Data Exfiltration Attempt

Low Escalated

ALR-00079 · 2026-10-07T23:42:51Z

Description

Large data transfer (2.3GB) to cloud storage from SRV-SQL-01 by user 'e.evans'. Attack Surface Scanner DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00079
Timestamp: 2026-10-07T23:42:51Z
Severity: Low
Status: Escalated
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-SQL-01
User Account: e.evans
Source IP: 103.157.216.156
Destination IP: 10.3.37.17
Origin Country: RU Russia

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

23:42:51 Event ingested by SOC365 Engine

23:42:53 EmilyAI triage started — correlation enrichment

23:43:04 EmilyAI confidence: 88% — escalated to human analyst

23:43:20 Alert assigned to analyst: EmilyAI (auto)

23:45:05 Investigation started — querying SIEM and threat intelligence

23:46:05 Containment action taken — endpoint isolated

23:53:17 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00394	2h ago	Data Exfiltration Attempt	High	Escalated	SRV-WEB-01
ALR-00035	3h ago	Data Exfiltration Attempt	High	Investigating	WS-LAP-011
ALR-00105	4h ago	Data Exfiltration Attempt	Informational	Open	SRV-SQL-01
ALR-00024	4h ago	Suspicious PowerShell Execution	Low	Investigating	SRV-SQL-01
ALR-00191	4h ago	Data Exfiltration Attempt	Low	False Positive	VM-DEV-01