Lateral Movement Detected
Informational
Escalated
ALR-00379 · 2026-07-07T03:01:02Z
Description
Dark Web Monitor detected lateral movement from SRV-APP-01 to SRV-DC-01 using user 's.jones' credentials. SMB admin shares accessed.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
03:01:02
Event ingested by SOC365 Engine
03:01:04
EmilyAI triage started — correlation enrichment
03:01:16
EmilyAI confidence: 79% — escalated to human analyst
03:01:26
Alert assigned to analyst: EmilyAI (auto)
03:04:00
Investigation started — querying SIEM and threat intelligence
03:08:55
Containment action taken — endpoint isolated
03:19:33
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00284 | 6h ago | Lateral Movement Detected | Medium | False Positive | SRV-APP-01 |
| ALR-00273 | 9h ago | Anomalous DNS Query | Medium | False Positive | SRV-APP-01 |
| ALR-00399 | 11h ago | C2 Beacon Activity | High | Open | SRV-APP-01 |
| ALR-00021 | 11h ago | Lateral Movement Detected | Medium | Investigating | WS-PC-003 |
| ALR-00423 | 12h ago | Brute Force SSH | Informational | False Positive | SRV-APP-01 |