Insider Threat Indicator
Medium
Resolved
ALR-00421 · 2026-07-05T12:00:36Z
Description
Anomalous after-hours access by 'h.roberts' on SRV-FILE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Firewall.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
12:00:36
Event ingested by SOC365 Engine
12:00:40
EmilyAI triage started — correlation enrichment
12:00:48
EmilyAI confidence: 98% — escalated to human analyst
12:01:04
Alert assigned to analyst: Marcus Webb
12:02:42
Investigation started — querying SIEM and threat intelligence
12:07:03
Containment action taken — endpoint isolated
12:13:59
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00132 | 15h ago | Insider Threat Indicator | Low | Investigating | SRV-DC-01 |
| ALR-00165 | 15h ago | C2 Beacon Activity | Informational | Escalated | SRV-FILE-01 |
| ALR-00431 | 16h ago | Suspicious PowerShell Execution | Medium | Resolved | SRV-FILE-01 |
| ALR-00337 | 18h ago | Unauthorised USB Device | Low | Escalated | SRV-FILE-01 |
| ALR-00321 | 21h ago | Tor Exit Node Connection | Informational | Investigating | SRV-FILE-01 |