Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:40:33 UTC

Failed MFA Challenge

Informational Resolved
ALR-00296 · 2026-10-12T04:37:50Z

Description

Multiple failed MFA challenges for user 'a.wilson' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Endpoint Agent locked account.

Alert Metadata

Alert ID
ALR-00296
Timestamp
2026-10-12T04:37:50Z
Severity
Informational
Status
Resolved
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-012
User Account
a.wilson
Source IP
91.91.195.124
Destination IP
10.3.157.148
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1621
Reference
attack.mitre.org/techniques/T1621

Investigation Timeline

04:37:50 Event ingested by SOC365 Engine
04:37:55 EmilyAI triage started — correlation enrichment
04:38:01 EmilyAI confidence: 93% — escalated to human analyst
04:38:13 Alert assigned to analyst: EmilyAI (auto)
04:40:35 Investigation started — querying SIEM and threat intelligence
04:46:31 Containment action taken — endpoint isolated
04:47:51 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00282 33m ago Failed MFA Challenge Informational False Positive SRV-FILE-01
ALR-00037 5h ago Failed MFA Challenge Informational Escalated WS-PC-006
ALR-00445 7h ago DecoyPulse Honeypot Triggered Medium Open WS-LAP-012
ALR-00155 9h ago Lateral Movement Detected Medium Open WS-LAP-012
ALR-00424 10h ago Rogue DHCP Server Medium Open WS-LAP-012