Ransomware Behaviour Detected
Low
Open
ALR-00427 · 2026-07-07T04:22:22Z
Description
File encryption behaviour detected on SRV-BACKUP-01. 142 files renamed with .locked extension in 30 seconds. Dark Web Monitor isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
04:22:22
Event ingested by SOC365 Engine
04:22:27
EmilyAI triage started — correlation enrichment
04:22:28
EmilyAI confidence: 84% — escalated to human analyst
04:22:50
Alert assigned to analyst: EmilyAI (auto)
04:24:20
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00176 | 10h ago | Brute Force SSH | Low | Open | SRV-BACKUP-01 |
| ALR-00238 | 13h ago | Privilege Escalation Attempt | Informational | Open | SRV-BACKUP-01 |
| ALR-00439 | 13h ago | Credential Stuffing Attempt | Low | False Positive | SRV-BACKUP-01 |
| ALR-00360 | 1d ago | Ransomware Behaviour Detected | Low | False Positive | SRV-MAIL-01 |
| ALR-00121 | 1d ago | Ransomware Behaviour Detected | Low | Resolved | WS-PC-006 |