Data Exfiltration Attempt
Low
Escalated
ALR-00221 · 2026-07-05T21:03:52Z
Description
Large data transfer (2.3GB) to cloud storage from WS-PC-003 by user 'h.roberts'. EmilyAI Triage DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
21:03:52
Event ingested by SOC365 Engine
21:03:56
EmilyAI triage started — correlation enrichment
21:04:07
EmilyAI confidence: 95% — escalated to human analyst
21:04:25
Alert assigned to analyst: EmilyAI (auto)
21:04:39
Investigation started — querying SIEM and threat intelligence
21:07:01
Containment action taken — endpoint isolated
21:14:56
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00251 | 1h ago | Pass-the-Hash Detected | Medium | False Positive | WS-PC-003 |
| ALR-00244 | 1h ago | Data Exfiltration Attempt | Low | Escalated | WS-LAP-011 |
| ALR-00209 | 8h ago | Unauthorised USB Device | Low | Escalated | WS-PC-003 |
| ALR-00332 | 9h ago | Privilege Escalation Attempt | Low | Open | WS-PC-003 |
| ALR-00302 | 10h ago | Data Exfiltration Attempt | Informational | Escalated | SRV-SQL-01 |