Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 05:44:27 UTC

Failed MFA Challenge

Low Resolved
ALR-00484 · 2026-10-09T09:11:30Z

Description

Multiple failed MFA challenges for user 'l.johnson' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Network IDS locked account.

Alert Metadata

Alert ID
ALR-00484
Timestamp
2026-10-09T09:11:30Z
Severity
Low
Status
Resolved
Detection Source
Network IDS
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SW-CORE-01
User Account
l.johnson
Source IP
103.197.216.125
Destination IP
10.0.55.229
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1621
Reference
attack.mitre.org/techniques/T1621

Investigation Timeline

09:11:30 Event ingested by SOC365 Engine
09:11:35 EmilyAI triage started — correlation enrichment
09:11:44 EmilyAI confidence: 88% — escalated to human analyst
09:12:09 Alert assigned to analyst: EmilyAI (auto)
09:13:41 Investigation started — querying SIEM and threat intelligence
09:19:38 Containment action taken — endpoint isolated
09:26:04 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00481 2h ago Failed MFA Challenge High Open WS-LAP-011
ALR-00265 5h ago Failed MFA Challenge Low False Positive SRV-DC-01
ALR-00353 10h ago Failed MFA Challenge Medium Resolved WS-PC-004
ALR-00161 18h ago Failed MFA Challenge Medium False Positive WS-PC-001
ALR-00229 1d ago Failed MFA Challenge High Investigating WS-PC-006