Suspicious Scheduled Task
Medium
Escalated
ALR-00164 · 2026-10-09T11:41:42Z
Description
New scheduled task created on WS-PC-002 by 'h.roberts' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:41:42
Event ingested by SOC365 Engine
11:41:45
EmilyAI triage started — correlation enrichment
11:41:52
EmilyAI confidence: 80% — escalated to human analyst
11:42:15
Alert assigned to analyst: Emma Richardson
11:44:37
Investigation started — querying SIEM and threat intelligence
11:48:55
Containment action taken — endpoint isolated
11:54:40
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00401 | 2h ago | Suspicious Scheduled Task | Medium | False Positive | WS-LAP-011 |
| ALR-00255 | 4h ago | Data Exfiltration Attempt | Informational | Escalated | WS-PC-002 |
| ALR-00462 | 6h ago | Suspicious Scheduled Task | Medium | Open | WS-LAP-011 |
| ALR-00477 | 7h ago | Rogue DHCP Server | Informational | Open | WS-PC-002 |
| ALR-00205 | 9h ago | Suspicious Scheduled Task | High | Escalated | SRV-APP-01 |