Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:06 UTC

Insider Threat Indicator

Low Resolved
ALR-00135 · 2026-10-09T20:08:58Z

Description

Anomalous after-hours access by 'p.thomas' on SRV-APP-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Endpoint Agent.

Alert Metadata

Alert ID
ALR-00135
Timestamp
2026-10-09T20:08:58Z
Severity
Low
Status
Resolved
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-APP-01
User Account
p.thomas
Source IP
185.90.220.91
Destination IP
10.3.102.246
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

20:08:58 Event ingested by SOC365 Engine
20:09:01 EmilyAI triage started — correlation enrichment
20:09:08 EmilyAI confidence: 80% — escalated to human analyst
20:09:33 Alert assigned to analyst: EmilyAI (auto)
20:10:56 Investigation started — querying SIEM and threat intelligence
20:13:06 Containment action taken — endpoint isolated
20:22:09 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00451 8h ago Insider Threat Indicator High Open SW-CORE-01
ALR-00205 9h ago Suspicious Scheduled Task High Escalated SRV-APP-01
ALR-00492 11h ago Port Scan Detected Low False Positive SRV-APP-01
ALR-00186 14h ago Ransomware Behaviour Detected High Escalated SRV-APP-01
ALR-00424 15h ago Insider Threat Indicator Low Open WS-LAP-011