Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:49:13 UTC

Data Exfiltration Attempt

Informational False Positive
ALR-00485 · 2026-10-05T11:51:40Z

Description

Large data transfer (2.3GB) to cloud storage from SRV-MAIL-01 by user 'd.walker'. EmilyAI Triage DLP policy triggered — sensitive documents detected.

Alert Metadata

Alert ID
ALR-00485
Timestamp
2026-10-05T11:51:40Z
Severity
Informational
Status
False Positive
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-MAIL-01
User Account
d.walker
Source IP
103.253.216.95
Destination IP
10.2.104.186
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Exfiltration
Technique
T1567.002
Reference
attack.mitre.org/techniques/T1567.002

Investigation Timeline

11:51:40 Event ingested by SOC365 Engine
11:51:42 EmilyAI triage started — correlation enrichment
11:51:53 EmilyAI confidence: 82% — escalated to human analyst
11:52:05 Alert assigned to analyst: EmilyAI (auto)
11:54:28 Investigation started — querying SIEM and threat intelligence
11:59:31 Containment action taken — endpoint isolated
12:01:51 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00460 7h ago Failed MFA Challenge Medium Escalated SRV-MAIL-01
ALR-00497 7h ago Data Exfiltration Attempt Low Escalated SRV-SQL-01
ALR-00285 14h ago Data Exfiltration Attempt Low Open WS-PC-001
ALR-00209 19h ago Data Exfiltration Attempt Medium Resolved SRV-DC-01
ALR-00133 1d ago Suspicious Scheduled Task Low Investigating SRV-MAIL-01