DLP Policy Violation
Informational
Resolved
ALR-00186 · 2026-07-07T07:56:50Z
Description
DLP policy violation: user 's.jones' attempted to email 3 files classified as 'Confidential' to external address from WS-LAP-011.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
07:56:50
Event ingested by SOC365 Engine
07:56:52
EmilyAI triage started — correlation enrichment
07:57:03
EmilyAI confidence: 84% — escalated to human analyst
07:57:10
Alert assigned to analyst: EmilyAI (auto)
07:58:17
Investigation started — querying SIEM and threat intelligence
08:06:10
Containment action taken — endpoint isolated
08:12:39
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00262 | 36m ago | C2 Beacon Activity | Low | False Positive | WS-LAP-011 |
| ALR-00438 | 46m ago | DLP Policy Violation | Medium | Open | SRV-DC-01 |
| ALR-00406 | 1h ago | DLP Policy Violation | Medium | Escalated | WS-PC-003 |
| ALR-00062 | 4h ago | Anomalous DNS Query | Informational | Resolved | WS-LAP-011 |
| ALR-00109 | 5h ago | DLP Policy Violation | Low | False Positive | WS-LAP-012 |