Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:45:39 UTC

Shadow IT Discovery

Medium Escalated
ALR-00205 · 2026-10-08T20:55:59Z

Description

SOC365 Engine discovered unauthorised SaaS application (file sharing) used by 's.jones'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00205
Timestamp
2026-10-08T20:55:59Z
Severity
Medium
Status
Escalated
Detection Source
SOC365 Engine
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
SRV-FILE-01
User Account
s.jones
Source IP
91.36.195.219
Destination IP
10.3.148.84
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

20:55:59 Event ingested by SOC365 Engine
20:56:01 EmilyAI triage started — correlation enrichment
20:56:09 EmilyAI confidence: 92% — escalated to human analyst
20:56:16 Alert assigned to analyst: Marcus Webb
20:56:54 Investigation started — querying SIEM and threat intelligence
21:03:39 Containment action taken — endpoint isolated
21:13:39 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00001 1h ago Lateral Movement Detected Low Resolved SRV-FILE-01
ALR-00420 4h ago Shadow IT Discovery Low False Positive WS-PC-006
ALR-00285 7h ago Brute Force SSH Informational False Positive SRV-FILE-01
ALR-00168 8h ago Shadow IT Discovery High Escalated VM-DEV-01
ALR-00162 10h ago Shadow IT Discovery Low Escalated WS-LAP-011