C2 Beacon Activity
Low
Investigating
ALR-00248 · 2026-07-10T09:15:08Z
Description
Suspected C2 beacon detected from SRV-APP-01. Regular 60-second interval HTTPS POST to suspicious domain. Cloud Connector blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
09:15:08
Event ingested by SOC365 Engine
09:15:12
EmilyAI triage started — correlation enrichment
09:15:21
EmilyAI confidence: 96% — escalated to human analyst
09:15:29
Alert assigned to analyst: EmilyAI (auto)
09:16:01
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00262 | 36m ago | C2 Beacon Activity | Low | False Positive | WS-LAP-011 |
| ALR-00465 | 1h ago | Suspicious Scheduled Task | Critical | Open | SRV-APP-01 |
| ALR-00261 | 5h ago | Lateral Movement Detected | Medium | Resolved | SRV-APP-01 |
| ALR-00170 | 7h ago | C2 Beacon Activity | Low | Investigating | SRV-DC-01 |
| ALR-00488 | 12h ago | C2 Beacon Activity | Low | False Positive | WS-LAP-012 |