Insider Threat Indicator

Low Resolved

ALR-00257 · 2026-07-10T21:52:20Z

Description

Anomalous after-hours access by 'd.walker' on WS-MAC-005. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.

Alert Metadata

Alert ID: ALR-00257
Timestamp: 2026-07-10T21:52:20Z
Severity: Low
Status: Resolved
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-MAC-005
User Account: d.walker
Source IP: 194.110.62.78
Destination IP: 10.2.139.128
Origin Country: IN India

MITRE ATT&CK Mapping

Tactic: Collection
Technique: T1119
Reference: attack.mitre.org/techniques/T1119

Investigation Timeline

21:52:20 Event ingested by SOC365 Engine

21:52:25 EmilyAI triage started — correlation enrichment

21:52:26 EmilyAI confidence: 86% — escalated to human analyst

21:52:59 Alert assigned to analyst: EmilyAI (auto)

21:55:12 Investigation started — querying SIEM and threat intelligence

21:55:30 Containment action taken — endpoint isolated

22:05:05 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00289	6h ago	Tor Exit Node Connection	High	Investigating	WS-MAC-005
ALR-00404	8h ago	Anomalous DNS Query	Low	False Positive	WS-MAC-005
ALR-00336	9h ago	Anomalous DNS Query	Medium	Escalated	WS-MAC-005
ALR-00126	10h ago	Brute Force SSH	High	Investigating	WS-MAC-005
ALR-00132	15h ago	Insider Threat Indicator	Low	Investigating	SRV-DC-01