Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:07 UTC

Shadow IT Discovery

Low Resolved
ALR-00188 · 2026-10-09T14:40:15Z

Description

Dark Web Monitor discovered unauthorised SaaS application (file sharing) used by 'e.evans'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00188
Timestamp
2026-10-09T14:40:15Z
Severity
Low
Status
Resolved
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-WEB-01
User Account
e.evans
Source IP
103.232.216.91
Destination IP
10.3.87.225
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

14:40:15 Event ingested by SOC365 Engine
14:40:16 EmilyAI triage started — correlation enrichment
14:40:26 EmilyAI confidence: 91% — escalated to human analyst
14:40:53 Alert assigned to analyst: EmilyAI (auto)
14:43:12 Investigation started — querying SIEM and threat intelligence
14:46:25 Containment action taken — endpoint isolated
14:54:04 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00378 17h ago C2 Beacon Activity Medium Resolved SRV-WEB-01
ALR-00090 1d ago Data Exfiltration Attempt Informational Escalated SRV-WEB-01
ALR-00130 1d ago Shadow IT Discovery Medium Open SRV-APP-01
ALR-00172 1d ago Rogue DHCP Server High Investigating SRV-WEB-01
ALR-00387 1d ago Shadow IT Discovery Low Resolved WS-LAP-012