Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:08 UTC

Rogue DHCP Server

Medium Escalated
ALR-00159 · 2026-10-10T03:33:46Z

Description

Rogue DHCP server detected on VLAN 10 from SW-CORE-01. Offering IPs in unexpected range. Cloud Connector quarantined the device.

Alert Metadata

Alert ID
ALR-00159
Timestamp
2026-10-10T03:33:46Z
Severity
Medium
Status
Escalated
Detection Source
Cloud Connector
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SW-CORE-01
User Account
system
Source IP
103.201.216.155
Destination IP
10.1.25.207
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

03:33:46 Event ingested by SOC365 Engine
03:33:47 EmilyAI triage started — correlation enrichment
03:33:51 EmilyAI confidence: 79% — escalated to human analyst
03:34:06 Alert assigned to analyst: James Okonkwo
03:35:36 Investigation started — querying SIEM and threat intelligence
03:39:09 Containment action taken — endpoint isolated
03:48:41 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00125 3h ago Ransomware Behaviour Detected Informational False Positive SW-CORE-01
ALR-00258 4h ago Certificate Anomaly Medium Open SW-CORE-01
ALR-00348 5h ago Credential Stuffing Attempt Low Escalated SW-CORE-01
ALR-00332 11h ago DLP Policy Violation High Escalated SW-CORE-01
ALR-00305 14h ago Failed MFA Challenge Critical Escalated SW-CORE-01