Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:00:16 UTC

Data Exfiltration Attempt

High Investigating
ALR-00315 · 2026-10-08T06:27:00Z

Description

Large data transfer (2.3GB) to cloud storage from SRV-FILE-01 by user 'n.clark'. DLP Module DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID
ALR-00315
Timestamp
2026-10-08T06:27:00Z
Severity
High
Status
Investigating
Detection Source
DLP Module
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-FILE-01
User Account
n.clark
Source IP
45.19.148.132
Destination IP
10.2.144.126
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567.002
Reference
attack.mitre.org/techniques/T1567.002

Investigation Timeline

06:27:00 Event ingested by SOC365 Engine
06:27:05 EmilyAI triage started — correlation enrichment
06:27:07 EmilyAI confidence: 78% — escalated to human analyst
06:27:38 Alert assigned to analyst: James Okonkwo
06:28:28 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00010 13m ago Certificate Anomaly Medium Escalated SRV-FILE-01
ALR-00162 8h ago Data Exfiltration Attempt Low Resolved SRV-FILE-01
ALR-00364 10h ago DLP Policy Violation Informational Investigating SRV-FILE-01
ALR-00290 12h ago Data Exfiltration Attempt Informational Investigating SRV-APP-01
ALR-00057 18h ago Data Exfiltration Attempt Low False Positive AP-WIFI-03