Phishing Email Blocked
Low
Escalated
ALR-00248 · 2026-07-05T11:36:26Z
Description
Phishing email targeting 'j.smith@company.co.uk' blocked by Dark Web Monitor. Payload: credential harvesting link mimicking Microsoft 365 login.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:36:26
Event ingested by SOC365 Engine
11:36:30
EmilyAI triage started — correlation enrichment
11:36:32
EmilyAI confidence: 88% — escalated to human analyst
11:37:10
Alert assigned to analyst: EmilyAI (auto)
11:38:08
Investigation started — querying SIEM and threat intelligence
11:45:48
Containment action taken — endpoint isolated
11:47:43
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00127 | 5h ago | Ransomware Behaviour Detected | Low | False Positive | WS-MAC-005 |
| ALR-00279 | 5h ago | Unusual Outbound Traffic | Informational | Resolved | WS-MAC-005 |
| ALR-00247 | 16h ago | Phishing Email Blocked | Low | Resolved | SRV-FILE-01 |
| ALR-00234 | 16h ago | Phishing Email Blocked | Medium | Investigating | SRV-WEB-01 |
| ALR-00293 | 22h ago | Phishing Email Blocked | Medium | False Positive | AP-WIFI-03 |