Failed MFA Challenge
Informational
Escalated
ALR-00225 · 2026-07-05T22:09:32Z
Description
Multiple failed MFA challenges for user 'l.johnson' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Cloud Connector locked account.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
22:09:32
Event ingested by SOC365 Engine
22:09:35
EmilyAI triage started — correlation enrichment
22:09:41
EmilyAI confidence: 81% — escalated to human analyst
22:10:17
Alert assigned to analyst: EmilyAI (auto)
22:10:45
Investigation started — querying SIEM and threat intelligence
22:13:22
Containment action taken — endpoint isolated
22:28:52
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00095 | 3h ago | Failed MFA Challenge | Low | Escalated | WS-PC-006 |
| ALR-00249 | 8h ago | Privilege Escalation Attempt | Medium | Resolved | WS-PC-002 |
| ALR-00181 | 11h ago | Credential Stuffing Attempt | Informational | Escalated | WS-PC-002 |
| ALR-00140 | 1d ago | DecoyPulse Honeypot Triggered | Low | Open | WS-PC-002 |
| ALR-00217 | 1d ago | Failed MFA Challenge | Medium | Investigating | SRV-BACKUP-01 |