Shadow IT Discovery
Critical
Escalated
ALR-00215 · 2026-10-09T10:26:41Z
Description
DecoyPulse discovered unauthorised SaaS application (file sharing) used by 'f.hall'. 14GB of company data synced to unapproved cloud storage.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
10:26:41
Event ingested by SOC365 Engine
10:26:46
EmilyAI triage started — correlation enrichment
10:26:56
EmilyAI confidence: 90% — escalated to human analyst
10:27:08
Alert assigned to analyst: Sarah Chen
10:28:41
Investigation started — querying SIEM and threat intelligence
10:29:44
Containment action taken — endpoint isolated
10:41:27
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00347 | 10h ago | Brute Force SSH | Low | False Positive | WS-PC-006 |
| ALR-00136 | 10h ago | Suspicious PowerShell Execution | Low | Escalated | WS-PC-006 |
| ALR-00271 | 19h ago | Shadow IT Discovery | Medium | Investigating | SRV-DC-01 |
| ALR-00181 | 1d ago | Pass-the-Hash Detected | Medium | Resolved | WS-PC-006 |
| ALR-00092 | 1d ago | Anomalous DNS Query | Medium | Open | WS-PC-006 |