Port Scan Detected
Low
Investigating
ALR-00475 · 2026-10-07T08:15:07Z
Description
Sequential port scan (1-1024) detected targeting SW-CORE-01 from external IP. Dark Web Monitor identified SYN scan pattern.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:15:07
Event ingested by SOC365 Engine
08:15:12
EmilyAI triage started — correlation enrichment
08:15:19
EmilyAI confidence: 78% — escalated to human analyst
08:15:41
Alert assigned to analyst: EmilyAI (auto)
08:16:49
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00201 | 38m ago | Shadow IT Discovery | Medium | False Positive | SW-CORE-01 |
| ALR-00126 | 13h ago | Port Scan Detected | Medium | False Positive | WS-PC-002 |
| ALR-00324 | 13h ago | Port Scan Detected | Informational | Investigating | WS-PC-003 |
| ALR-00404 | 15h ago | Insider Threat Indicator | Medium | Escalated | SW-CORE-01 |
| ALR-00289 | 20h ago | Port Scan Detected | Medium | False Positive | VM-DEV-01 |