Insider Threat Indicator
Low
Escalated
ALR-00419 · 2026-07-11T16:50:04Z
Description
Anomalous after-hours access by 'k.brown' on WS-PC-002. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Attack Surface Scanner.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
16:50:04
Event ingested by SOC365 Engine
16:50:06
EmilyAI triage started — correlation enrichment
16:50:15
EmilyAI confidence: 90% — escalated to human analyst
16:50:37
Alert assigned to analyst: EmilyAI (auto)
16:52:08
Investigation started — querying SIEM and threat intelligence
16:54:29
Containment action taken — endpoint isolated
17:00:08
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00125 | 2h ago | Privilege Escalation Attempt | High | Open | WS-PC-002 |
| ALR-00381 | 3h ago | Pass-the-Hash Detected | Informational | Open | WS-PC-002 |
| ALR-00253 | 8h ago | Shadow IT Discovery | Low | False Positive | WS-PC-002 |
| ALR-00010 | 13h ago | Insider Threat Indicator | Medium | False Positive | FW-EDGE-01 |
| ALR-00282 | 23h ago | Credential Stuffing Attempt | Low | Investigating | WS-PC-002 |