Brute Force SSH

Informational False Positive

ALR-00285 · 2026-10-11T21:58:45Z

Description

Multiple failed SSH login attempts detected on SRV-FILE-01 from external IP. EmilyAI Triage flagged 47 attempts in 5 minutes targeting user 'h.roberts'.

Alert Metadata

Alert ID: ALR-00285
Timestamp: 2026-10-11T21:58:45Z
Severity: Informational
Status: False Positive
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-FILE-01
User Account: h.roberts
Source IP: 91.184.195.121
Destination IP: 10.1.159.24
Origin Country: RU Russia

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

21:58:45 Event ingested by SOC365 Engine

21:58:50 EmilyAI triage started — correlation enrichment

21:59:00 EmilyAI confidence: 81% — escalated to human analyst

21:59:26 Alert assigned to analyst: EmilyAI (auto)

22:00:04 Investigation started — querying SIEM and threat intelligence

22:04:23 Containment action taken — endpoint isolated

22:09:06 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00176	45m ago	Brute Force SSH	Medium	Open	WS-LAP-012
ALR-00001	1h ago	Lateral Movement Detected	Low	Resolved	SRV-FILE-01
ALR-00247	3h ago	Brute Force SSH	Low	Open	WS-PC-006
ALR-00421	8h ago	Brute Force SSH	Medium	Investigating	WS-PC-001
ALR-00100	16h ago	Shadow IT Discovery	Critical	Investigating	SRV-FILE-01