DecoyPulse Honeypot Triggered
Medium
Investigating
ALR-00070 · 2026-05-27T10:42:48Z
Description
DecoyPulse honeypot on WS-PC-004 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
10:42:48
Event ingested by SOC365 Engine
10:42:50
EmilyAI triage started — correlation enrichment
10:42:56
EmilyAI confidence: 81% — escalated to human analyst
10:43:14
Alert assigned to analyst: James Okonkwo
10:45:25
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00126 | 57m ago | DecoyPulse Honeypot Triggered | High | Open | SRV-SQL-01 |
| ALR-00015 | 3h ago | DLP Policy Violation | Medium | Investigating | WS-PC-004 |
| ALR-00418 | 9h ago | DecoyPulse Honeypot Triggered | Low | Escalated | FW-EDGE-01 |
| ALR-00209 | 21h ago | Brute Force SSH | Informational | Investigating | WS-PC-004 |
| ALR-00422 | 1d ago | DLP Policy Violation | Low | Escalated | WS-PC-004 |