Brute Force SSH

Medium Escalated

ALR-00180 · 2026-10-06T03:36:22Z

Description

Multiple failed SSH login attempts detected on WS-PC-004 from external IP. Attack Surface Scanner flagged 47 attempts in 5 minutes targeting user 'c.williams'.

Alert Metadata

Alert ID: ALR-00180
Timestamp: 2026-10-06T03:36:22Z
Severity: Medium
Status: Escalated
Detection Source: Attack Surface Scanner
Assigned Analyst: James Okonkwo

Endpoint Information

Hostname: WS-PC-004
User Account: c.williams
Source IP: 185.159.220.49
Destination IP: 10.3.198.15
Origin Country: GB United Kingdom

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

03:36:22 Event ingested by SOC365 Engine

03:36:24 EmilyAI triage started — correlation enrichment

03:36:36 EmilyAI confidence: 96% — escalated to human analyst

03:37:06 Alert assigned to analyst: James Okonkwo

03:37:58 Investigation started — querying SIEM and threat intelligence

03:43:28 Containment action taken — endpoint isolated

03:48:50 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00297	4h ago	Brute Force SSH	Low	False Positive	SRV-SQL-01
ALR-00131	1d ago	Certificate Anomaly	Informational	Escalated	WS-PC-004
ALR-00237	1d ago	Insider Threat Indicator	High	Open	WS-PC-004
ALR-00058	1d ago	Brute Force SSH	Low	Open	WS-PC-001
ALR-00100	2d ago	Brute Force SSH	Low	Resolved	VM-DEV-01