DLP Policy Violation
Medium
Escalated
ALR-00073 · 2026-07-10T21:24:28Z
Description
DLP policy violation: user 'j.smith' attempted to email 3 files classified as 'Confidential' to external address from SRV-APP-01.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
21:24:28
Event ingested by SOC365 Engine
21:24:29
EmilyAI triage started — correlation enrichment
21:24:41
EmilyAI confidence: 94% — escalated to human analyst
21:24:54
Alert assigned to analyst: James Okonkwo
21:25:59
Investigation started — querying SIEM and threat intelligence
21:33:41
Containment action taken — endpoint isolated
21:41:47
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00236 | 1h ago | Privilege Escalation Attempt | Informational | False Positive | SRV-APP-01 |
| ALR-00481 | 7h ago | Pass-the-Hash Detected | Informational | Escalated | SRV-APP-01 |
| ALR-00037 | 13h ago | Unusual Outbound Traffic | Medium | False Positive | SRV-APP-01 |
| ALR-00261 | 18h ago | Privilege Escalation Attempt | Low | Escalated | SRV-APP-01 |
| ALR-00070 | 20h ago | Ransomware Behaviour Detected | Critical | Investigating | SRV-APP-01 |