Insider Threat Indicator
Informational
Open
ALR-00243 · 2026-07-06T00:58:08Z
Description
Anomalous after-hours access by 'k.brown' on WS-PC-002. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Email Gateway.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:58:08
Event ingested by SOC365 Engine
00:58:13
EmilyAI triage started — correlation enrichment
00:58:21
EmilyAI confidence: 85% — escalated to human analyst
00:58:51
Alert assigned to analyst: EmilyAI (auto)
00:59:07
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00262 | 2m ago | Insider Threat Indicator | Low | Investigating | WS-PC-006 |
| ALR-00438 | 2h ago | Insider Threat Indicator | Medium | False Positive | AP-WIFI-03 |
| ALR-00297 | 8h ago | Insider Threat Indicator | Informational | Escalated | SRV-FILE-01 |
| ALR-00256 | 14h ago | DecoyPulse Honeypot Triggered | Informational | False Positive | WS-PC-002 |
| ALR-00005 | 14h ago | DecoyPulse Honeypot Triggered | Medium | False Positive | WS-PC-002 |