DLP Policy Violation
Medium
Resolved
ALR-00207 · 2026-07-07T17:12:00Z
Description
DLP policy violation: user 'h.roberts' attempted to email 3 files classified as 'Confidential' to external address from WS-MAC-005.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:12:00
Event ingested by SOC365 Engine
17:12:01
EmilyAI triage started — correlation enrichment
17:12:11
EmilyAI confidence: 81% — escalated to human analyst
17:12:35
Alert assigned to analyst: Emma Richardson
17:13:14
Investigation started — querying SIEM and threat intelligence
17:15:33
Containment action taken — endpoint isolated
17:25:57
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00494 | 9h ago | DLP Policy Violation | Critical | Investigating | SW-CORE-01 |
| ALR-00067 | 13h ago | DLP Policy Violation | Medium | Investigating | WS-LAP-012 |
| ALR-00446 | 16h ago | Certificate Anomaly | Medium | Investigating | WS-MAC-005 |
| ALR-00118 | 19h ago | DLP Policy Violation | High | Open | WS-LAP-012 |
| ALR-00141 | 21h ago | DLP Policy Violation | Medium | Investigating | SRV-FILE-01 |