Phishing Email Blocked

Low Investigating

ALR-00167 · 2026-10-06T07:52:54Z

Description

Phishing email targeting 'j.smith@company.co.uk' blocked by Attack Surface Scanner. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID: ALR-00167
Timestamp: 2026-10-06T07:52:54Z
Severity: Low
Status: Investigating
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-LAP-010
User Account: j.smith
Source IP: 103.239.216.55
Destination IP: 10.3.156.14
Origin Country: RO Romania

MITRE ATT&CK Mapping

Tactic: Initial Access
Technique: T1566.001
Reference: attack.mitre.org/techniques/T1566.001

Investigation Timeline

07:52:54 Event ingested by SOC365 Engine

07:52:58 EmilyAI triage started — correlation enrichment

07:53:05 EmilyAI confidence: 95% — escalated to human analyst

07:53:31 Alert assigned to analyst: EmilyAI (auto)

07:54:41 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00277	1h ago	Brute Force SSH	High	Open	WS-LAP-010
ALR-00079	1h ago	Malware Signature Match	Informational	Resolved	WS-LAP-010
ALR-00080	5h ago	Suspicious PowerShell Execution	Medium	Escalated	WS-LAP-010
ALR-00467	9h ago	Unauthorised USB Device	Informational	Resolved	WS-LAP-010
ALR-00202	10h ago	Phishing Email Blocked	High	Open	SRV-MAIL-01