Brute Force SSH

Medium Resolved

ALR-00326 · 2026-10-07T12:30:56Z

Description

Multiple failed SSH login attempts detected on SRV-SQL-01 from external IP. Cloud Connector flagged 47 attempts in 5 minutes targeting user 'a.wilson'.

Alert Metadata

Alert ID: ALR-00326
Timestamp: 2026-10-07T12:30:56Z
Severity: Medium
Status: Resolved
Detection Source: Cloud Connector
Assigned Analyst: Sarah Chen

Endpoint Information

Hostname: SRV-SQL-01
User Account: a.wilson
Source IP: 103.37.216.158
Destination IP: 10.1.61.68
Origin Country: GB United Kingdom

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

12:30:56 Event ingested by SOC365 Engine

12:31:01 EmilyAI triage started — correlation enrichment

12:31:06 EmilyAI confidence: 89% — escalated to human analyst

12:31:19 Alert assigned to analyst: Sarah Chen

12:33:54 Investigation started — querying SIEM and threat intelligence

12:38:06 Containment action taken — endpoint isolated

12:42:02 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00358	3h ago	Brute Force SSH	Low	Escalated	WS-LAP-010
ALR-00498	6h ago	Suspicious Scheduled Task	Informational	Resolved	SRV-SQL-01
ALR-00382	7h ago	Brute Force SSH	Medium	Resolved	WS-PC-003
ALR-00294	8h ago	Tor Exit Node Connection	Medium	Resolved	SRV-SQL-01
ALR-00181	19h ago	Brute Force SSH	Low	Open	FW-EDGE-01