Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:39 UTC

Shadow IT Discovery

Informational False Positive
ALR-00284 · 2026-10-10T11:38:47Z

Description

EmilyAI Triage discovered unauthorised SaaS application (file sharing) used by 'k.brown'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID
ALR-00284
Timestamp
2026-10-10T11:38:47Z
Severity
Informational
Status
False Positive
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-011
User Account
k.brown
Source IP
45.47.148.10
Destination IP
10.0.160.233
Origin Country
RO Romania

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567
Reference
attack.mitre.org/techniques/T1567

Investigation Timeline

11:38:47 Event ingested by SOC365 Engine
11:38:50 EmilyAI triage started — correlation enrichment
11:39:01 EmilyAI confidence: 94% — escalated to human analyst
11:39:30 Alert assigned to analyst: EmilyAI (auto)
11:41:28 Investigation started — querying SIEM and threat intelligence
11:45:00 Containment action taken — endpoint isolated
11:58:06 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00335 11h ago Shadow IT Discovery Medium Investigating SRV-MAIL-01
ALR-00338 11h ago Anomalous DNS Query High Investigating WS-LAP-011
ALR-00400 15h ago Shadow IT Discovery Medium Investigating WS-PC-006
ALR-00409 16h ago Unauthorised USB Device Medium Investigating WS-LAP-011
ALR-00178 1d ago Shadow IT Discovery Medium Open SW-CORE-01