Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 18:40:43 UTC

Brute Force SSH

Low Resolved
ALR-00095 · 2026-07-11T09:40:51Z

Description

Multiple failed SSH login attempts detected on SRV-FILE-01 from external IP. Firewall flagged 47 attempts in 5 minutes targeting user 's.jones'.

Alert Metadata

Alert ID
ALR-00095
Timestamp
2026-07-11T09:40:51Z
Severity
Low
Status
Resolved
Detection Source
Firewall
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-FILE-01
User Account
s.jones
Source IP
103.197.216.195
Destination IP
10.1.174.220
Origin Country
FR France

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.001
Reference
attack.mitre.org/techniques/T1110.001

Investigation Timeline

09:40:51 Event ingested by SOC365 Engine
09:40:53 EmilyAI triage started — correlation enrichment
09:40:58 EmilyAI confidence: 98% — escalated to human analyst
09:41:07 Alert assigned to analyst: EmilyAI (auto)
09:42:06 Investigation started — querying SIEM and threat intelligence
09:49:47 Containment action taken — endpoint isolated
09:58:20 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00210 1h ago Port Scan Detected Informational Escalated SRV-FILE-01
ALR-00175 1h ago Port Scan Detected Critical Investigating SRV-FILE-01
ALR-00447 2h ago Privilege Escalation Attempt Informational Resolved SRV-FILE-01
ALR-00486 2h ago Unusual Outbound Traffic Medium Investigating SRV-FILE-01
ALR-00230 9h ago Unauthorised USB Device Critical Open SRV-FILE-01