Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 17:10:07 UTC

Shadow IT Discovery

High Investigating
ALR-00105 · 2026-05-26T04:42:58Z

Description

DecoyPulse discovered unauthorised SaaS application (file sharing) used by 'f.hall'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00105
Timestamp
2026-05-26T04:42:58Z
Severity
High
Status
Investigating
Detection Source
DecoyPulse
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
WS-LAP-012
User Account
f.hall
Source IP
91.52.195.148
Destination IP
10.3.185.142
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

04:42:58 Event ingested by SOC365 Engine
04:43:03 EmilyAI triage started — correlation enrichment
04:43:07 EmilyAI confidence: 95% — escalated to human analyst
04:43:43 Alert assigned to analyst: Marcus Webb
04:43:44 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00314 2h ago Shadow IT Discovery Low Open WS-PC-006
ALR-00132 6h ago Shadow IT Discovery Low Open AP-WIFI-03
ALR-00466 6h ago Shadow IT Discovery Informational Open WS-PC-006
ALR-00008 8h ago DecoyPulse Honeypot Triggered Low Open WS-LAP-012
ALR-00091 13h ago Insider Threat Indicator High Escalated WS-LAP-012