Brute Force SSH
Low
Open
ALR-00084 · 2026-07-07T16:40:30Z
Description
Multiple failed SSH login attempts detected on SRV-DC-01 from external IP. EmilyAI Triage flagged 47 attempts in 5 minutes targeting user 'r.davies'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
16:40:30
Event ingested by SOC365 Engine
16:40:33
EmilyAI triage started — correlation enrichment
16:40:40
EmilyAI confidence: 90% — escalated to human analyst
16:41:08
Alert assigned to analyst: EmilyAI (auto)
16:42:19
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00316 | 8m ago | Brute Force SSH | Low | Resolved | WS-PC-004 |
| ALR-00300 | 3h ago | Brute Force SSH | Low | Open | SRV-FILE-01 |
| ALR-00333 | 3h ago | DecoyPulse Honeypot Triggered | Informational | False Positive | SRV-DC-01 |
| ALR-00450 | 14h ago | Brute Force SSH | Low | Resolved | WS-PC-006 |
| ALR-00050 | 15h ago | Brute Force SSH | Informational | Resolved | WS-LAP-010 |