Brute Force SSH

Informational False Positive

ALR-00175 · 2026-10-12T01:59:57Z

Description

Multiple failed SSH login attempts detected on SRV-BACKUP-01 from external IP. Endpoint Agent flagged 47 attempts in 5 minutes targeting user 'c.williams'.

Alert Metadata

Alert ID: ALR-00175
Timestamp: 2026-10-12T01:59:57Z
Severity: Informational
Status: False Positive
Detection Source: Endpoint Agent
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-BACKUP-01
User Account: c.williams
Source IP: 45.84.148.94
Destination IP: 10.2.85.158
Origin Country: BR Brazil

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

01:59:57 Event ingested by SOC365 Engine

01:59:58 EmilyAI triage started — correlation enrichment

02:00:05 EmilyAI confidence: 97% — escalated to human analyst

02:00:14 Alert assigned to analyst: EmilyAI (auto)

02:02:08 Investigation started — querying SIEM and threat intelligence

02:04:36 Containment action taken — endpoint isolated

02:16:05 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00396	6m ago	Tor Exit Node Connection	High	Open	SRV-BACKUP-01
ALR-00249	4h ago	Insider Threat Indicator	Low	False Positive	SRV-BACKUP-01
ALR-00484	6h ago	Pass-the-Hash Detected	Low	Open	SRV-BACKUP-01
ALR-00311	8h ago	Brute Force SSH	Low	Investigating	WS-LAP-011
ALR-00447	8h ago	Brute Force SSH	Medium	Open	WS-PC-006