C2 Beacon Activity
Medium
Investigating
ALR-00031 · 2026-07-07T00:31:50Z
Description
Suspected C2 beacon detected from WS-PC-002. Regular 60-second interval HTTPS POST to suspicious domain. Email Gateway blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:31:50
Event ingested by SOC365 Engine
00:31:52
EmilyAI triage started — correlation enrichment
00:31:57
EmilyAI confidence: 82% — escalated to human analyst
00:32:34
Alert assigned to analyst: Sarah Chen
00:33:03
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00357 | 21h ago | C2 Beacon Activity | Informational | Investigating | WS-LAP-012 |
| ALR-00317 | 21h ago | Data Exfiltration Attempt | Medium | Escalated | WS-PC-002 |
| ALR-00309 | 1d ago | C2 Beacon Activity | Medium | Investigating | WS-PC-001 |
| ALR-00302 | 1d ago | Unauthorised USB Device | Low | False Positive | WS-PC-002 |
| ALR-00179 | 1d ago | Rogue DHCP Server | Low | Open | WS-PC-002 |