Insider Threat Indicator
Informational
False Positive
ALR-00465 · 2026-07-07T06:30:37Z
Description
Anomalous after-hours access by 'f.hall' on FW-EDGE-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Firewall.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
06:30:37
Event ingested by SOC365 Engine
06:30:42
EmilyAI triage started — correlation enrichment
06:30:44
EmilyAI confidence: 96% — escalated to human analyst
06:30:59
Alert assigned to analyst: EmilyAI (auto)
06:32:07
Investigation started — querying SIEM and threat intelligence
06:35:51
Containment action taken — endpoint isolated
06:47:57
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00243 | 7h ago | Insider Threat Indicator | High | Escalated | SRV-MAIL-01 |
| ALR-00304 | 8h ago | Insider Threat Indicator | Medium | Escalated | WS-MAC-005 |
| ALR-00486 | 17h ago | Insider Threat Indicator | Low | Escalated | SRV-MAIL-01 |
| ALR-00284 | 23h ago | Credential Stuffing Attempt | Informational | Investigating | FW-EDGE-01 |
| ALR-00066 | 1d ago | Insider Threat Indicator | Informational | Resolved | WS-PC-003 |