Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:00 UTC

DLP Policy Violation

High Escalated
ALR-00456 · 2026-10-05T09:41:12Z

Description

DLP policy violation: user 'e.evans' attempted to email 3 files classified as 'Confidential' to external address from WS-LAP-011.

Alert Metadata

Alert ID
ALR-00456
Timestamp
2026-10-05T09:41:12Z
Severity
High
Status
Escalated
Detection Source
Network IDS
Assigned Analyst
Sarah Chen

Endpoint Information

Hostname
WS-LAP-011
User Account
e.evans
Source IP
91.88.195.92
Destination IP
10.3.234.84
Origin Country
VN Vietnam

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1048
Reference
attack.mitre.org/techniques/T1048

Investigation Timeline

09:41:12 Event ingested by SOC365 Engine
09:41:16 EmilyAI triage started — correlation enrichment
09:41:22 EmilyAI confidence: 91% — escalated to human analyst
09:41:50 Alert assigned to analyst: Sarah Chen
09:43:10 Investigation started — querying SIEM and threat intelligence
09:51:09 Containment action taken — endpoint isolated
09:54:23 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00328 2h ago DLP Policy Violation Medium Investigating SRV-SQL-01
ALR-00239 5h ago DLP Policy Violation Medium Escalated SRV-MAIL-01
ALR-00036 6h ago DLP Policy Violation Medium Investigating WS-LAP-012
ALR-00124 7h ago Suspicious Scheduled Task High Investigating WS-LAP-011
ALR-00087 17h ago DLP Policy Violation Informational Resolved WS-PC-003