Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 02:45:51 UTC

Rogue DHCP Server

Informational False Positive
ALR-00005 · 2026-10-07T16:48:02Z

Description

Rogue DHCP server detected on VLAN 10 from WS-LAP-012. Offering IPs in unexpected range. Dark Web Monitor quarantined the device.

Alert Metadata

Alert ID
ALR-00005
Timestamp
2026-10-07T16:48:02Z
Severity
Informational
Status
False Positive
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-012
User Account
h.roberts
Source IP
194.252.62.78
Destination IP
10.1.110.168
Origin Country
VN Vietnam

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

16:48:02 Event ingested by SOC365 Engine
16:48:06 EmilyAI triage started — correlation enrichment
16:48:13 EmilyAI confidence: 78% — escalated to human analyst
16:48:22 Alert assigned to analyst: EmilyAI (auto)
16:50:35 Investigation started — querying SIEM and threat intelligence
16:52:04 Containment action taken — endpoint isolated
17:03:42 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00143 4h ago Rogue DHCP Server Informational Investigating SW-CORE-01
ALR-00194 5h ago DecoyPulse Honeypot Triggered Medium Resolved WS-LAP-012
ALR-00427 18h ago Rogue DHCP Server Medium Resolved SW-CORE-01
ALR-00344 20h ago Phishing Email Blocked Low False Positive WS-LAP-012
ALR-00065 23h ago Rogue DHCP Server Medium Investigating WS-PC-001