Data Exfiltration Attempt

Medium Escalated

ALR-00250 · 2026-10-05T09:33:47Z

Description

Large data transfer (2.3GB) to cloud storage from WS-LAP-011 by user 'c.williams'. Cloud Connector DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00250
Timestamp: 2026-10-05T09:33:47Z
Severity: Medium
Status: Escalated
Detection Source: Cloud Connector
Assigned Analyst: Sarah Chen

Endpoint Information

Hostname: WS-LAP-011
User Account: c.williams
Source IP: 194.80.62.252
Destination IP: 10.1.17.83
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

09:33:47 Event ingested by SOC365 Engine

09:33:51 EmilyAI triage started — correlation enrichment

09:34:02 EmilyAI confidence: 92% — escalated to human analyst

09:34:05 Alert assigned to analyst: Sarah Chen

09:35:36 Investigation started — querying SIEM and threat intelligence

09:40:20 Containment action taken — endpoint isolated

09:48:56 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00478	3h ago	Failed MFA Challenge	Medium	Escalated	WS-LAP-011
ALR-00068	3h ago	Suspicious Scheduled Task	Low	Resolved	WS-LAP-011
ALR-00298	6h ago	Data Exfiltration Attempt	Low	Investigating	VM-DEV-01
ALR-00346	12h ago	Unusual Outbound Traffic	Low	False Positive	WS-LAP-011
ALR-00112	15h ago	Phishing Email Blocked	High	Open	WS-LAP-011