Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:56:51 UTC

DLP Policy Violation

Medium False Positive
ALR-00283 · 2026-10-11T07:48:41Z

Description

DLP policy violation: user 'p.thomas' attempted to email 3 files classified as 'Confidential' to external address from SRV-FILE-01.

Alert Metadata

Alert ID
ALR-00283
Timestamp
2026-10-11T07:48:41Z
Severity
Medium
Status
False Positive
Detection Source
Endpoint Agent
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
SRV-FILE-01
User Account
p.thomas
Source IP
103.222.216.78
Destination IP
10.3.180.54
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1048
Reference
attack.mitre.org/techniques/T1048

Investigation Timeline

07:48:41 Event ingested by SOC365 Engine
07:48:46 EmilyAI triage started — correlation enrichment
07:48:55 EmilyAI confidence: 94% — escalated to human analyst
07:49:17 Alert assigned to analyst: Anika Patel
07:49:26 Investigation started — querying SIEM and threat intelligence
07:52:57 Containment action taken — endpoint isolated
08:05:40 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00449 1h ago DecoyPulse Honeypot Triggered Informational Resolved SRV-FILE-01
ALR-00221 3h ago Ransomware Behaviour Detected Informational Escalated SRV-FILE-01
ALR-00382 15h ago Insider Threat Indicator Medium Investigating SRV-FILE-01
ALR-00388 15h ago Phishing Email Blocked Medium Investigating SRV-FILE-01
ALR-00215 20h ago DLP Policy Violation Low Resolved FW-EDGE-01