Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:40:32 UTC

Lateral Movement Detected

Medium Open
ALR-00155 · 2026-10-11T18:47:33Z

Description

Firewall detected lateral movement from WS-LAP-012 to SRV-DC-01 using user 'j.smith' credentials. SMB admin shares accessed.

Alert Metadata

Alert ID
ALR-00155
Timestamp
2026-10-11T18:47:33Z
Severity
Medium
Status
Open
Detection Source
Firewall
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
WS-LAP-012
User Account
j.smith
Source IP
103.249.216.101
Destination IP
10.3.77.170
Origin Country
VN Vietnam

MITRE ATT&CK Mapping

Tactic
Lateral Movement
Technique
T1021.002
Reference
attack.mitre.org/techniques/T1021.002

Investigation Timeline

18:47:33 Event ingested by SOC365 Engine
18:47:37 EmilyAI triage started — correlation enrichment
18:47:40 EmilyAI confidence: 93% — escalated to human analyst
18:48:16 Alert assigned to analyst: Marcus Webb
18:50:28 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00296 2m ago Failed MFA Challenge Informational Resolved WS-LAP-012
ALR-00266 2h ago Lateral Movement Detected Low Escalated SRV-WEB-01
ALR-00087 6h ago Lateral Movement Detected Informational Investigating WS-PC-001
ALR-00445 7h ago DecoyPulse Honeypot Triggered Medium Open WS-LAP-012
ALR-00424 10h ago Rogue DHCP Server Medium Open WS-LAP-012