Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:44:32 UTC

Kerberoasting Attempt

Low Resolved
ALR-00074 · 2026-10-09T07:53:45Z

Description

Kerberoasting attack detected: user 's.jones' requested TGS tickets for multiple service accounts in 2 minutes. Flagged by DecoyPulse.

Alert Metadata

Alert ID
ALR-00074
Timestamp
2026-10-09T07:53:45Z
Severity
Low
Status
Resolved
Detection Source
DecoyPulse
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-WEB-01
User Account
s.jones
Source IP
45.47.148.27
Destination IP
10.0.5.125
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1558.003
Reference
attack.mitre.org/techniques/T1558.003

Investigation Timeline

07:53:45 Event ingested by SOC365 Engine
07:53:48 EmilyAI triage started — correlation enrichment
07:53:52 EmilyAI confidence: 91% — escalated to human analyst
07:54:23 Alert assigned to analyst: EmilyAI (auto)
07:54:59 Investigation started — querying SIEM and threat intelligence
08:03:18 Containment action taken — endpoint isolated
08:04:49 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00456 3h ago Pass-the-Hash Detected Low Resolved SRV-WEB-01
ALR-00145 3h ago Rogue DHCP Server Low False Positive SRV-WEB-01
ALR-00280 3h ago Kerberoasting Attempt Low Resolved SRV-SQL-01
ALR-00274 5h ago Certificate Anomaly Low Escalated SRV-WEB-01
ALR-00184 15h ago Port Scan Detected Medium Investigating SRV-WEB-01