Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:49:20 UTC

Credential Stuffing Attempt

Low Open
ALR-00369 · 2026-10-11T16:58:57Z

Description

Credential stuffing attack detected against VPN gateway. 234 unique username/password combinations attempted. Flagged by Dark Web Monitor.

Alert Metadata

Alert ID
ALR-00369
Timestamp
2026-10-11T16:58:57Z
Severity
Low
Status
Open
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-DC-01
User Account
c.williams
Source IP
185.163.220.186
Destination IP
10.3.17.125
Origin Country
GB United Kingdom

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.004
Reference
attack.mitre.org/techniques/T1110.004

Investigation Timeline

16:58:57 Event ingested by SOC365 Engine
16:59:00 EmilyAI triage started — correlation enrichment
16:59:03 EmilyAI confidence: 94% — escalated to human analyst
16:59:21 Alert assigned to analyst: EmilyAI (auto)
17:00:44 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00066 59m ago Credential Stuffing Attempt Medium Investigating SRV-DC-01
ALR-00180 10h ago Credential Stuffing Attempt Medium Escalated AP-WIFI-03
ALR-00020 16h ago Credential Stuffing Attempt Low False Positive VM-DEV-01
ALR-00146 23h ago Credential Stuffing Attempt Medium Escalated WS-PC-001
ALR-00458 1d ago Credential Stuffing Attempt Low Open SRV-FILE-01