Insider Threat Indicator
Low
Resolved
ALR-00257 · 2026-07-10T21:52:20Z
Description
Anomalous after-hours access by 'd.walker' on WS-MAC-005. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
21:52:20
Event ingested by SOC365 Engine
21:52:25
EmilyAI triage started — correlation enrichment
21:52:26
EmilyAI confidence: 86% — escalated to human analyst
21:52:59
Alert assigned to analyst: EmilyAI (auto)
21:55:12
Investigation started — querying SIEM and threat intelligence
21:55:30
Containment action taken — endpoint isolated
22:05:05
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00289 | 6h ago | Tor Exit Node Connection | High | Investigating | WS-MAC-005 |
| ALR-00404 | 8h ago | Anomalous DNS Query | Low | False Positive | WS-MAC-005 |
| ALR-00336 | 9h ago | Anomalous DNS Query | Medium | Escalated | WS-MAC-005 |
| ALR-00126 | 10h ago | Brute Force SSH | High | Investigating | WS-MAC-005 |
| ALR-00132 | 15h ago | Insider Threat Indicator | Low | Investigating | SRV-DC-01 |