C2 Beacon Activity
Informational
Escalated
ALR-00244 · 2026-05-20T19:03:01Z
Description
Suspected C2 beacon detected from SRV-APP-01. Regular 60-second interval HTTPS POST to suspicious domain. Attack Surface Scanner blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:03:01
Event ingested by SOC365 Engine
19:03:05
EmilyAI triage started — correlation enrichment
19:03:11
EmilyAI confidence: 95% — escalated to human analyst
19:03:16
Alert assigned to analyst: EmilyAI (auto)
19:04:47
Investigation started — querying SIEM and threat intelligence
19:12:42
Containment action taken — endpoint isolated
19:14:54
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00349 | 1h ago | Shadow IT Discovery | High | Open | SRV-APP-01 |
| ALR-00201 | 5h ago | C2 Beacon Activity | Low | Open | AP-WIFI-03 |
| ALR-00035 | 6h ago | Rogue DHCP Server | Informational | Open | SRV-APP-01 |
| ALR-00187 | 6h ago | Suspicious Scheduled Task | Medium | Open | SRV-APP-01 |
| ALR-00372 | 8h ago | Ransomware Behaviour Detected | Medium | False Positive | SRV-APP-01 |