Unauthorised USB Device
Informational
Resolved
ALR-00157 · 2026-07-08T04:11:54Z
Description
Unauthorised USB mass storage device connected to SRV-MAIL-01 by user 'f.hall'. Device blocked by Email Gateway endpoint policy.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
04:11:54
Event ingested by SOC365 Engine
04:11:56
EmilyAI triage started — correlation enrichment
04:12:01
EmilyAI confidence: 83% — escalated to human analyst
04:12:12
Alert assigned to analyst: EmilyAI (auto)
04:13:17
Investigation started — querying SIEM and threat intelligence
04:18:00
Containment action taken — endpoint isolated
04:30:51
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00488 | 1h ago | Unauthorised USB Device | Medium | Open | SRV-DC-01 |
| ALR-00078 | 4h ago | Credential Stuffing Attempt | Informational | Escalated | SRV-MAIL-01 |
| ALR-00399 | 7h ago | Failed MFA Challenge | Low | Open | SRV-MAIL-01 |
| ALR-00067 | 16h ago | C2 Beacon Activity | High | Open | SRV-MAIL-01 |
| ALR-00303 | 16h ago | Unauthorised USB Device | Low | False Positive | WS-PC-006 |