Data Exfiltration Attempt
Low
False Positive
ALR-00372 · 2026-07-11T08:16:06Z
Description
Large data transfer (2.3GB) to cloud storage from WS-LAP-011 by user 'r.davies'. DecoyPulse DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:16:06
Event ingested by SOC365 Engine
08:16:08
EmilyAI triage started — correlation enrichment
08:16:18
EmilyAI confidence: 89% — escalated to human analyst
08:16:50
Alert assigned to analyst: EmilyAI (auto)
08:17:36
Investigation started — querying SIEM and threat intelligence
08:23:30
Containment action taken — endpoint isolated
08:34:30
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00101 | 50m ago | Suspicious Scheduled Task | Medium | False Positive | WS-LAP-011 |
| ALR-00124 | 1h ago | Brute Force SSH | Informational | False Positive | WS-LAP-011 |
| ALR-00433 | 1h ago | Data Exfiltration Attempt | Low | Resolved | VM-DEV-01 |
| ALR-00122 | 4h ago | Data Exfiltration Attempt | Low | False Positive | WS-PC-001 |
| ALR-00412 | 7h ago | Failed MFA Challenge | Medium | Investigating | WS-LAP-011 |