Ransomware Behaviour Detected
Informational
Investigating
ALR-00054 · 2026-07-11T04:46:16Z
Description
File encryption behaviour detected on WS-PC-001. 142 files renamed with .locked extension in 30 seconds. Attack Surface Scanner isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
04:46:16
Event ingested by SOC365 Engine
04:46:20
EmilyAI triage started — correlation enrichment
04:46:25
EmilyAI confidence: 90% — escalated to human analyst
04:46:38
Alert assigned to analyst: EmilyAI (auto)
04:49:13
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00026 | 1h ago | Ransomware Behaviour Detected | Medium | Escalated | WS-LAP-011 |
| ALR-00314 | 2h ago | Phishing Email Blocked | Medium | Open | WS-PC-001 |
| ALR-00392 | 4h ago | Pass-the-Hash Detected | Low | Investigating | WS-PC-001 |
| ALR-00452 | 12h ago | Ransomware Behaviour Detected | Low | Investigating | SW-CORE-01 |
| ALR-00477 | 13h ago | Kerberoasting Attempt | Informational | Investigating | WS-PC-001 |