Rogue DHCP Server
Informational
Open
ALR-00171 · 2026-07-06T03:23:52Z
Description
Rogue DHCP server detected on VLAN 10 from SRV-APP-01. Offering IPs in unexpected range. Endpoint Agent quarantined the device.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
03:23:52
Event ingested by SOC365 Engine
03:23:57
EmilyAI triage started — correlation enrichment
03:24:00
EmilyAI confidence: 80% — escalated to human analyst
03:24:34
Alert assigned to analyst: EmilyAI (auto)
03:25:09
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00180 | 6m ago | Data Exfiltration Attempt | Low | Resolved | SRV-APP-01 |
| ALR-00447 | 7h ago | Kerberoasting Attempt | Low | Escalated | SRV-APP-01 |
| ALR-00169 | 12h ago | Data Exfiltration Attempt | Medium | Escalated | SRV-APP-01 |
| ALR-00163 | 14h ago | DLP Policy Violation | Low | Escalated | SRV-APP-01 |
| ALR-00337 | 15h ago | Rogue DHCP Server | Low | Escalated | SRV-DC-01 |