Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 18:39:25 UTC

Anomalous DNS Query

High Investigating
ALR-00042 · 2026-07-08T07:05:02Z

Description

DNS query to known DGA-generated domain from WS-PC-006. Attack Surface Scanner matched pattern against threat intelligence feed. User: k.brown.

Alert Metadata

Alert ID
ALR-00042
Timestamp
2026-07-08T07:05:02Z
Severity
High
Status
Investigating
Detection Source
Attack Surface Scanner
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
WS-PC-006
User Account
k.brown
Source IP
194.11.62.132
Destination IP
10.1.96.125
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1568.002
Reference
attack.mitre.org/techniques/T1568.002

Investigation Timeline

07:05:02 Event ingested by SOC365 Engine
07:05:06 EmilyAI triage started — correlation enrichment
07:05:10 EmilyAI confidence: 84% — escalated to human analyst
07:05:44 Alert assigned to analyst: James Okonkwo
07:07:11 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00026 12h ago Tor Exit Node Connection Informational False Positive WS-PC-006
ALR-00280 18h ago Lateral Movement Detected Informational Escalated WS-PC-006
ALR-00010 21h ago Anomalous DNS Query Low Resolved FW-EDGE-01
ALR-00322 1d ago Anomalous DNS Query Informational Open AP-WIFI-03
ALR-00414 1d ago Privilege Escalation Attempt High Escalated WS-PC-006