Rogue DHCP Server
Medium
Investigating
ALR-00099 · 2026-07-08T01:57:02Z
Description
Rogue DHCP server detected on VLAN 10 from WS-LAP-011. Offering IPs in unexpected range. DLP Module quarantined the device.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
01:57:02
Event ingested by SOC365 Engine
01:57:05
EmilyAI triage started — correlation enrichment
01:57:13
EmilyAI confidence: 96% — escalated to human analyst
01:57:23
Alert assigned to analyst: Anika Patel
01:58:15
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00476 | 11h ago | Privilege Escalation Attempt | Informational | Investigating | WS-LAP-011 |
| ALR-00240 | 11h ago | Brute Force SSH | Medium | Escalated | WS-LAP-011 |
| ALR-00198 | 16h ago | Port Scan Detected | Informational | Open | WS-LAP-011 |
| ALR-00182 | 20h ago | Unauthorised USB Device | Low | Investigating | WS-LAP-011 |
| ALR-00345 | 1d ago | Tor Exit Node Connection | Medium | Resolved | WS-LAP-011 |