Data Exfiltration Attempt

Low Escalated

ALR-00225 · 2026-10-08T05:03:47Z

Description

Large data transfer (2.3GB) to cloud storage from SRV-APP-01 by user 'c.williams'. Cloud Connector DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00225
Timestamp: 2026-10-08T05:03:47Z
Severity: Low
Status: Escalated
Detection Source: Cloud Connector
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-APP-01
User Account: c.williams
Source IP: 194.89.62.216
Destination IP: 10.3.88.107
Origin Country: DE Germany

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

05:03:47 Event ingested by SOC365 Engine

05:03:52 EmilyAI triage started — correlation enrichment

05:03:57 EmilyAI confidence: 91% — escalated to human analyst

05:04:12 Alert assigned to analyst: EmilyAI (auto)

05:05:46 Investigation started — querying SIEM and threat intelligence

05:07:58 Containment action taken — endpoint isolated

05:16:16 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00226	1h ago	Port Scan Detected	Informational	Resolved	SRV-APP-01
ALR-00013	8h ago	Data Exfiltration Attempt	Medium	Resolved	WS-PC-004
ALR-00038	12h ago	Malware Signature Match	Critical	Investigating	SRV-APP-01
ALR-00023	13h ago	Data Exfiltration Attempt	Low	Open	WS-PC-002
ALR-00390	13h ago	Insider Threat Indicator	Low	Escalated	SRV-APP-01