C2 Beacon Activity
Medium
Escalated
ALR-00076 · 2026-07-05T20:40:08Z
Description
Suspected C2 beacon detected from SRV-WEB-01. Regular 60-second interval HTTPS POST to suspicious domain. SOC365 Engine blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
20:40:08
Event ingested by SOC365 Engine
20:40:10
EmilyAI triage started — correlation enrichment
20:40:20
EmilyAI confidence: 91% — escalated to human analyst
20:40:40
Alert assigned to analyst: Anika Patel
20:42:44
Investigation started — querying SIEM and threat intelligence
20:48:55
Containment action taken — endpoint isolated
20:55:30
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00369 | 5h ago | C2 Beacon Activity | Informational | Resolved | WS-PC-003 |
| ALR-00199 | 7h ago | C2 Beacon Activity | Low | Resolved | SRV-BACKUP-01 |
| ALR-00025 | 14h ago | Unusual Outbound Traffic | Low | Investigating | SRV-WEB-01 |
| ALR-00186 | 1d ago | Port Scan Detected | Low | Resolved | SRV-WEB-01 |
| ALR-00109 | 1d ago | Credential Stuffing Attempt | High | Investigating | SRV-WEB-01 |