Anomalous DNS Query
High
Investigating
ALR-00042 · 2026-07-08T07:05:02Z
Description
DNS query to known DGA-generated domain from WS-PC-006. Attack Surface Scanner matched pattern against threat intelligence feed. User: k.brown.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
07:05:02
Event ingested by SOC365 Engine
07:05:06
EmilyAI triage started — correlation enrichment
07:05:10
EmilyAI confidence: 84% — escalated to human analyst
07:05:44
Alert assigned to analyst: James Okonkwo
07:07:11
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00026 | 12h ago | Tor Exit Node Connection | Informational | False Positive | WS-PC-006 |
| ALR-00280 | 18h ago | Lateral Movement Detected | Informational | Escalated | WS-PC-006 |
| ALR-00010 | 21h ago | Anomalous DNS Query | Low | Resolved | FW-EDGE-01 |
| ALR-00322 | 1d ago | Anomalous DNS Query | Informational | Open | AP-WIFI-03 |
| ALR-00414 | 1d ago | Privilege Escalation Attempt | High | Escalated | WS-PC-006 |