Alert queue
Alert queue: 31 of 31 alerts shown, 31 open, 0 closed. Sorted by severity. Filters: no filters. Top of the queue: A-1045, critical severity, Credential dumping tool executed against LSASS, from EDR, 305 minutes old, still open.
31 of 31 alerts shown. Click any row to investigate.
Severity
Source
Status
| Source | User | Host | Status | |||
|---|---|---|---|---|---|---|
| Critical | Credential dumping tool executed against LSASSA-1045 | EDR | a.brennan | SRV-ERP-02 | 2026-07-24 13:55Z305 min old | Open |
| Critical | User account added to Domain Admins outside a change windowA-1055 | SIEM Correlation | m.okafor | SRV-DC-01 | 2026-07-24 15:47Z193 min old | Open |
| Critical | Ransomware canary file modified on the engineering shareA-1060 | EDR | l.nowak | SRV-FILE-03 | 2026-07-24 16:34Z146 min old | Open |
| High | Credential phishing email reported by user — link clickedA-1041 | Email Gateway | j.rivera | WKS-FINANCE-14 | 2026-07-24 13:04Z356 min old | Open |
| High | Password spray followed by successful sign-inA-1043 | SIEM Correlation | m.okafor | SRV-DC-01 | 2026-07-24 13:26Z334 min old | Open |
| High | Impossible travel: Chicago then Singapore in 22 minutesA-1047 | Cloud Audit Log | dtanaka | LAPTOP-DTANAKA | 2026-07-24 14:18Z282 min old | Open |
| High | Encoded PowerShell download cradle on a finance workstationA-1049 | EDR | j.rivera | WKS-FINANCE-14 | 2026-07-24 14:38Z262 min old | Open |
| High | Large upload of CAD files to a personal cloud storage accountA-1051 | DLP | l.nowak | WKS-ENG-07 | 2026-07-24 15:02Z238 min old | Open |
| High | SMB scanning and admin share access across the finance subnetA-1053 | IDS | m.okafor | WKS-FINANCE-14 | 2026-07-24 15:24Z216 min old | Open |
| High | Outbound connection to a known command-and-control server blockedA-1057 | Firewall | j.rivera | LAPTOP-JRIVERA | 2026-07-24 16:05Z175 min old | Open |
| High | Executive impersonation email requesting an urgent wire transferA-1059 | Email Gateway | p.osei | WKS-FINANCE-14 | 2026-07-24 16:20Z160 min old | Open |
| High | New cloud access key created for a service principalA-1061 | Cloud Audit Log | dtanaka | LAPTOP-DTANAKA | 2026-07-24 16:41Z139 min old | Open |
| High | Cloud storage bucket made publicly readableA-1062 | Cloud Audit Log | a.brennan | SRV-ERP-02 | 2026-07-24 16:52Z128 min old | Open |
| High | Kerberoasting: bulk service ticket requests with weak encryptionA-1064 | SIEM Correlation | m.okafor | SRV-DC-01 | 2026-07-24 17:12Z108 min old | Open |
| High | Scheduled task created to run a script at every logonA-1066 | EDR | j.rivera | WKS-FINANCE-14 | 2026-07-24 17:36Z84 min old | Open |
| High | DNS tunneling suspected from a plant floor gatewayA-1070 | IDS | m.okafor | PLC-GW-01 | 2026-07-24 18:28Z32 min old | Open |
| Medium | Repeated MFA push prompts rejected by user (push fatigue)A-1071 | Cloud Audit Log | dtanaka | LAPTOP-DTANAKA | 2026-07-24 13:06Z354 min old | Open |
| Medium | Bulk marketing email flagged as suspicious by content filterA-1042 | Email Gateway | k.mensah | WKS-HR-02 | 2026-07-24 13:12Z348 min old | Open |
| Medium | Repeated failed logons from a user's own workstationA-1044 | SIEM Correlation | t.alvarez | WKS-QA-11 | 2026-07-24 13:41Z319 min old | Open |
| Medium | EICAR test file detected during antivirus validationA-1046 | EDR | a.brennan | WKS-ENG-07 | 2026-07-24 14:02Z298 min old | Open |
| Medium | Impossible travel flagged for a user on the corporate VPNA-1048 | Cloud Audit Log | l.nowak | WKS-ENG-07 | 2026-07-24 14:26Z274 min old | Open |
| Medium | PowerShell remoting used by IT during approved patchingA-1050 | EDR | a.brennan | SRV-FILE-03 | 2026-07-24 14:44Z256 min old | Open |
| Medium | Backup service account uploads 40 GB to cloud storageA-1052 | DLP | svc-backup | SRV-BACKUP-01 | 2026-07-24 15:11Z229 min old | Open |
| Medium | Vulnerability scanner triggers lateral movement signatureA-1054 | IDS | svc-backup | SRV-BACKUP-01 | 2026-07-24 15:33Z207 min old | Open |
| Medium | Helpdesk technician added to a local Administrators groupA-1056 | SIEM Correlation | a.brennan | WKS-QA-11 | 2026-07-24 15:55Z185 min old | Open |
| Medium | IDS signature for SQL injection against the supplier portalA-1065 | IDS | external | SRV-ERP-02 | 2026-07-24 17:24Z96 min old | Open |
| Medium | Disabled employee account attempts VPN sign-inA-1068 | SIEM Correlation | b.harlow | SRV-DC-01 | 2026-07-24 18:02Z58 min old | Open |
| Medium | USB mass storage device blocked on the OT gatewayA-1069 | DLP | m.okafor | PLC-GW-01 | 2026-07-24 18:15Z45 min old | Open |
| Low | Firewall deny burst to a printer vendor update serviceA-1058 | Firewall | t.alvarez | WKS-QA-11 | 2026-07-24 16:12Z168 min old | Open |
| Low | DLP blocks a resume attachment sent to a personal addressA-1063 | DLP | k.mensah | WKS-HR-02 | 2026-07-24 17:01Z119 min old | Open |
| Low | Software deployment tool flagged as suspicious script executionA-1067 | EDR | svc-backup | WKS-HR-02 | 2026-07-24 17:48Z72 min old | Open |
Sources here mirror a real SOC: , correlation, , , , and .