Data Exfiltration Attempt
Low
Resolved
ALR-00182 · 2026-05-21T23:47:03Z
Description
Large data transfer (2.3GB) to cloud storage from FW-EDGE-01 by user 'j.smith'. Dark Web Monitor DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
23:47:03
Event ingested by SOC365 Engine
23:47:08
EmilyAI triage started — correlation enrichment
23:47:10
EmilyAI confidence: 89% — escalated to human analyst
23:47:40
Alert assigned to analyst: EmilyAI (auto)
23:48:37
Investigation started — querying SIEM and threat intelligence
23:52:18
Containment action taken — endpoint isolated
23:59:24
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00257 | 2h ago | Data Exfiltration Attempt | Informational | Open | WS-LAP-011 |
| ALR-00029 | 4h ago | Tor Exit Node Connection | Informational | Resolved | FW-EDGE-01 |
| ALR-00050 | 4h ago | Insider Threat Indicator | Medium | False Positive | FW-EDGE-01 |
| ALR-00364 | 10h ago | Data Exfiltration Attempt | Low | Open | SW-CORE-01 |
| ALR-00398 | 14h ago | Data Exfiltration Attempt | Low | Escalated | WS-PC-001 |