Insider Threat Indicator
Low
Open
ALR-00368 · 2026-07-08T06:51:23Z
Description
Anomalous after-hours access by 'f.hall' on SRV-SQL-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Endpoint Agent.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
06:51:23
Event ingested by SOC365 Engine
06:51:28
EmilyAI triage started — correlation enrichment
06:51:29
EmilyAI confidence: 79% — escalated to human analyst
06:52:03
Alert assigned to analyst: EmilyAI (auto)
06:54:12
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00074 | 1h ago | Brute Force SSH | Medium | Escalated | SRV-SQL-01 |
| ALR-00103 | 4h ago | Insider Threat Indicator | Medium | Open | FW-EDGE-01 |
| ALR-00336 | 4h ago | Credential Stuffing Attempt | Informational | Resolved | SRV-SQL-01 |
| ALR-00402 | 6h ago | Insider Threat Indicator | Medium | Investigating | SRV-MAIL-01 |
| ALR-00269 | 12h ago | Unauthorised USB Device | Low | Escalated | SRV-SQL-01 |