Phishing Email Blocked
High
Open
ALR-00417 · 2026-07-11T21:52:40Z
Description
Phishing email targeting 'h.roberts@company.co.uk' blocked by SOC365 Engine. Payload: credential harvesting link mimicking Microsoft 365 login.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
21:52:40
Event ingested by SOC365 Engine
21:52:43
EmilyAI triage started — correlation enrichment
21:52:51
EmilyAI confidence: 91% — escalated to human analyst
21:53:04
Alert assigned to analyst: Marcus Webb
21:54:00
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00215 | 4h ago | DecoyPulse Honeypot Triggered | Medium | Escalated | FW-EDGE-01 |
| ALR-00485 | 5h ago | Privilege Escalation Attempt | Informational | Escalated | FW-EDGE-01 |
| ALR-00486 | 11h ago | Anomalous DNS Query | Critical | Escalated | FW-EDGE-01 |
| ALR-00292 | 14h ago | Phishing Email Blocked | High | Investigating | SRV-APP-01 |
| ALR-00245 | 14h ago | Rogue DHCP Server | High | Investigating | FW-EDGE-01 |