Failed MFA Challenge
High
Investigating
ALR-00326 · 2026-07-09T13:17:12Z
Description
Multiple failed MFA challenges for user 'l.johnson' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Firewall locked account.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
13:17:12
Event ingested by SOC365 Engine
13:17:13
EmilyAI triage started — correlation enrichment
13:17:24
EmilyAI confidence: 93% — escalated to human analyst
13:17:27
Alert assigned to analyst: Marcus Webb
13:18:38
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00070 | 3h ago | Privilege Escalation Attempt | Medium | Open | WS-PC-002 |
| ALR-00447 | 7h ago | Credential Stuffing Attempt | Critical | Investigating | WS-PC-002 |
| ALR-00412 | 7h ago | Failed MFA Challenge | Medium | Investigating | WS-LAP-011 |
| ALR-00299 | 12h ago | Failed MFA Challenge | Medium | Escalated | AP-WIFI-03 |
| ALR-00448 | 15h ago | Unusual Outbound Traffic | Medium | Resolved | WS-PC-002 |