Brute Force SSH

Low Open

ALR-00219 · 2026-10-07T02:12:44Z

Description

Multiple failed SSH login attempts detected on SW-CORE-01 from external IP. Attack Surface Scanner flagged 47 attempts in 5 minutes targeting user 'k.brown'.

Alert Metadata

Alert ID: ALR-00219
Timestamp: 2026-10-07T02:12:44Z
Severity: Low
Status: Open
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SW-CORE-01
User Account: k.brown
Source IP: 185.247.220.118
Destination IP: 10.1.120.148
Origin Country: RO Romania

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

02:12:44 Event ingested by SOC365 Engine

02:12:49 EmilyAI triage started — correlation enrichment

02:12:56 EmilyAI confidence: 94% — escalated to human analyst

02:13:05 Alert assigned to analyst: EmilyAI (auto)

02:15:14 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00277	1h ago	Brute Force SSH	High	Open	WS-LAP-010
ALR-00125	3h ago	Ransomware Behaviour Detected	Informational	False Positive	SW-CORE-01
ALR-00064	4h ago	Brute Force SSH	High	Open	SRV-FILE-01
ALR-00234	4h ago	Brute Force SSH	High	Investigating	WS-PC-004
ALR-00258	4h ago	Certificate Anomaly	Medium	Open	SW-CORE-01