Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:48:24 UTC

Phishing Email Blocked

High Open
ALR-00419 · 2026-10-07T03:33:05Z

Description

Phishing email targeting 'k.brown@company.co.uk' blocked by Email Gateway. Payload: credential harvesting link mimicking Microsoft 365 login.

Alert Metadata

Alert ID
ALR-00419
Timestamp
2026-10-07T03:33:05Z
Severity
High
Status
Open
Detection Source
Email Gateway
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
WS-LAP-012
User Account
k.brown
Source IP
185.101.220.1
Destination IP
10.0.41.62
Origin Country
FR France

MITRE ATT&CK Mapping

Tactic
Initial Access
Technique
T1566.001
Reference
attack.mitre.org/techniques/T1566.001

Investigation Timeline

03:33:05 Event ingested by SOC365 Engine
03:33:06 EmilyAI triage started — correlation enrichment
03:33:20 EmilyAI confidence: 96% — escalated to human analyst
03:33:28 Alert assigned to analyst: James Okonkwo
03:35:38 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00085 1h ago Port Scan Detected Medium Resolved WS-LAP-012
ALR-00299 8h ago Malware Signature Match Medium False Positive WS-LAP-012
ALR-00014 12h ago Phishing Email Blocked Medium Investigating SRV-DC-01
ALR-00498 13h ago Data Exfiltration Attempt Low Resolved WS-LAP-012
ALR-00267 20h ago Credential Stuffing Attempt Informational Investigating WS-LAP-012