Ransomware Behaviour Detected
Low
Resolved
ALR-00073 · 2026-07-05T19:20:00Z
Description
File encryption behaviour detected on SRV-BACKUP-01. 142 files renamed with .locked extension in 30 seconds. Attack Surface Scanner isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:20:00
Event ingested by SOC365 Engine
19:20:03
EmilyAI triage started — correlation enrichment
19:20:06
EmilyAI confidence: 79% — escalated to human analyst
19:20:32
Alert assigned to analyst: EmilyAI (auto)
19:22:16
Investigation started — querying SIEM and threat intelligence
19:27:30
Containment action taken — endpoint isolated
19:32:41
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00440 | 4h ago | Malware Signature Match | Critical | Escalated | SRV-BACKUP-01 |
| ALR-00333 | 5h ago | Ransomware Behaviour Detected | Medium | Open | WS-LAP-012 |
| ALR-00199 | 7h ago | C2 Beacon Activity | Low | Resolved | SRV-BACKUP-01 |
| ALR-00085 | 12h ago | Ransomware Behaviour Detected | Low | Resolved | FW-EDGE-01 |
| ALR-00386 | 14h ago | Ransomware Behaviour Detected | Medium | Resolved | WS-PC-001 |