Data Exfiltration Attempt
Low
False Positive
ALR-00294 · 2026-07-09T17:38:40Z
Description
Large data transfer (2.3GB) to cloud storage from WS-LAP-011 by user 'p.thomas'. Firewall DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:38:40
Event ingested by SOC365 Engine
17:38:44
EmilyAI triage started — correlation enrichment
17:38:51
EmilyAI confidence: 91% — escalated to human analyst
17:39:22
Alert assigned to analyst: EmilyAI (auto)
17:39:52
Investigation started — querying SIEM and threat intelligence
17:46:50
Containment action taken — endpoint isolated
17:55:08
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00371 | 11h ago | Unauthorised USB Device | Low | Open | WS-LAP-011 |
| ALR-00242 | 16h ago | Data Exfiltration Attempt | Informational | Investigating | SRV-MAIL-01 |
| ALR-00363 | 1d ago | C2 Beacon Activity | Low | Open | WS-LAP-011 |
| ALR-00215 | 1d ago | Data Exfiltration Attempt | Medium | False Positive | WS-PC-004 |
| ALR-00469 | 1d ago | Malware Signature Match | Medium | Escalated | WS-LAP-011 |