Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:45:39 UTC

Shadow IT Discovery

High Open
ALR-00199 · 2026-10-08T17:47:54Z

Description

DLP Module discovered unauthorised SaaS application (file sharing) used by 'a.wilson'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00199
Timestamp
2026-10-08T17:47:54Z
Severity
High
Status
Open
Detection Source
DLP Module
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
SRV-MAIL-01
User Account
a.wilson
Source IP
91.116.195.144
Destination IP
10.3.137.49
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

17:47:54 Event ingested by SOC365 Engine
17:47:57 EmilyAI triage started — correlation enrichment
17:48:04 EmilyAI confidence: 91% — escalated to human analyst
17:48:30 Alert assigned to analyst: Marcus Webb
17:49:27 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00420 4h ago Shadow IT Discovery Low False Positive WS-PC-006
ALR-00168 8h ago Shadow IT Discovery High Escalated VM-DEV-01
ALR-00162 10h ago Shadow IT Discovery Low Escalated WS-LAP-011
ALR-00409 10h ago Shadow IT Discovery Medium Investigating WS-PC-001
ALR-00063 11h ago Unusual Outbound Traffic Low Escalated SRV-MAIL-01