Insider Threat Indicator

High Open

ALR-00098 · 2026-10-10T04:46:54Z

Description

Anomalous after-hours access by 'e.evans' on SRV-MAIL-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.

Alert Metadata

Alert ID: ALR-00098
Timestamp: 2026-10-10T04:46:54Z
Severity: High
Status: Open
Detection Source: Attack Surface Scanner
Assigned Analyst: James Okonkwo

Endpoint Information

Hostname: SRV-MAIL-01
User Account: e.evans
Source IP: 103.203.216.198
Destination IP: 10.2.76.238
Origin Country: UA Ukraine

MITRE ATT&CK Mapping

Tactic: Collection
Technique: T1119
Reference: attack.mitre.org/techniques/T1119

Investigation Timeline

04:46:54 Event ingested by SOC365 Engine

04:46:55 EmilyAI triage started — correlation enrichment

04:47:01 EmilyAI confidence: 81% — escalated to human analyst

04:47:14 Alert assigned to analyst: James Okonkwo

04:49:09 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00036	46m ago	Insider Threat Indicator	Informational	Investigating	SRV-FILE-01
ALR-00196	6h ago	Port Scan Detected	Low	Open	SRV-MAIL-01
ALR-00249	10h ago	Port Scan Detected	Medium	False Positive	SRV-MAIL-01
ALR-00355	18h ago	Insider Threat Indicator	Medium	Open	WS-PC-002
ALR-00428	18h ago	Insider Threat Indicator	Medium	Resolved	WS-PC-002