Failed MFA Challenge

Low False Positive

ALR-00217 · 2026-07-06T15:50:22Z

Description

Multiple failed MFA challenges for user 'm.taylor' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Dark Web Monitor locked account.

Alert Metadata

Alert ID: ALR-00217
Timestamp: 2026-07-06T15:50:22Z
Severity: Low
Status: False Positive
Detection Source: Dark Web Monitor
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-WEB-01
User Account: m.taylor
Source IP: 45.248.148.72
Destination IP: 10.1.88.173
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

15:50:22 Event ingested by SOC365 Engine

15:50:23 EmilyAI triage started — correlation enrichment

15:50:34 EmilyAI confidence: 83% — escalated to human analyst

15:51:05 Alert assigned to analyst: EmilyAI (auto)

15:51:33 Investigation started — querying SIEM and threat intelligence

15:55:53 Containment action taken — endpoint isolated

16:09:46 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00119	3h ago	Shadow IT Discovery	Low	Escalated	SRV-WEB-01
ALR-00470	3h ago	Suspicious PowerShell Execution	Low	Open	SRV-WEB-01
ALR-00106	10h ago	Privilege Escalation Attempt	Medium	Open	SRV-WEB-01
ALR-00189	1d ago	Failed MFA Challenge	Low	False Positive	SRV-FILE-01
ALR-00128	1d ago	Failed MFA Challenge	Low	False Positive	SRV-SQL-01