Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:44:08 UTC

C2 Beacon Activity

High Open
ALR-00077 · 2026-10-06T02:40:22Z

Description

Suspected C2 beacon detected from VM-DEV-01. Regular 60-second interval HTTPS POST to suspicious domain. Dark Web Monitor blocked outbound.

Alert Metadata

Alert ID
ALR-00077
Timestamp
2026-10-06T02:40:22Z
Severity
High
Status
Open
Detection Source
Dark Web Monitor
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
VM-DEV-01
User Account
n.clark
Source IP
45.106.148.189
Destination IP
10.3.160.8
Origin Country
NL Netherlands

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1071.001
Reference
attack.mitre.org/techniques/T1071.001

Investigation Timeline

02:40:22 Event ingested by SOC365 Engine
02:40:26 EmilyAI triage started — correlation enrichment
02:40:31 EmilyAI confidence: 83% — escalated to human analyst
02:40:46 Alert assigned to analyst: James Okonkwo
02:43:02 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00458 7m ago C2 Beacon Activity Informational Escalated SW-CORE-01
ALR-00230 5h ago Certificate Anomaly Informational Open VM-DEV-01
ALR-00482 13h ago Shadow IT Discovery Informational False Positive VM-DEV-01
ALR-00018 13h ago C2 Beacon Activity Medium Escalated SRV-DC-01
ALR-00498 13h ago Lateral Movement Detected Informational Resolved VM-DEV-01