Suspicious Scheduled Task
Medium
Escalated
ALR-00013 · 2026-05-22T05:37:06Z
Description
New scheduled task created on SW-CORE-01 by 'r.davies' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
05:37:06
Event ingested by SOC365 Engine
05:37:11
EmilyAI triage started — correlation enrichment
05:37:19
EmilyAI confidence: 87% — escalated to human analyst
05:37:36
Alert assigned to analyst: James Okonkwo
05:39:53
Investigation started — querying SIEM and threat intelligence
05:45:25
Containment action taken — endpoint isolated
05:49:17
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00362 | 3h ago | Suspicious Scheduled Task | Medium | Resolved | SRV-FILE-01 |
| ALR-00233 | 4h ago | Suspicious Scheduled Task | Informational | Open | WS-PC-006 |
| ALR-00371 | 5h ago | Rogue DHCP Server | Low | False Positive | SW-CORE-01 |
| ALR-00117 | 7h ago | Lateral Movement Detected | Medium | Investigating | SW-CORE-01 |
| ALR-00379 | 20h ago | Tor Exit Node Connection | Informational | False Positive | SW-CORE-01 |