DecoyPulse Honeypot Triggered
Medium
Open
ALR-00173 · 2026-07-08T20:33:59Z
Description
DecoyPulse honeypot on SRV-MAIL-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
20:33:59
Event ingested by SOC365 Engine
20:34:01
EmilyAI triage started — correlation enrichment
20:34:07
EmilyAI confidence: 94% — escalated to human analyst
20:34:42
Alert assigned to analyst: Sarah Chen
20:35:42
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00274 | 18h ago | Privilege Escalation Attempt | Low | Open | SRV-MAIL-01 |
| ALR-00158 | 1d ago | DecoyPulse Honeypot Triggered | High | Investigating | SW-CORE-01 |
| ALR-00081 | 1d ago | Brute Force SSH | Low | Investigating | SRV-MAIL-01 |
| ALR-00491 | 1d ago | Brute Force SSH | Low | Open | SRV-MAIL-01 |
| ALR-00063 | 1d ago | DecoyPulse Honeypot Triggered | Low | Investigating | WS-PC-006 |