Data Exfiltration Attempt
Medium
Escalated
ALR-00339 · 2026-07-05T08:04:33Z
Description
Large data transfer (2.3GB) to cloud storage from SRV-SQL-01 by user 'p.thomas'. Email Gateway DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:04:33
Event ingested by SOC365 Engine
08:04:34
EmilyAI triage started — correlation enrichment
08:04:47
EmilyAI confidence: 97% — escalated to human analyst
08:04:53
Alert assigned to analyst: Marcus Webb
08:06:25
Investigation started — querying SIEM and threat intelligence
08:11:22
Containment action taken — endpoint isolated
08:23:15
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00006 | 1h ago | Data Exfiltration Attempt | Medium | Resolved | WS-LAP-010 |
| ALR-00042 | 3h ago | Data Exfiltration Attempt | Informational | Escalated | WS-PC-002 |
| ALR-00271 | 6h ago | Data Exfiltration Attempt | Medium | Investigating | WS-PC-003 |
| ALR-00286 | 8h ago | Insider Threat Indicator | Informational | Resolved | SRV-SQL-01 |
| ALR-00206 | 13h ago | Shadow IT Discovery | Informational | Escalated | SRV-SQL-01 |