Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:19 UTC

Ransomware Behaviour Detected

Critical Escalated
ALR-00097 · 2026-10-05T20:58:46Z

Description

File encryption behaviour detected on WS-PC-002. 142 files renamed with .locked extension in 30 seconds. Email Gateway isolated endpoint.

Alert Metadata

Alert ID
ALR-00097
Timestamp
2026-10-05T20:58:46Z
Severity
Critical
Status
Escalated
Detection Source
Email Gateway
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
WS-PC-002
User Account
n.clark
Source IP
103.252.216.194
Destination IP
10.2.254.34
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Impact
Technique
T1486
Reference
attack.mitre.org/techniques/T1486

Investigation Timeline

20:58:46 Event ingested by SOC365 Engine
20:58:47 EmilyAI triage started — correlation enrichment
20:59:01 EmilyAI confidence: 83% — escalated to human analyst
20:59:04 Alert assigned to analyst: Anika Patel
20:59:49 Investigation started — querying SIEM and threat intelligence
21:02:48 Containment action taken — endpoint isolated
21:13:06 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00481 10h ago Suspicious PowerShell Execution Medium Investigating WS-PC-002
ALR-00112 12h ago Unauthorised USB Device High Escalated WS-PC-002
ALR-00188 16h ago Suspicious PowerShell Execution Low Investigating WS-PC-002
ALR-00316 19h ago Kerberoasting Attempt High Open WS-PC-002
ALR-00472 22h ago Lateral Movement Detected Informational Open WS-PC-002