Port Scan Detected
Medium
Resolved
ALR-00276 · 2026-05-21T23:48:23Z
Description
Sequential port scan (1-1024) detected targeting WS-LAP-010 from external IP. Email Gateway identified SYN scan pattern.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
23:48:23
Event ingested by SOC365 Engine
23:48:28
EmilyAI triage started — correlation enrichment
23:48:29
EmilyAI confidence: 97% — escalated to human analyst
23:49:01
Alert assigned to analyst: James Okonkwo
23:51:02
Investigation started — querying SIEM and threat intelligence
23:57:14
Containment action taken — endpoint isolated
00:06:53
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00039 | 4h ago | Tor Exit Node Connection | Low | Escalated | WS-LAP-010 |
| ALR-00391 | 6h ago | Port Scan Detected | Medium | False Positive | SRV-WEB-01 |
| ALR-00165 | 8h ago | Malware Signature Match | Low | False Positive | WS-LAP-010 |
| ALR-00227 | 9h ago | Port Scan Detected | Medium | Open | AP-WIFI-03 |
| ALR-00289 | 11h ago | Port Scan Detected | Low | False Positive | SRV-BACKUP-01 |