Insider Threat Indicator
Low
False Positive
ALR-00411 · 2026-07-07T01:26:55Z
Description
Anomalous after-hours access by 'h.roberts' on FW-EDGE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
01:26:55
Event ingested by SOC365 Engine
01:27:00
EmilyAI triage started — correlation enrichment
01:27:02
EmilyAI confidence: 84% — escalated to human analyst
01:27:11
Alert assigned to analyst: EmilyAI (auto)
01:28:53
Investigation started — querying SIEM and threat intelligence
01:31:13
Containment action taken — endpoint isolated
01:41:35
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00063 | 1h ago | Shadow IT Discovery | Medium | Open | FW-EDGE-01 |
| ALR-00457 | 3h ago | Unusual Outbound Traffic | High | Investigating | FW-EDGE-01 |
| ALR-00146 | 6h ago | Unauthorised USB Device | Informational | Resolved | FW-EDGE-01 |
| ALR-00354 | 6h ago | Insider Threat Indicator | Informational | Investigating | SRV-FILE-01 |
| ALR-00175 | 10h ago | Insider Threat Indicator | Informational | Open | SRV-DC-01 |