Phishing Email Blocked

Medium Resolved

ALR-00287 · 2026-05-25T20:29:49Z

Description

Phishing email targeting 'k.brown@company.co.uk' blocked by Attack Surface Scanner. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID: ALR-00287
Timestamp: 2026-05-25T20:29:49Z
Severity: Medium
Status: Resolved
Detection Source: Attack Surface Scanner
Assigned Analyst: Marcus Webb

Endpoint Information

Hostname: SW-CORE-01
User Account: k.brown
Source IP: 185.233.220.57
Destination IP: 10.2.84.174
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Initial Access
Technique: T1566.001
Reference: attack.mitre.org/techniques/T1566.001

Investigation Timeline

20:29:49 Event ingested by SOC365 Engine

20:29:52 EmilyAI triage started — correlation enrichment

20:29:56 EmilyAI confidence: 91% — escalated to human analyst

20:30:34 Alert assigned to analyst: Marcus Webb

20:31:15 Investigation started — querying SIEM and threat intelligence

20:34:27 Containment action taken — endpoint isolated

20:44:40 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00375	2h ago	Phishing Email Blocked	Low	Open	SRV-MAIL-01
ALR-00371	5h ago	Rogue DHCP Server	Low	False Positive	SW-CORE-01
ALR-00117	7h ago	Lateral Movement Detected	Medium	Investigating	SW-CORE-01
ALR-00379	20h ago	Tor Exit Node Connection	Informational	False Positive	SW-CORE-01
ALR-00435	1d ago	Credential Stuffing Attempt	Medium	False Positive	SW-CORE-01