Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 02:46:54 UTC

DecoyPulse Honeypot Triggered

Informational Resolved
ALR-00009 · 2026-10-09T06:55:32Z

Description

DecoyPulse honeypot on SW-CORE-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.

Alert Metadata

Alert ID
ALR-00009
Timestamp
2026-10-09T06:55:32Z
Severity
Informational
Status
Resolved
Detection Source
Network IDS
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SW-CORE-01
User Account
d.walker
Source IP
103.191.216.220
Destination IP
10.1.229.240
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1018
Reference
attack.mitre.org/techniques/T1018

Investigation Timeline

06:55:32 Event ingested by SOC365 Engine
06:55:36 EmilyAI triage started — correlation enrichment
06:55:43 EmilyAI confidence: 89% — escalated to human analyst
06:55:51 Alert assigned to analyst: EmilyAI (auto)
06:58:12 Investigation started — querying SIEM and threat intelligence
07:03:53 Containment action taken — endpoint isolated
07:05:46 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00490 4h ago DecoyPulse Honeypot Triggered Critical Investigating WS-PC-001
ALR-00254 6h ago DecoyPulse Honeypot Triggered High Investigating WS-PC-001
ALR-00433 9h ago Failed MFA Challenge High Escalated SW-CORE-01
ALR-00315 10h ago Kerberoasting Attempt Low Open SW-CORE-01
ALR-00103 12h ago DLP Policy Violation High Open SW-CORE-01