Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:41:29 UTC

Phishing Email Blocked

Informational Escalated
ALR-00324 · 2026-10-10T07:24:02Z

Description

Phishing email targeting 'a.wilson@company.co.uk' blocked by Network IDS. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID
ALR-00324
Timestamp
2026-10-10T07:24:02Z
Severity
Informational
Status
Escalated
Detection Source
Network IDS
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-MAC-005
User Account
a.wilson
Source IP
45.186.148.223
Destination IP
10.1.228.31
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Initial Access
Technique
T1566.001
Reference
attack.mitre.org/techniques/T1566.001

Investigation Timeline

07:24:02 Event ingested by SOC365 Engine
07:24:06 EmilyAI triage started — correlation enrichment
07:24:07 EmilyAI confidence: 91% — escalated to human analyst
07:24:27 Alert assigned to analyst: EmilyAI (auto)
07:26:10 Investigation started — querying SIEM and threat intelligence
07:31:42 Containment action taken — endpoint isolated
07:35:24 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00121 3h ago Credential Stuffing Attempt Informational Open WS-MAC-005
ALR-00141 5h ago Phishing Email Blocked Medium Investigating SRV-BACKUP-01
ALR-00437 6h ago Kerberoasting Attempt Low Investigating WS-MAC-005
ALR-00458 8h ago Anomalous DNS Query Low Escalated WS-MAC-005
ALR-00078 12h ago Phishing Email Blocked Medium Resolved VM-DEV-01