Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:44 UTC

Insider Threat Indicator

Low False Positive
ALR-00190 · 2026-10-06T17:01:50Z

Description

Anomalous after-hours access by 's.jones' on SRV-SQL-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Email Gateway.

Alert Metadata

Alert ID
ALR-00190
Timestamp
2026-10-06T17:01:50Z
Severity
Low
Status
False Positive
Detection Source
Email Gateway
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-SQL-01
User Account
s.jones
Source IP
185.127.220.99
Destination IP
10.1.149.168
Origin Country
BR Brazil

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

17:01:50 Event ingested by SOC365 Engine
17:01:54 EmilyAI triage started — correlation enrichment
17:02:04 EmilyAI confidence: 98% — escalated to human analyst
17:02:05 Alert assigned to analyst: EmilyAI (auto)
17:04:14 Investigation started — querying SIEM and threat intelligence
17:10:07 Containment action taken — endpoint isolated
17:15:31 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00448 20m ago Suspicious PowerShell Execution Low False Positive SRV-SQL-01
ALR-00468 4h ago Insider Threat Indicator Low False Positive WS-PC-001
ALR-00359 6h ago Anomalous DNS Query High Escalated SRV-SQL-01
ALR-00390 13h ago Insider Threat Indicator Low Escalated SRV-APP-01
ALR-00228 17h ago Insider Threat Indicator Medium Resolved SRV-DC-01