Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 19:43:23 UTC

Brute Force SSH

Low Investigating
ALR-00288 · 2026-07-10T13:25:03Z

Description

Multiple failed SSH login attempts detected on SRV-FILE-01 from external IP. DLP Module flagged 47 attempts in 5 minutes targeting user 'l.johnson'.

Alert Metadata

Alert ID
ALR-00288
Timestamp
2026-07-10T13:25:03Z
Severity
Low
Status
Investigating
Detection Source
DLP Module
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-FILE-01
User Account
l.johnson
Source IP
45.86.148.122
Destination IP
10.3.118.76
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.001
Reference
attack.mitre.org/techniques/T1110.001

Investigation Timeline

13:25:03 Event ingested by SOC365 Engine
13:25:07 EmilyAI triage started — correlation enrichment
13:25:18 EmilyAI confidence: 95% — escalated to human analyst
13:25:29 Alert assigned to analyst: EmilyAI (auto)
13:26:28 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00203 51m ago Shadow IT Discovery Medium Resolved SRV-FILE-01
ALR-00161 2h ago Brute Force SSH High Escalated SRV-MAIL-01
ALR-00297 8h ago Insider Threat Indicator Informational Escalated SRV-FILE-01
ALR-00015 10h ago Brute Force SSH Medium Resolved WS-LAP-012
ALR-00345 13h ago Brute Force SSH High Investigating SRV-APP-01