Brute Force SSH

Low Escalated

ALR-00278 · 2026-10-07T21:10:15Z

Description

Multiple failed SSH login attempts detected on WS-PC-002 from external IP. Attack Surface Scanner flagged 47 attempts in 5 minutes targeting user 'p.thomas'.

Alert Metadata

Alert ID: ALR-00278
Timestamp: 2026-10-07T21:10:15Z
Severity: Low
Status: Escalated
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-PC-002
User Account: p.thomas
Source IP: 194.124.62.57
Destination IP: 10.0.153.179
Origin Country: NG Nigeria

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

21:10:15 Event ingested by SOC365 Engine

21:10:17 EmilyAI triage started — correlation enrichment

21:10:21 EmilyAI confidence: 84% — escalated to human analyst

21:10:45 Alert assigned to analyst: EmilyAI (auto)

21:11:19 Investigation started — querying SIEM and threat intelligence

21:16:26 Containment action taken — endpoint isolated

21:29:08 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00255	4h ago	Data Exfiltration Attempt	Informational	Escalated	WS-PC-002
ALR-00297	4h ago	Brute Force SSH	Low	False Positive	SRV-SQL-01
ALR-00477	7h ago	Rogue DHCP Server	Informational	Open	WS-PC-002
ALR-00466	10h ago	Unauthorised USB Device	Low	Investigating	WS-PC-002
ALR-00430	12h ago	DecoyPulse Honeypot Triggered	Informational	Investigating	WS-PC-002