Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:45:43 UTC

Unauthorised USB Device

Informational Escalated
ALR-00403 · 2026-10-07T04:44:36Z

Description

Unauthorised USB mass storage device connected to FW-EDGE-01 by user 'j.smith'. Device blocked by Network IDS endpoint policy.

Alert Metadata

Alert ID
ALR-00403
Timestamp
2026-10-07T04:44:36Z
Severity
Informational
Status
Escalated
Detection Source
Network IDS
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
FW-EDGE-01
User Account
j.smith
Source IP
91.29.195.63
Destination IP
10.1.175.204
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Initial Access
Technique
T1091
Reference
attack.mitre.org/techniques/T1091

Investigation Timeline

04:44:36 Event ingested by SOC365 Engine
04:44:41 EmilyAI triage started — correlation enrichment
04:44:46 EmilyAI confidence: 98% — escalated to human analyst
04:45:04 Alert assigned to analyst: EmilyAI (auto)
04:46:26 Investigation started — querying SIEM and threat intelligence
04:54:08 Containment action taken — endpoint isolated
05:03:15 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00009 3h ago Unauthorised USB Device Medium Investigating SRV-WEB-01
ALR-00248 5h ago Unauthorised USB Device Medium Open SRV-BACKUP-01
ALR-00399 7h ago Unauthorised USB Device Informational Escalated WS-PC-004
ALR-00134 11h ago Unusual Outbound Traffic Low Resolved FW-EDGE-01
ALR-00185 14h ago Anomalous DNS Query Medium False Positive FW-EDGE-01