Data Exfiltration Attempt

Medium Resolved

ALR-00397 · 2026-10-09T01:23:12Z

Description

Large data transfer (2.3GB) to cloud storage from WS-LAP-011 by user 'm.taylor'. Dark Web Monitor DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID: ALR-00397
Timestamp: 2026-10-09T01:23:12Z
Severity: Medium
Status: Resolved
Detection Source: Dark Web Monitor
Assigned Analyst: Marcus Webb

Endpoint Information

Hostname: WS-LAP-011
User Account: m.taylor
Source IP: 103.24.216.100
Destination IP: 10.0.2.246
Origin Country: UA Ukraine

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567.002
Reference: attack.mitre.org/techniques/T1567.002

Investigation Timeline

01:23:12 Event ingested by SOC365 Engine

01:23:17 EmilyAI triage started — correlation enrichment

01:23:25 EmilyAI confidence: 86% — escalated to human analyst

01:23:40 Alert assigned to analyst: Marcus Webb

01:25:58 Investigation started — querying SIEM and threat intelligence

01:28:54 Containment action taken — endpoint isolated

01:34:39 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00102	5h ago	Data Exfiltration Attempt	Informational	Open	SRV-WEB-01
ALR-00369	11h ago	Credential Stuffing Attempt	Low	Escalated	WS-LAP-011
ALR-00355	13h ago	Failed MFA Challenge	Low	False Positive	WS-LAP-011
ALR-00367	15h ago	Tor Exit Node Connection	Low	Escalated	WS-LAP-011
ALR-00184	22h ago	Data Exfiltration Attempt	Medium	False Positive	WS-LAP-012