Brute Force SSH
Informational
Escalated
ALR-00316 · 2026-07-09T19:55:30Z
Description
Multiple failed SSH login attempts detected on VM-DEV-01 from external IP. Dark Web Monitor flagged 47 attempts in 5 minutes targeting user 'd.walker'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:55:30
Event ingested by SOC365 Engine
19:55:31
EmilyAI triage started — correlation enrichment
19:55:45
EmilyAI confidence: 85% — escalated to human analyst
19:56:09
Alert assigned to analyst: EmilyAI (auto)
19:57:20
Investigation started — querying SIEM and threat intelligence
20:04:37
Containment action taken — endpoint isolated
20:12:47
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00129 | 4h ago | Lateral Movement Detected | Low | Escalated | VM-DEV-01 |
| ALR-00138 | 10h ago | Brute Force SSH | Informational | Open | WS-PC-002 |
| ALR-00314 | 12h ago | Brute Force SSH | Low | False Positive | SW-CORE-01 |
| ALR-00109 | 19h ago | Brute Force SSH | Low | Escalated | WS-PC-003 |
| ALR-00261 | 20h ago | Shadow IT Discovery | Medium | Resolved | VM-DEV-01 |