Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:44:33 UTC

Insider Threat Indicator

Informational Investigating
ALR-00096 · 2026-10-11T00:05:38Z

Description

Anomalous after-hours access by 's.jones' on SRV-MAIL-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by SOC365 Engine.

Alert Metadata

Alert ID
ALR-00096
Timestamp
2026-10-11T00:05:38Z
Severity
Informational
Status
Investigating
Detection Source
SOC365 Engine
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-MAIL-01
User Account
s.jones
Source IP
185.1.220.226
Destination IP
10.0.68.144
Origin Country
FR France

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

00:05:38 Event ingested by SOC365 Engine
00:05:43 EmilyAI triage started — correlation enrichment
00:05:47 EmilyAI confidence: 88% — escalated to human analyst
00:06:00 Alert assigned to analyst: EmilyAI (auto)
00:08:30 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00163 4h ago Insider Threat Indicator Informational Escalated SRV-FILE-01
ALR-00048 5h ago Rogue DHCP Server Low False Positive SRV-MAIL-01
ALR-00499 6h ago Port Scan Detected Medium Resolved SRV-MAIL-01
ALR-00412 9h ago Port Scan Detected Low Escalated SRV-MAIL-01
ALR-00494 1d ago Brute Force SSH Informational Open SRV-MAIL-01