Phishing Email Blocked
Medium
False Positive
ALR-00123 · 2026-07-11T04:19:49Z
Description
Phishing email targeting 'l.johnson@company.co.uk' blocked by Firewall. Payload: credential harvesting link mimicking Microsoft 365 login.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
04:19:49
Event ingested by SOC365 Engine
04:19:53
EmilyAI triage started — correlation enrichment
04:19:55
EmilyAI confidence: 98% — escalated to human analyst
04:20:15
Alert assigned to analyst: James Okonkwo
04:20:40
Investigation started — querying SIEM and threat intelligence
04:25:07
Containment action taken — endpoint isolated
04:31:05
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00390 | 1h ago | Phishing Email Blocked | Low | Resolved | WS-LAP-010 |
| ALR-00243 | 2h ago | Suspicious PowerShell Execution | Medium | Open | VM-DEV-01 |
| ALR-00177 | 3h ago | Suspicious PowerShell Execution | Critical | Escalated | VM-DEV-01 |
| ALR-00258 | 6h ago | Suspicious Scheduled Task | Low | False Positive | VM-DEV-01 |
| ALR-00078 | 6h ago | Phishing Email Blocked | Medium | False Positive | WS-LAP-011 |