Unauthorised USB Device
Medium
Escalated
ALR-00084 · 2026-07-06T09:54:07Z
Description
Unauthorised USB mass storage device connected to WS-PC-001 by user 'c.williams'. Device blocked by SOC365 Engine endpoint policy.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
09:54:07
Event ingested by SOC365 Engine
09:54:08
EmilyAI triage started — correlation enrichment
09:54:12
EmilyAI confidence: 92% — escalated to human analyst
09:54:33
Alert assigned to analyst: James Okonkwo
09:55:43
Investigation started — querying SIEM and threat intelligence
09:59:06
Containment action taken — endpoint isolated
10:05:45
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00465 | 1h ago | Unauthorised USB Device | Informational | Escalated | WS-PC-003 |
| ALR-00115 | 11h ago | Failed MFA Challenge | Low | Resolved | WS-PC-001 |
| ALR-00423 | 15h ago | Unauthorised USB Device | Medium | False Positive | SRV-BACKUP-01 |
| ALR-00121 | 1d ago | Malware Signature Match | Low | Escalated | WS-PC-001 |
| ALR-00331 | 1d ago | Credential Stuffing Attempt | Low | Escalated | WS-PC-001 |