Brute Force SSH
Low
Resolved
ALR-00095 · 2026-07-11T09:40:51Z
Description
Multiple failed SSH login attempts detected on SRV-FILE-01 from external IP. Firewall flagged 47 attempts in 5 minutes targeting user 's.jones'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
09:40:51
Event ingested by SOC365 Engine
09:40:53
EmilyAI triage started — correlation enrichment
09:40:58
EmilyAI confidence: 98% — escalated to human analyst
09:41:07
Alert assigned to analyst: EmilyAI (auto)
09:42:06
Investigation started — querying SIEM and threat intelligence
09:49:47
Containment action taken — endpoint isolated
09:58:20
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00210 | 1h ago | Port Scan Detected | Informational | Escalated | SRV-FILE-01 |
| ALR-00175 | 1h ago | Port Scan Detected | Critical | Investigating | SRV-FILE-01 |
| ALR-00447 | 2h ago | Privilege Escalation Attempt | Informational | Resolved | SRV-FILE-01 |
| ALR-00486 | 2h ago | Unusual Outbound Traffic | Medium | Investigating | SRV-FILE-01 |
| ALR-00230 | 9h ago | Unauthorised USB Device | Critical | Open | SRV-FILE-01 |