Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:46:45 UTC

Insider Threat Indicator

High Escalated
ALR-00477 · 2026-10-12T00:16:33Z

Description

Anomalous after-hours access by 'k.brown' on SRV-APP-01. Accessed 847 files across 12 shares in 45 minutes. Pattern flagged by EmilyAI Triage.

Alert Metadata

Alert ID
ALR-00477
Timestamp
2026-10-12T00:16:33Z
Severity
High
Status
Escalated
Detection Source
EmilyAI Triage
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-APP-01
User Account
k.brown
Source IP
194.180.62.222
Destination IP
10.0.215.196
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Collection
Technique
T1119
Reference
attack.mitre.org/techniques/T1119

Investigation Timeline

00:16:33 Event ingested by SOC365 Engine
00:16:38 EmilyAI triage started — correlation enrichment
00:16:44 EmilyAI confidence: 84% — escalated to human analyst
00:17:01 Alert assigned to analyst: James Okonkwo
00:18:00 Investigation started — querying SIEM and threat intelligence
00:24:28 Containment action taken — endpoint isolated
00:29:33 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00019 1d ago Insider Threat Indicator Medium Resolved WS-PC-002
ALR-00299 1d ago Insider Threat Indicator Low Open WS-PC-002
ALR-00451 1d ago Lateral Movement Detected Low Resolved SRV-APP-01
ALR-00372 1d ago Insider Threat Indicator Low Investigating SRV-APP-01
ALR-00099 1d ago Insider Threat Indicator Medium Escalated WS-LAP-011