Phishing Email Blocked

Medium Open

ALR-00306 · 2026-05-23T22:39:58Z

Description

Phishing email targeting 'd.walker@company.co.uk' blocked by Attack Surface Scanner. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID: ALR-00306
Timestamp: 2026-05-23T22:39:58Z
Severity: Medium
Status: Open
Detection Source: Attack Surface Scanner
Assigned Analyst: Anika Patel

Endpoint Information

Hostname: VM-DEV-01
User Account: d.walker
Source IP: 103.168.216.214
Destination IP: 10.3.48.32
Origin Country: RU Russia

MITRE ATT&CK Mapping

Tactic: Initial Access
Technique: T1566.001
Reference: attack.mitre.org/techniques/T1566.001

Investigation Timeline

22:39:58 Event ingested by SOC365 Engine

22:40:01 EmilyAI triage started — correlation enrichment

22:40:13 EmilyAI confidence: 87% — escalated to human analyst

22:40:26 Alert assigned to analyst: Anika Patel

22:41:58 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00127	7m ago	Phishing Email Blocked	Critical	Open	WS-PC-006
ALR-00196	1h ago	Phishing Email Blocked	Medium	Investigating	SRV-DC-01
ALR-00244	3h ago	Phishing Email Blocked	Medium	Escalated	SRV-MAIL-01
ALR-00278	8h ago	Phishing Email Blocked	Medium	Escalated	SRV-MAIL-01
ALR-00344	11h ago	Phishing Email Blocked	Informational	Resolved	WS-LAP-012