Brute Force SSH
Low
False Positive
ALR-00075 · 2026-07-07T22:02:02Z
Description
Multiple failed SSH login attempts detected on WS-PC-004 from external IP. Firewall flagged 47 attempts in 5 minutes targeting user 'l.johnson'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
22:02:02
Event ingested by SOC365 Engine
22:02:04
EmilyAI triage started — correlation enrichment
22:02:10
EmilyAI confidence: 97% — escalated to human analyst
22:02:24
Alert assigned to analyst: EmilyAI (auto)
22:02:56
Investigation started — querying SIEM and threat intelligence
22:10:26
Containment action taken — endpoint isolated
22:17:54
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00164 | 3m ago | Credential Stuffing Attempt | Medium | Resolved | WS-PC-004 |
| ALR-00083 | 6h ago | Brute Force SSH | Medium | False Positive | SRV-SQL-01 |
| ALR-00069 | 10h ago | Credential Stuffing Attempt | High | Open | WS-PC-004 |
| ALR-00447 | 18h ago | Brute Force SSH | High | Investigating | VM-DEV-01 |
| ALR-00093 | 22h ago | Privilege Escalation Attempt | Low | Investigating | WS-PC-004 |