Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:52:40 UTC

Port Scan Detected

Informational Escalated
ALR-00194 · 2026-10-09T14:15:19Z

Description

Sequential port scan (1-1024) detected targeting SRV-BACKUP-01 from external IP. Endpoint Agent identified SYN scan pattern.

Alert Metadata

Alert ID
ALR-00194
Timestamp
2026-10-09T14:15:19Z
Severity
Informational
Status
Escalated
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-BACKUP-01
User Account
l.johnson
Source IP
91.98.195.204
Destination IP
10.2.79.160
Origin Country
RO Romania

MITRE ATT&CK Mapping

Tactic
Reconnaissance
Technique
T1046
Reference
attack.mitre.org/techniques/T1046

Investigation Timeline

14:15:19 Event ingested by SOC365 Engine
14:15:24 EmilyAI triage started — correlation enrichment
14:15:30 EmilyAI confidence: 84% — escalated to human analyst
14:15:42 Alert assigned to analyst: EmilyAI (auto)
14:17:20 Investigation started — querying SIEM and threat intelligence
14:21:04 Containment action taken — endpoint isolated
14:27:33 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00277 8h ago Tor Exit Node Connection Medium Investigating SRV-BACKUP-01
ALR-00355 12h ago Unusual Outbound Traffic Medium Escalated SRV-BACKUP-01
ALR-00118 16h ago Anomalous DNS Query Medium False Positive SRV-BACKUP-01
ALR-00086 17h ago Port Scan Detected Low False Positive SRV-BACKUP-01
ALR-00093 23h ago Ransomware Behaviour Detected Medium Resolved SRV-BACKUP-01