Kerberoasting Attempt
Medium
False Positive
ALR-00169 · 2026-07-06T08:16:35Z
Description
Kerberoasting attack detected: user 'k.brown' requested TGS tickets for multiple service accounts in 2 minutes. Flagged by Endpoint Agent.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:16:35
Event ingested by SOC365 Engine
08:16:37
EmilyAI triage started — correlation enrichment
08:16:41
EmilyAI confidence: 97% — escalated to human analyst
08:16:52
Alert assigned to analyst: Anika Patel
08:18:53
Investigation started — querying SIEM and threat intelligence
08:20:13
Containment action taken — endpoint isolated
08:27:44
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00427 | 4h ago | Kerberoasting Attempt | Low | Resolved | SRV-DC-01 |
| ALR-00112 | 8h ago | Phishing Email Blocked | Low | False Positive | SRV-DC-01 |
| ALR-00175 | 10h ago | Insider Threat Indicator | Informational | Open | SRV-DC-01 |
| ALR-00056 | 11h ago | Kerberoasting Attempt | Medium | Escalated | SRV-DC-01 |
| ALR-00225 | 1d ago | Lateral Movement Detected | Low | Open | SRV-DC-01 |