Brute Force SSH
Medium
Investigating
ALR-00431 · 2026-07-10T06:44:55Z
Description
Multiple failed SSH login attempts detected on WS-PC-001 from external IP. Email Gateway flagged 47 attempts in 5 minutes targeting user 'j.smith'.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
06:44:55
Event ingested by SOC365 Engine
06:44:56
EmilyAI triage started — correlation enrichment
06:45:05
EmilyAI confidence: 81% — escalated to human analyst
06:45:15
Alert assigned to analyst: James Okonkwo
06:47:05
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00230 | 3h ago | Brute Force SSH | Medium | Resolved | WS-LAP-010 |
| ALR-00368 | 5h ago | Phishing Email Blocked | Low | Investigating | WS-PC-001 |
| ALR-00486 | 6h ago | Brute Force SSH | High | Open | WS-PC-004 |
| ALR-00473 | 9h ago | Phishing Email Blocked | Medium | Investigating | WS-PC-001 |
| ALR-00065 | 12h ago | Malware Signature Match | High | Investigating | WS-PC-001 |