Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:44:02 UTC

DLP Policy Violation

Low Open
ALR-00127 · 2026-10-10T02:59:46Z

Description

DLP policy violation: user 'n.clark' attempted to email 3 files classified as 'Confidential' to external address from WS-LAP-011.

Alert Metadata

Alert ID
ALR-00127
Timestamp
2026-10-10T02:59:46Z
Severity
Low
Status
Open
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-011
User Account
n.clark
Source IP
194.102.62.92
Destination IP
10.0.128.91
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1048
Reference
attack.mitre.org/techniques/T1048

Investigation Timeline

02:59:46 Event ingested by SOC365 Engine
02:59:47 EmilyAI triage started — correlation enrichment
03:00:01 EmilyAI confidence: 80% — escalated to human analyst
03:00:26 Alert assigned to analyst: EmilyAI (auto)
03:00:55 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00481 2h ago Failed MFA Challenge High Open WS-LAP-011
ALR-00340 4h ago DLP Policy Violation Informational Resolved WS-LAP-010
ALR-00044 6h ago DLP Policy Violation Medium Escalated WS-LAP-010
ALR-00177 12h ago DLP Policy Violation Informational False Positive FW-EDGE-01
ALR-00398 13h ago DLP Policy Violation Medium Open SRV-BACKUP-01