Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:11 UTC

Insider Threat Indicator

Low Resolved
ALR-00476 · 2026-10-08T14:50:51Z

Description

Anomalous after-hours access by 'c.williams' on SRV-BACKUP-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by Endpoint Agent.

Alert Metadata

Alert ID
ALR-00476
Timestamp
2026-10-08T14:50:51Z
Severity
Low
Status
Resolved
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-BACKUP-01
User Account
c.williams
Source IP
103.86.216.38
Destination IP
10.3.27.80
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

14:50:51 Event ingested by SOC365 Engine
14:50:53 EmilyAI triage started — correlation enrichment
14:50:56 EmilyAI confidence: 94% — escalated to human analyst
14:51:17 Alert assigned to analyst: EmilyAI (auto)
14:51:57 Investigation started — querying SIEM and threat intelligence
14:58:13 Containment action taken — endpoint isolated
15:06:41 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00443 1h ago Privilege Escalation Attempt Medium Investigating SRV-BACKUP-01
ALR-00347 1h ago Anomalous DNS Query Informational Resolved SRV-BACKUP-01
ALR-00468 4h ago Insider Threat Indicator Low False Positive WS-PC-001
ALR-00417 6h ago Port Scan Detected Low Investigating SRV-BACKUP-01
ALR-00189 10h ago Unauthorised USB Device Medium Open SRV-BACKUP-01