Lateral Movement Detected
High
Open
ALR-00211 · 2026-07-09T15:35:48Z
Description
DecoyPulse detected lateral movement from WS-PC-002 to SRV-DC-01 using user 'd.walker' credentials. SMB admin shares accessed.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
15:35:48
Event ingested by SOC365 Engine
15:35:53
EmilyAI triage started — correlation enrichment
15:35:53
EmilyAI confidence: 80% — escalated to human analyst
15:36:18
Alert assigned to analyst: James Okonkwo
15:37:51
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00410 | 8h ago | Lateral Movement Detected | Low | False Positive | FW-EDGE-01 |
| ALR-00256 | 14h ago | DecoyPulse Honeypot Triggered | Informational | False Positive | WS-PC-002 |
| ALR-00005 | 14h ago | DecoyPulse Honeypot Triggered | Medium | False Positive | WS-PC-002 |
| ALR-00131 | 16h ago | Suspicious Scheduled Task | Medium | Investigating | WS-PC-002 |
| ALR-00170 | 16h ago | Kerberoasting Attempt | Medium | False Positive | WS-PC-002 |