Failed MFA Challenge

Medium Escalated

ALR-00310 · 2026-10-06T15:46:05Z

Description

Multiple failed MFA challenges for user 'l.johnson' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Endpoint Agent locked account.

Alert Metadata

Alert ID: ALR-00310
Timestamp: 2026-10-06T15:46:05Z
Severity: Medium
Status: Escalated
Detection Source: Endpoint Agent
Assigned Analyst: Marcus Webb

Endpoint Information

Hostname: WS-PC-001
User Account: l.johnson
Source IP: 45.124.148.71
Destination IP: 10.0.41.170
Origin Country: FR France

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

15:46:05 Event ingested by SOC365 Engine

15:46:10 EmilyAI triage started — correlation enrichment

15:46:18 EmilyAI confidence: 84% — escalated to human analyst

15:46:24 Alert assigned to analyst: Marcus Webb

15:48:01 Investigation started — querying SIEM and threat intelligence

15:53:02 Containment action taken — endpoint isolated

16:05:50 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00040	5h ago	DLP Policy Violation	Informational	False Positive	WS-PC-001
ALR-00272	9h ago	Anomalous DNS Query	Low	Open	WS-PC-001
ALR-00034	10h ago	Failed MFA Challenge	Informational	False Positive	WS-PC-004
ALR-00333	12h ago	Privilege Escalation Attempt	Low	Resolved	WS-PC-001
ALR-00059	12h ago	Privilege Escalation Attempt	Low	Escalated	WS-PC-001