Brute Force SSH
Medium
Escalated
ALR-00089 · 2026-07-10T18:38:54Z
Description
Multiple failed SSH login attempts detected on SRV-FILE-01 from external IP. Network IDS flagged 47 attempts in 5 minutes targeting user 'c.williams'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:38:54
Event ingested by SOC365 Engine
18:38:57
EmilyAI triage started — correlation enrichment
18:39:05
EmilyAI confidence: 81% — escalated to human analyst
18:39:21
Alert assigned to analyst: Emma Richardson
18:39:39
Investigation started — querying SIEM and threat intelligence
18:42:51
Containment action taken — endpoint isolated
18:49:06
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00240 | 11h ago | Brute Force SSH | Medium | Escalated | WS-LAP-011 |
| ALR-00104 | 13h ago | Kerberoasting Attempt | Informational | False Positive | SRV-FILE-01 |
| ALR-00406 | 16h ago | DLP Policy Violation | Low | Escalated | SRV-FILE-01 |
| ALR-00070 | 16h ago | Phishing Email Blocked | Medium | Escalated | SRV-FILE-01 |
| ALR-00274 | 1d ago | Brute Force SSH | Low | False Positive | SRV-FILE-01 |