Failed MFA Challenge

Low Resolved

ALR-00147 · 2026-10-05T16:48:30Z

Description

Multiple failed MFA challenges for user 'c.williams' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. EmilyAI Triage locked account.

Alert Metadata

Alert ID: ALR-00147
Timestamp: 2026-10-05T16:48:30Z
Severity: Low
Status: Resolved
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: FW-EDGE-01
User Account: c.williams
Source IP: 194.151.62.182
Destination IP: 10.3.181.169
Origin Country: FR France

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

16:48:30 Event ingested by SOC365 Engine

16:48:34 EmilyAI triage started — correlation enrichment

16:48:38 EmilyAI confidence: 90% — escalated to human analyst

16:48:55 Alert assigned to analyst: EmilyAI (auto)

16:49:59 Investigation started — querying SIEM and threat intelligence

16:54:58 Containment action taken — endpoint isolated

17:02:41 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00296	2m ago	Failed MFA Challenge	Informational	Resolved	WS-LAP-012
ALR-00282	33m ago	Failed MFA Challenge	Informational	False Positive	SRV-FILE-01
ALR-00109	4h ago	Phishing Email Blocked	High	Open	FW-EDGE-01
ALR-00143	5h ago	DecoyPulse Honeypot Triggered	Low	Escalated	FW-EDGE-01
ALR-00037	5h ago	Failed MFA Challenge	Informational	Escalated	WS-PC-006