Brute Force SSH

Critical Investigating

ALR-00491 · 2026-07-08T15:45:54Z

Description

Multiple failed SSH login attempts detected on WS-PC-003 from external IP. Attack Surface Scanner flagged 47 attempts in 5 minutes targeting user 'j.smith'.

Alert Metadata

Alert ID: ALR-00491
Timestamp: 2026-07-08T15:45:54Z
Severity: Critical
Status: Investigating
Detection Source: Attack Surface Scanner
Assigned Analyst: Emma Richardson

Endpoint Information

Hostname: WS-PC-003
User Account: j.smith
Source IP: 194.8.62.85
Destination IP: 10.0.80.107
Origin Country: RU Russia

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1110.001
Reference: attack.mitre.org/techniques/T1110.001

Investigation Timeline

15:45:54 Event ingested by SOC365 Engine

15:45:55 EmilyAI triage started — correlation enrichment

15:46:04 EmilyAI confidence: 90% — escalated to human analyst

15:46:31 Alert assigned to analyst: Emma Richardson

15:48:20 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00161	2h ago	Brute Force SSH	High	Escalated	SRV-MAIL-01
ALR-00330	7h ago	Phishing Email Blocked	Informational	Open	WS-PC-003
ALR-00342	9h ago	Certificate Anomaly	Low	Resolved	WS-PC-003
ALR-00015	10h ago	Brute Force SSH	Medium	Resolved	WS-LAP-012
ALR-00345	13h ago	Brute Force SSH	High	Investigating	SRV-APP-01