Brute Force SSH

Low Escalated

ALR-00345 · 2026-07-10T21:03:18Z

Description

Multiple failed SSH login attempts detected on SRV-WEB-01 from external IP. Email Gateway flagged 47 attempts in 5 minutes targeting user 'l.johnson'.

Alert Metadata

Alert ID: ALR-00345
Timestamp: 2026-07-10T21:03:18Z
Severity: Low
Status: Escalated
Detection Source: Email Gateway
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-WEB-01
User Account: l.johnson
Source IP: 185.149.220.131
Destination IP: 10.1.121.129
Origin Country: GB United Kingdom

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

21:03:18 Event ingested by SOC365 Engine

21:03:22 EmilyAI triage started — correlation enrichment

21:03:23 EmilyAI confidence: 82% — escalated to human analyst

21:03:51 Alert assigned to analyst: EmilyAI (auto)

21:04:18 Investigation started — querying SIEM and threat intelligence

21:11:43 Containment action taken — endpoint isolated

21:18:21 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00294	27m ago	Brute Force SSH	Low	Open	AP-WIFI-03
ALR-00307	3h ago	Brute Force SSH	Low	Investigating	SRV-MAIL-01
ALR-00090	14h ago	Privilege Escalation Attempt	High	Investigating	SRV-WEB-01
ALR-00259	21h ago	Unauthorised USB Device	High	Open	SRV-WEB-01
ALR-00237	1d ago	Brute Force SSH	Low	Open	WS-PC-003