Lateral Movement Detected
Medium
Resolved
ALR-00167 · 2026-07-09T05:02:20Z
Description
SOC365 Engine detected lateral movement from WS-LAP-011 to SRV-DC-01 using user 'p.thomas' credentials. SMB admin shares accessed.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
05:02:20
Event ingested by SOC365 Engine
05:02:25
EmilyAI triage started — correlation enrichment
05:02:26
EmilyAI confidence: 82% — escalated to human analyst
05:02:38
Alert assigned to analyst: Marcus Webb
05:04:13
Investigation started — querying SIEM and threat intelligence
05:07:27
Containment action taken — endpoint isolated
05:12:44
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00426 | 2h ago | Brute Force SSH | Medium | Open | WS-LAP-011 |
| ALR-00412 | 2h ago | Lateral Movement Detected | Medium | Investigating | SW-CORE-01 |
| ALR-00242 | 5h ago | Ransomware Behaviour Detected | Critical | Open | WS-LAP-011 |
| ALR-00205 | 9h ago | Port Scan Detected | Medium | Resolved | WS-LAP-011 |
| ALR-00096 | 13h ago | Brute Force SSH | High | Escalated | WS-LAP-011 |