Ransomware Behaviour Detected
Low
Open
ALR-00480 · 2026-07-06T01:06:05Z
Description
File encryption behaviour detected on WS-LAP-011. 142 files renamed with .locked extension in 30 seconds. EmilyAI Triage isolated endpoint.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
01:06:05
Event ingested by SOC365 Engine
01:06:07
EmilyAI triage started — correlation enrichment
01:06:17
EmilyAI confidence: 81% — escalated to human analyst
01:06:26
Alert assigned to analyst: EmilyAI (auto)
01:07:06
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00244 | 41m ago | Ransomware Behaviour Detected | High | Investigating | WS-LAP-010 |
| ALR-00410 | 5h ago | Port Scan Detected | Low | False Positive | WS-LAP-011 |
| ALR-00065 | 9h ago | Shadow IT Discovery | Low | Escalated | WS-LAP-011 |
| ALR-00070 | 13h ago | Ransomware Behaviour Detected | Informational | Investigating | SW-CORE-01 |
| ALR-00250 | 18h ago | Shadow IT Discovery | Low | Escalated | WS-LAP-011 |