Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:40 UTC

Port Scan Detected

High Open
ALR-00195 · 2026-10-08T15:40:47Z

Description

Sequential port scan (1-1024) detected targeting SW-CORE-01 from external IP. Email Gateway identified SYN scan pattern.

Alert Metadata

Alert ID
ALR-00195
Timestamp
2026-10-08T15:40:47Z
Severity
High
Status
Open
Detection Source
Email Gateway
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
SW-CORE-01
User Account
c.williams
Source IP
185.109.220.39
Destination IP
10.1.148.159
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Reconnaissance
Technique
T1046
Reference
attack.mitre.org/techniques/T1046

Investigation Timeline

15:40:47 Event ingested by SOC365 Engine
15:40:51 EmilyAI triage started — correlation enrichment
15:40:57 EmilyAI confidence: 94% — escalated to human analyst
15:41:24 Alert assigned to analyst: Marcus Webb
15:42:00 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00049 5h ago Phishing Email Blocked Medium Open SW-CORE-01
ALR-00451 8h ago Insider Threat Indicator High Open SW-CORE-01
ALR-00492 11h ago Port Scan Detected Low False Positive SRV-APP-01
ALR-00498 13h ago Port Scan Detected High Open SRV-FILE-01
ALR-00227 14h ago Certificate Anomaly Informational Open SW-CORE-01