Data Exfiltration Attempt

Informational Resolved

ALR-00372 · 2026-10-10T02:41:44Z

Description

Large data transfer (2.3GB) to cloud storage from FW-EDGE-01 by user 'h.roberts'. Dark Web Monitor DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00372
Timestamp: 2026-10-10T02:41:44Z
Severity: Informational
Status: Resolved
Detection Source: Dark Web Monitor
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: FW-EDGE-01
User Account: h.roberts
Source IP: 45.150.148.152
Destination IP: 10.2.179.195
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

02:41:44 Event ingested by SOC365 Engine

02:41:45 EmilyAI triage started — correlation enrichment

02:41:51 EmilyAI confidence: 83% — escalated to human analyst

02:42:08 Alert assigned to analyst: EmilyAI (auto)

02:43:11 Investigation started — querying SIEM and threat intelligence

02:46:19 Containment action taken — endpoint isolated

02:52:37 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00440	3h ago	Data Exfiltration Attempt	High	Open	WS-PC-004
ALR-00405	6h ago	Data Exfiltration Attempt	Medium	False Positive	WS-LAP-011
ALR-00321	19h ago	C2 Beacon Activity	Medium	Resolved	FW-EDGE-01
ALR-00036	20h ago	Data Exfiltration Attempt	Low	False Positive	WS-PC-002
ALR-00144	1d ago	Suspicious PowerShell Execution	Medium	Investigating	FW-EDGE-01