Alert help

So we got an email from our soc1 w an alert saying that a windows server had 600 failed login attempts from an admin account on our network.

The login attempts came from an aws vm on our network that’s linked to a developer. the admin account that tried those 600 attempts is not the employee that is listed as the developer tied to the vm that tried the attempts.

basically, it’s saying that employee As workstation tried to access …

alert cybersecurity