Kerberoasting Attempt
Low
Open
ALR-00110 · 2026-07-11T14:42:00Z
Description
Kerberoasting attack detected: user 'j.smith' requested TGS tickets for multiple service accounts in 2 minutes. Flagged by DLP Module.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
14:42:00
Event ingested by SOC365 Engine
14:42:04
EmilyAI triage started — correlation enrichment
14:42:15
EmilyAI confidence: 93% — escalated to human analyst
14:42:38
Alert assigned to analyst: EmilyAI (auto)
14:43:50
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00043 | 3h ago | Data Exfiltration Attempt | Low | False Positive | WS-LAP-012 |
| ALR-00020 | 5h ago | Kerberoasting Attempt | Medium | Resolved | SRV-FILE-01 |
| ALR-00447 | 7h ago | Kerberoasting Attempt | Low | Escalated | SRV-APP-01 |
| ALR-00276 | 8h ago | Kerberoasting Attempt | High | Escalated | AP-WIFI-03 |
| ALR-00050 | 11h ago | Anomalous DNS Query | Low | False Positive | WS-LAP-012 |