Port Scan Detected
Low
Escalated
ALR-00206 · 2026-07-04T20:37:22Z
Description
Sequential port scan (1-1024) detected targeting SW-CORE-01 from external IP. Dark Web Monitor identified SYN scan pattern.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
20:37:22
Event ingested by SOC365 Engine
20:37:27
EmilyAI triage started — correlation enrichment
20:37:37
EmilyAI confidence: 81% — escalated to human analyst
20:38:07
Alert assigned to analyst: EmilyAI (auto)
20:38:37
Investigation started — querying SIEM and threat intelligence
20:43:05
Containment action taken — endpoint isolated
20:56:25
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00080 | 1h ago | Failed MFA Challenge | Low | Resolved | SW-CORE-01 |
| ALR-00202 | 2h ago | Port Scan Detected | Medium | Resolved | SRV-SQL-01 |
| ALR-00148 | 6h ago | Port Scan Detected | High | Investigating | WS-LAP-010 |
| ALR-00494 | 9h ago | DLP Policy Violation | Critical | Investigating | SW-CORE-01 |
| ALR-00095 | 19h ago | Port Scan Detected | Medium | Investigating | SRV-WEB-01 |