Phishing Email Blocked

Low Open

ALR-00216 · 2026-10-06T10:11:26Z

Description

Phishing email targeting 'k.brown@company.co.uk' blocked by Attack Surface Scanner. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID: ALR-00216
Timestamp: 2026-10-06T10:11:26Z
Severity: Low
Status: Open
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-BACKUP-01
User Account: k.brown
Source IP: 194.122.62.130
Destination IP: 10.1.10.180
Origin Country: FR France

MITRE ATT&CK Mapping

Tactic: Initial Access
Technique: T1566.001
Reference: attack.mitre.org/techniques/T1566.001

Investigation Timeline

10:11:26 Event ingested by SOC365 Engine

10:11:30 EmilyAI triage started — correlation enrichment

10:11:38 EmilyAI confidence: 82% — escalated to human analyst

10:11:51 Alert assigned to analyst: EmilyAI (auto)

10:13:32 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00029	17m ago	Phishing Email Blocked	Low	Investigating	WS-MAC-005
ALR-00455	6h ago	DLP Policy Violation	Critical	Open	SRV-BACKUP-01
ALR-00043	8h ago	Phishing Email Blocked	Low	Open	FW-EDGE-01
ALR-00365	12h ago	Phishing Email Blocked	Medium	Open	WS-PC-004
ALR-00048	15h ago	Phishing Email Blocked	Medium	Open	SRV-APP-01