Port Scan Detected
Medium
False Positive
ALR-00357 · 2026-07-08T02:47:45Z
Description
Sequential port scan (1-1024) detected targeting WS-LAP-012 from external IP. Firewall identified SYN scan pattern.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
02:47:45
Event ingested by SOC365 Engine
02:47:47
EmilyAI triage started — correlation enrichment
02:47:57
EmilyAI confidence: 82% — escalated to human analyst
02:48:25
Alert assigned to analyst: Marcus Webb
02:49:07
Investigation started — querying SIEM and threat intelligence
02:55:13
Containment action taken — endpoint isolated
02:59:25
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00358 | 1h ago | Failed MFA Challenge | Informational | Escalated | WS-LAP-012 |
| ALR-00386 | 3h ago | Suspicious PowerShell Execution | Medium | Escalated | WS-LAP-012 |
| ALR-00393 | 5h ago | Port Scan Detected | Informational | Resolved | WS-LAP-010 |
| ALR-00067 | 15h ago | Port Scan Detected | Informational | Investigating | WS-LAP-010 |
| ALR-00383 | 16h ago | Certificate Anomaly | Low | Open | WS-LAP-012 |