Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:45:43 UTC

Credential Stuffing Attempt

Medium Escalated
ALR-00482 · 2026-10-11T07:41:17Z

Description

Credential stuffing attack detected against VPN gateway. 234 unique username/password combinations attempted. Flagged by Cloud Connector.

Alert Metadata

Alert ID
ALR-00482
Timestamp
2026-10-11T07:41:17Z
Severity
Medium
Status
Escalated
Detection Source
Cloud Connector
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
WS-PC-003
User Account
p.thomas
Source IP
91.211.195.232
Destination IP
10.3.190.162
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1110.004
Reference
attack.mitre.org/techniques/T1110.004

Investigation Timeline

07:41:17 Event ingested by SOC365 Engine
07:41:18 EmilyAI triage started — correlation enrichment
07:41:29 EmilyAI confidence: 92% — escalated to human analyst
07:41:48 Alert assigned to analyst: Marcus Webb
07:43:03 Investigation started — querying SIEM and threat intelligence
07:47:43 Containment action taken — endpoint isolated
07:53:46 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00117 43m ago Ransomware Behaviour Detected Medium Resolved WS-PC-003
ALR-00474 1h ago Brute Force SSH Low False Positive WS-PC-003
ALR-00312 3h ago Tor Exit Node Connection Medium False Positive WS-PC-003
ALR-00252 9h ago Credential Stuffing Attempt Informational Resolved SRV-MAIL-01
ALR-00044 10h ago Shadow IT Discovery Low False Positive WS-PC-003