DecoyPulse Honeypot Triggered
High
Escalated
ALR-00121 · 2026-10-08T15:31:30Z
Description
DecoyPulse honeypot on SRV-SQL-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
15:31:30
Event ingested by SOC365 Engine
15:31:32
EmilyAI triage started — correlation enrichment
15:31:37
EmilyAI confidence: 83% — escalated to human analyst
15:32:00
Alert assigned to analyst: Marcus Webb
15:34:04
Investigation started — querying SIEM and threat intelligence
15:38:29
Containment action taken — endpoint isolated
15:46:42
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00448 | 20m ago | Suspicious PowerShell Execution | Low | False Positive | SRV-SQL-01 |
| ALR-00359 | 6h ago | Anomalous DNS Query | High | Escalated | SRV-SQL-01 |
| ALR-00495 | 22h ago | Malware Signature Match | Medium | Escalated | SRV-SQL-01 |
| ALR-00408 | 23h ago | Insider Threat Indicator | Low | Escalated | SRV-SQL-01 |
| ALR-00358 | 1d ago | Shadow IT Discovery | Low | Open | SRV-SQL-01 |