Port Scan Detected
Informational
False Positive
ALR-00065 · 2026-07-05T19:24:56Z
Description
Sequential port scan (1-1024) detected targeting FW-EDGE-01 from external IP. SOC365 Engine identified SYN scan pattern.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:24:56
Event ingested by SOC365 Engine
19:24:57
EmilyAI triage started — correlation enrichment
19:25:02
EmilyAI confidence: 89% — escalated to human analyst
19:25:16
Alert assigned to analyst: EmilyAI (auto)
19:27:49
Investigation started — querying SIEM and threat intelligence
19:34:04
Containment action taken — endpoint isolated
19:43:28
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00239 | 5h ago | Tor Exit Node Connection | Informational | Escalated | FW-EDGE-01 |
| ALR-00004 | 7h ago | Port Scan Detected | Informational | Resolved | SRV-WEB-01 |
| ALR-00254 | 11h ago | Port Scan Detected | Low | False Positive | WS-PC-002 |
| ALR-00499 | 1d ago | Certificate Anomaly | Informational | Resolved | FW-EDGE-01 |
| ALR-00338 | 1d ago | DecoyPulse Honeypot Triggered | Low | False Positive | FW-EDGE-01 |