Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:42:33 UTC

Unusual Outbound Traffic

Informational Resolved
ALR-00128 · 2026-10-07T06:14:43Z

Description

Unusual outbound traffic pattern from AP-WIFI-03 to IP in Eastern Europe. 450MB transferred over non-standard port. Flagged by Firewall.

Alert Metadata

Alert ID
ALR-00128
Timestamp
2026-10-07T06:14:43Z
Severity
Informational
Status
Resolved
Detection Source
Firewall
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
AP-WIFI-03
User Account
d.walker
Source IP
103.21.216.20
Destination IP
10.3.104.39
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1041
Reference
attack.mitre.org/techniques/T1041

Investigation Timeline

06:14:43 Event ingested by SOC365 Engine
06:14:46 EmilyAI triage started — correlation enrichment
06:14:52 EmilyAI confidence: 86% — escalated to human analyst
06:15:28 Alert assigned to analyst: EmilyAI (auto)
06:16:42 Investigation started — querying SIEM and threat intelligence
06:19:14 Containment action taken — endpoint isolated
06:25:27 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00160 22m ago Unusual Outbound Traffic Low Investigating WS-LAP-012
ALR-00232 6h ago C2 Beacon Activity Informational False Positive AP-WIFI-03
ALR-00171 10h ago Port Scan Detected Informational Escalated AP-WIFI-03
ALR-00077 15h ago Tor Exit Node Connection Medium Investigating AP-WIFI-03
ALR-00406 16h ago Kerberoasting Attempt Low Open AP-WIFI-03