Shadow IT Discovery

Medium Open

ALR-00130 · 2026-10-10T15:52:57Z

Description

Attack Surface Scanner discovered unauthorised SaaS application (file sharing) used by 'r.davies'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID: ALR-00130
Timestamp: 2026-10-10T15:52:57Z
Severity: Medium
Status: Open
Detection Source: Attack Surface Scanner
Assigned Analyst: James Okonkwo

Endpoint Information

Hostname: SRV-APP-01
User Account: r.davies
Source IP: 103.159.216.63
Destination IP: 10.1.203.175
Origin Country: VN Vietnam

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567
Reference: attack.mitre.org/techniques/T1567

Investigation Timeline

15:52:57 Event ingested by SOC365 Engine

15:53:02 EmilyAI triage started — correlation enrichment

15:53:05 EmilyAI confidence: 97% — escalated to human analyst

15:53:18 Alert assigned to analyst: James Okonkwo

15:55:41 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00205	9h ago	Suspicious Scheduled Task	High	Escalated	SRV-APP-01
ALR-00492	11h ago	Port Scan Detected	Low	False Positive	SRV-APP-01
ALR-00186	14h ago	Ransomware Behaviour Detected	High	Escalated	SRV-APP-01
ALR-00460	16h ago	Kerberoasting Attempt	Low	False Positive	SRV-APP-01
ALR-00057	19h ago	Privilege Escalation Attempt	Informational	Resolved	SRV-APP-01