated
02:52:22
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00207 | 47m ago | Suspicious Scheduled Task | Medium | Resolved | FW-EDGE-01 |
| ALR-00369 | 1h ago | Lateral Movement Detected | Low | Investigating | FW-EDGE-01 |
| ALR-00270 | 3h ago | Lateral Movement Detected | Medium | Open | FW-EDGE-01 |
| ALR-00460 | 4h ago | Suspicious Scheduled Task | Low | Escalated | FW-EDGE-01 |
| ALR-00057 | 5h ago | Insider Threat Indicator | Informational | Escalated | SRV-DC-01 |