Ransomware Behaviour Detected
Informational
Resolved
ALR-00123 · 2026-07-11T01:25:53Z
Description
File encryption behaviour detected on WS-LAP-012. 142 files renamed with .locked extension in 30 seconds. Network IDS isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
01:25:53
Event ingested by SOC365 Engine
01:25:55
EmilyAI triage started — correlation enrichment
01:26:07
EmilyAI confidence: 85% — escalated to human analyst
01:26:13
Alert assigned to analyst: EmilyAI (auto)
01:28:06
Investigation started — querying SIEM and threat intelligence
01:31:33
Containment action taken — endpoint isolated
01:36:10
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00043 | 3h ago | Data Exfiltration Attempt | Low | False Positive | WS-LAP-012 |
| ALR-00110 | 5h ago | Kerberoasting Attempt | Low | Open | WS-LAP-012 |
| ALR-00050 | 11h ago | Anomalous DNS Query | Low | False Positive | WS-LAP-012 |
| ALR-00082 | 13h ago | Privilege Escalation Attempt | Medium | Escalated | WS-LAP-012 |
| ALR-00095 | 16h ago | Malware Signature Match | Critical | Escalated | WS-LAP-012 |