Failed MFA Challenge
Low
Resolved
ALR-00275 · 2026-05-26T00:14:49Z
Description
Multiple failed MFA challenges for user 'p.thomas' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. DecoyPulse locked account.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:14:49
Event ingested by SOC365 Engine
00:14:52
EmilyAI triage started — correlation enrichment
00:15:00
EmilyAI confidence: 90% — escalated to human analyst
00:15:20
Alert assigned to analyst: EmilyAI (auto)
00:16:18
Investigation started — querying SIEM and threat intelligence
00:21:50
Containment action taken — endpoint isolated
00:32:34
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00383 | 6h ago | Unauthorised USB Device | Medium | Investigating | WS-PC-003 |
| ALR-00019 | 12h ago | DLP Policy Violation | Low | Resolved | WS-PC-003 |
| ALR-00455 | 1d ago | Malware Signature Match | Informational | Investigating | WS-PC-003 |
| ALR-00036 | 1d ago | Failed MFA Challenge | Low | Resolved | SRV-BACKUP-01 |
| ALR-00107 | 1d ago | Insider Threat Indicator | Low | False Positive | WS-PC-003 |