Lateral Movement Detected
Low
False Positive
ALR-00177 · 2026-07-07T19:44:31Z
Description
SOC365 Engine detected lateral movement from WS-PC-006 to SRV-DC-01 using user 'c.williams' credentials. SMB admin shares accessed.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:44:31
Event ingested by SOC365 Engine
19:44:33
EmilyAI triage started — correlation enrichment
19:44:46
EmilyAI confidence: 83% — escalated to human analyst
19:44:58
Alert assigned to analyst: EmilyAI (auto)
19:46:09
Investigation started — querying SIEM and threat intelligence
19:54:07
Containment action taken — endpoint isolated
19:56:43
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00170 | 50m ago | Lateral Movement Detected | Informational | False Positive | WS-PC-006 |
| ALR-00224 | 3h ago | Lateral Movement Detected | High | Open | AP-WIFI-03 |
| ALR-00487 | 7h ago | Certificate Anomaly | Low | Escalated | WS-PC-006 |
| ALR-00040 | 11h ago | Insider Threat Indicator | Low | False Positive | WS-PC-006 |
| ALR-00185 | 15h ago | Lateral Movement Detected | Low | Resolved | WS-LAP-010 |