Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:51:06 UTC

Data Exfiltration Attempt

Low Open
ALR-00425 · 2026-10-07T11:29:35Z

Description

Large data transfer (2.3GB) to cloud storage from SRV-DC-01 by user 'a.wilson'. Endpoint Agent DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID
ALR-00425
Timestamp
2026-10-07T11:29:35Z
Severity
Low
Status
Open
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-DC-01
User Account
a.wilson
Source IP
45.61.148.131
Destination IP
10.0.37.69
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567.002
Reference
attack.mitre.org/techniques/T1567.002

Investigation Timeline

11:29:35 Event ingested by SOC365 Engine
11:29:38 EmilyAI triage started — correlation enrichment
11:29:48 EmilyAI confidence: 98% — escalated to human analyst
11:30:08 Alert assigned to analyst: EmilyAI (auto)
11:32:25 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00385 4h ago Data Exfiltration Attempt Informational Open WS-PC-001
ALR-00328 5h ago Lateral Movement Detected Low Open SRV-DC-01
ALR-00228 10h ago Data Exfiltration Attempt Informational Resolved SRV-APP-01
ALR-00471 14h ago Data Exfiltration Attempt Low False Positive SRV-APP-01
ALR-00206 18h ago Data Exfiltration Attempt High Investigating WS-LAP-011