Failed MFA Challenge

Low Resolved

ALR-00162 · 2026-07-05T13:44:56Z

Description

Multiple failed MFA challenges for user 'n.clark' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Attack Surface Scanner locked account.

Alert Metadata

Alert ID: ALR-00162
Timestamp: 2026-07-05T13:44:56Z
Severity: Low
Status: Resolved
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: AP-WIFI-03
User Account: n.clark
Source IP: 103.117.216.51
Destination IP: 10.0.25.66
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

13:44:56 Event ingested by SOC365 Engine

13:45:00 EmilyAI triage started — correlation enrichment

13:45:10 EmilyAI confidence: 83% — escalated to human analyst

13:45:12 Alert assigned to analyst: EmilyAI (auto)

13:47:11 Investigation started — querying SIEM and threat intelligence

13:48:10 Containment action taken — endpoint isolated

14:00:34 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00080	1h ago	Failed MFA Challenge	Low	Resolved	SW-CORE-01
ALR-00054	2h ago	Privilege Escalation Attempt	Informational	Escalated	AP-WIFI-03
ALR-00438	2h ago	Insider Threat Indicator	Medium	False Positive	AP-WIFI-03
ALR-00010	8h ago	Failed MFA Challenge	Informational	Open	WS-PC-004
ALR-00363	19h ago	Failed MFA Challenge	Low	Investigating	WS-LAP-011