Insider Threat Indicator

Low False Positive

ALR-00411 · 2026-07-07T01:26:55Z

Description

Anomalous after-hours access by 'h.roberts' on FW-EDGE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.

Alert Metadata

Alert ID: ALR-00411
Timestamp: 2026-07-07T01:26:55Z
Severity: Low
Status: False Positive
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: FW-EDGE-01
User Account: h.roberts
Source IP: 91.4.195.79
Destination IP: 10.2.151.223
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Collection
Technique: T1119
Reference: attack.mitre.org/techniques/T1119

Investigation Timeline

01:26:55 Event ingested by SOC365 Engine

01:27:00 EmilyAI triage started — correlation enrichment

01:27:02 EmilyAI confidence: 84% — escalated to human analyst

01:27:11 Alert assigned to analyst: EmilyAI (auto)

01:28:53 Investigation started — querying SIEM and threat intelligence

01:31:13 Containment action taken — endpoint isolated

01:41:35 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00063	1h ago	Shadow IT Discovery	Medium	Open	FW-EDGE-01
ALR-00457	3h ago	Unusual Outbound Traffic	High	Investigating	FW-EDGE-01
ALR-00146	6h ago	Unauthorised USB Device	Informational	Resolved	FW-EDGE-01
ALR-00354	6h ago	Insider Threat Indicator	Informational	Investigating	SRV-FILE-01
ALR-00175	10h ago	Insider Threat Indicator	Informational	Open	SRV-DC-01