Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 18:42:07 UTC

Rogue DHCP Server

Low Investigating
ALR-00060 · 2026-07-06T17:19:40Z

Description

Rogue DHCP server detected on VLAN 10 from WS-PC-006. Offering IPs in unexpected range. DLP Module quarantined the device.

Alert Metadata

Alert ID
ALR-00060
Timestamp
2026-07-06T17:19:40Z
Severity
Low
Status
Investigating
Detection Source
DLP Module
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-PC-006
User Account
s.jones
Source IP
103.56.216.57
Destination IP
10.0.121.96
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

17:19:40 Event ingested by SOC365 Engine
17:19:44 EmilyAI triage started — correlation enrichment
17:19:55 EmilyAI confidence: 91% — escalated to human analyst
17:20:20 Alert assigned to analyst: EmilyAI (auto)
17:20:37 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00356 7h ago DecoyPulse Honeypot Triggered Informational Investigating WS-PC-006
ALR-00088 13h ago Rogue DHCP Server Medium Resolved WS-PC-004
ALR-00075 14h ago Lateral Movement Detected Low Resolved WS-PC-006
ALR-00126 1d ago Pass-the-Hash Detected Low Resolved WS-PC-006
ALR-00179 1d ago Rogue DHCP Server Low Open WS-PC-002