Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 20:41:34 UTC

Failed MFA Challenge

Informational Open
ALR-00328 · 2026-07-10T20:35:32Z

Description

Multiple failed MFA challenges for user 's.jones' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. SOC365 Engine locked account.

Alert Metadata

Alert ID
ALR-00328
Timestamp
2026-07-10T20:35:32Z
Severity
Informational
Status
Open
Detection Source
SOC365 Engine
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-DC-01
User Account
s.jones
Source IP
91.13.195.87
Destination IP
10.1.130.87
Origin Country
FR France

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1621
Reference
attack.mitre.org/techniques/T1621

Investigation Timeline

20:35:32 Event ingested by SOC365 Engine
20:35:35 EmilyAI triage started — correlation enrichment
20:35:37 EmilyAI confidence: 95% — escalated to human analyst
20:36:12 Alert assigned to analyst: EmilyAI (auto)
20:37:11 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00255 1h ago DLP Policy Violation Informational Investigating SRV-DC-01
ALR-00422 2h ago Shadow IT Discovery Medium Open SRV-DC-01
ALR-00176 2h ago Port Scan Detected Low Open SRV-DC-01
ALR-00130 9h ago Phishing Email Blocked Low Open SRV-DC-01
ALR-00431 12h ago Failed MFA Challenge Informational Investigating VM-DEV-01