Shadow IT Discovery

Medium Resolved

ALR-00466 · 2026-10-07T01:34:59Z

Description

Attack Surface Scanner discovered unauthorised SaaS application (file sharing) used by 'f.hall'. 14GB of company data synced to unapproved cloud storage.

Alert Metadata

Alert ID: ALR-00466
Timestamp: 2026-10-07T01:34:59Z
Severity: Medium
Status: Resolved
Detection Source: Attack Surface Scanner
Assigned Analyst: Marcus Webb

Endpoint Information

Hostname: SRV-BACKUP-01
User Account: f.hall
Source IP: 91.231.195.175
Destination IP: 10.3.159.4
Origin Country: KP North Korea

MITRE ATT&CK Mapping

Tactic: Exfiltration
Technique: T1567
Reference: attack.mitre.org/techniques/T1567

Investigation Timeline

01:34:59 Event ingested by SOC365 Engine

01:35:02 EmilyAI triage started — correlation enrichment

01:35:04 EmilyAI confidence: 88% — escalated to human analyst

01:35:28 Alert assigned to analyst: Marcus Webb

01:35:47 Investigation started — querying SIEM and threat intelligence

01:43:19 Containment action taken — endpoint isolated

01:47:29 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00189	32m ago	Brute Force SSH	Low	Escalated	SRV-BACKUP-01
ALR-00174	1h ago	DecoyPulse Honeypot Triggered	Medium	Resolved	SRV-BACKUP-01
ALR-00168	10h ago	Lateral Movement Detected	Low	False Positive	SRV-BACKUP-01
ALR-00467	13h ago	Insider Threat Indicator	Medium	Investigating	SRV-BACKUP-01
ALR-00463	17h ago	Pass-the-Hash Detected	Informational	Investigating	SRV-BACKUP-01