Brute Force SSH

Informational Investigating

ALR-00173 · 2026-07-10T11:34:30Z

Description

Multiple failed SSH login attempts detected on WS-LAP-010 from external IP. EmilyAI Triage flagged 47 attempts in 5 minutes targeting user 'a.wilson'.

Alert Metadata

Alert ID: ALR-00173
Timestamp: 2026-07-10T11:34:30Z
Severity: Informational
Status: Investigating
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-LAP-010
User Account: a.wilson
Source IP: 103.252.216.82
Destination IP: 10.0.239.67
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

11:34:30 Event ingested by SOC365 Engine

11:34:35 EmilyAI triage started — correlation enrichment

11:34:36 EmilyAI confidence: 79% — escalated to human analyst

11:35:04 Alert assigned to analyst: EmilyAI (auto)

11:36:10 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00416	2h ago	DecoyPulse Honeypot Triggered	Low	Escalated	WS-LAP-010
ALR-00487	6h ago	Brute Force SSH	High	Investigating	SRV-SQL-01
ALR-00102	11h ago	Brute Force SSH	Low	False Positive	SRV-APP-01
ALR-00451	11h ago	Port Scan Detected	Medium	False Positive	WS-LAP-010
ALR-00159	19h ago	Rogue DHCP Server	High	Investigating	WS-LAP-010