DecoyPulse Honeypot Triggered
Informational
Escalated
ALR-00236 · 2026-07-10T14:37:37Z
Description
DecoyPulse honeypot on VM-DEV-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
14:37:37
Event ingested by SOC365 Engine
14:37:39
EmilyAI triage started — correlation enrichment
14:37:51
EmilyAI confidence: 83% — escalated to human analyst
14:37:53
Alert assigned to analyst: EmilyAI (auto)
14:38:37
Investigation started — querying SIEM and threat intelligence
14:42:26
Containment action taken — endpoint isolated
14:51:19
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00370 | 11h ago | Credential Stuffing Attempt | Medium | Investigating | VM-DEV-01 |
| ALR-00342 | 13h ago | DecoyPulse Honeypot Triggered | Medium | False Positive | WS-PC-002 |
| ALR-00349 | 14h ago | DecoyPulse Honeypot Triggered | Informational | False Positive | SRV-MAIL-01 |
| ALR-00158 | 16h ago | DecoyPulse Honeypot Triggered | Critical | Escalated | SRV-DC-01 |
| ALR-00113 | 21h ago | Suspicious Scheduled Task | Low | False Positive | VM-DEV-01 |