Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:46:19 UTC

Credential Stuffing Attempt

Medium Investigating
ALR-00322 · 2026-10-08T14:48:12Z

Description

Credential stuffing attack detected against VPN gateway. 234 unique username/password combinations attempted. Flagged by Email Gateway.

Alert Metadata

Alert ID
ALR-00322
Timestamp
2026-10-08T14:48:12Z
Severity
Medium
Status
Investigating
Detection Source
Email Gateway
Assigned Analyst
Emma Richardson

Endpoint Information

Hostname
SRV-WEB-01
User Account
s.jones
Source IP
91.123.195.42
Destination IP
10.2.209.3
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.004
Reference
attack.mitre.org/techniques/T1110.004

Investigation Timeline

14:48:12 Event ingested by SOC365 Engine
14:48:13 EmilyAI triage started — correlation enrichment
14:48:17 EmilyAI confidence: 97% — escalated to human analyst
14:48:49 Alert assigned to analyst: Emma Richardson
14:49:32 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00030 2h ago Credential Stuffing Attempt Medium False Positive WS-LAP-010
ALR-00104 3h ago Credential Stuffing Attempt Medium False Positive SRV-WEB-01
ALR-00018 9h ago DecoyPulse Honeypot Triggered High Open SRV-WEB-01
ALR-00020 10h ago Brute Force SSH Medium Escalated SRV-WEB-01
ALR-00400 17h ago Suspicious Scheduled Task High Investigating SRV-WEB-01