Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:41 UTC

Insider Threat Indicator

Low Resolved
ALR-00193 · 2026-10-08T22:24:23Z

Description

Anomalous after-hours access by 'n.clark' on AP-WIFI-03. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Dark Web Monitor.

Alert Metadata

Alert ID
ALR-00193
Timestamp
2026-10-08T22:24:23Z
Severity
Low
Status
Resolved
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
AP-WIFI-03
User Account
n.clark
Source IP
194.137.62.208
Destination IP
10.0.204.147
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

22:24:23 Event ingested by SOC365 Engine
22:24:27 EmilyAI triage started — correlation enrichment
22:24:37 EmilyAI confidence: 81% — escalated to human analyst
22:24:42 Alert assigned to analyst: EmilyAI (auto)
22:25:12 Investigation started — querying SIEM and threat intelligence
22:31:06 Containment action taken — endpoint isolated
22:41:39 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00451 8h ago Insider Threat Indicator High Open SW-CORE-01
ALR-00456 14h ago Unauthorised USB Device High Investigating AP-WIFI-03
ALR-00424 15h ago Insider Threat Indicator Low Open WS-LAP-011
ALR-00484 17h ago Anomalous DNS Query Informational Investigating AP-WIFI-03
ALR-00089 20h ago Insider Threat Indicator Low Escalated WS-PC-003