Suspicious Scheduled Task
Medium
Open
ALR-00252 · 2026-07-10T23:50:37Z
Description
New scheduled task created on SRV-MAIL-01 by 'l.johnson' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
23:50:37
Event ingested by SOC365 Engine
23:50:40
EmilyAI triage started — correlation enrichment
23:50:49
EmilyAI confidence: 78% — escalated to human analyst
23:51:03
Alert assigned to analyst: James Okonkwo
23:52:32
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00017 | 9m ago | Suspicious Scheduled Task | Medium | Investigating | VM-DEV-01 |
| ALR-00361 | 1h ago | Suspicious Scheduled Task | Medium | Escalated | WS-PC-006 |
| ALR-00161 | 2h ago | Brute Force SSH | High | Escalated | SRV-MAIL-01 |
| ALR-00333 | 7h ago | Malware Signature Match | Low | Escalated | SRV-MAIL-01 |
| ALR-00068 | 10h ago | Privilege Escalation Attempt | Informational | Resolved | SRV-MAIL-01 |