Brute Force SSH
Low
Resolved
ALR-00128 · 2026-07-07T18:29:49Z
Description
Multiple failed SSH login attempts detected on WS-PC-006 from external IP. Attack Surface Scanner flagged 47 attempts in 5 minutes targeting user 'm.taylor'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:29:49
Event ingested by SOC365 Engine
18:29:53
EmilyAI triage started — correlation enrichment
18:30:04
EmilyAI confidence: 93% — escalated to human analyst
18:30:10
Alert assigned to analyst: EmilyAI (auto)
18:32:16
Investigation started — querying SIEM and threat intelligence
18:39:09
Containment action taken — endpoint isolated
18:45:04
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00262 | 2m ago | Insider Threat Indicator | Low | Investigating | WS-PC-006 |
| ALR-00361 | 1h ago | Suspicious Scheduled Task | Medium | Escalated | WS-PC-006 |
| ALR-00161 | 2h ago | Brute Force SSH | High | Escalated | SRV-MAIL-01 |
| ALR-00015 | 10h ago | Brute Force SSH | Medium | Resolved | WS-LAP-012 |
| ALR-00345 | 13h ago | Brute Force SSH | High | Investigating | SRV-APP-01 |