Data Exfiltration Attempt
Low
Investigating
ALR-00372 · 2026-07-07T05:25:48Z
Description
Large data transfer (2.3GB) to cloud storage from VM-DEV-01 by user 'system'. EmilyAI Triage DLP policy triggered — sensitive documents detected.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
05:25:48
Event ingested by SOC365 Engine
05:25:52
EmilyAI triage started — correlation enrichment
05:25:57
EmilyAI confidence: 92% — escalated to human analyst
05:26:31
Alert assigned to analyst: EmilyAI (auto)
05:28:08
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00425 | 2h ago | Data Exfiltration Attempt | Informational | Resolved | WS-PC-001 |
| ALR-00424 | 6h ago | Data Exfiltration Attempt | Informational | Escalated | WS-PC-003 |
| ALR-00462 | 7h ago | Insider Threat Indicator | Medium | False Positive | VM-DEV-01 |
| ALR-00111 | 12h ago | Data Exfiltration Attempt | Medium | False Positive | WS-PC-001 |
| ALR-00410 | 13h ago | Rogue DHCP Server | Informational | Escalated | VM-DEV-01 |