Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:55:47 UTC

Insider Threat Indicator

High Escalated
ALR-00422 · 2026-10-10T07:23:26Z

Description

Anomalous after-hours access by 'k.brown' on SRV-WEB-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Firewall.

Alert Metadata

Alert ID
ALR-00422
Timestamp
2026-10-10T07:23:26Z
Severity
High
Status
Escalated
Detection Source
Firewall
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-WEB-01
User Account
k.brown
Source IP
103.19.216.76
Destination IP
10.0.174.208
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

07:23:26 Event ingested by SOC365 Engine
07:23:27 EmilyAI triage started — correlation enrichment
07:23:38 EmilyAI confidence: 80% — escalated to human analyst
07:24:04 Alert assigned to analyst: James Okonkwo
07:24:25 Investigation started — querying SIEM and threat intelligence
07:28:34 Containment action taken — endpoint isolated
07:40:20 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00222 1h ago Unauthorised USB Device Medium Open SRV-WEB-01
ALR-00467 11h ago Malware Signature Match Informational Escalated SRV-WEB-01
ALR-00258 12h ago Lateral Movement Detected Informational Resolved SRV-WEB-01
ALR-00296 20h ago DecoyPulse Honeypot Triggered Informational False Positive SRV-WEB-01
ALR-00299 23h ago Insider Threat Indicator High Investigating WS-PC-002