Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:56:48 UTC

Certificate Anomaly

Low Resolved
ALR-00254 · 2026-10-06T20:18:12Z

Description

TLS certificate anomaly detected on WS-LAP-011. Self-signed certificate on port 443 does not match expected corporate CA chain.

Alert Metadata

Alert ID
ALR-00254
Timestamp
2026-10-06T20:18:12Z
Severity
Low
Status
Resolved
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-011
User Account
r.davies
Source IP
45.218.148.40
Destination IP
10.3.147.99
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Defence Evasion
Technique
T1553.004
Reference
attack.mitre.org/techniques/T1553.004

Investigation Timeline

20:18:12 Event ingested by SOC365 Engine
20:18:16 EmilyAI triage started — correlation enrichment
20:18:25 EmilyAI confidence: 86% — escalated to human analyst
20:18:42 Alert assigned to analyst: EmilyAI (auto)
20:21:00 Investigation started — querying SIEM and threat intelligence
20:24:09 Containment action taken — endpoint isolated
20:31:44 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00147 5h ago Certificate Anomaly Low Open WS-LAP-010
ALR-00223 6h ago Certificate Anomaly Informational False Positive WS-PC-004
ALR-00322 6h ago Certificate Anomaly Medium Escalated SRV-DC-01
ALR-00421 11h ago Certificate Anomaly Medium Open SW-CORE-01
ALR-00341 1d ago Brute Force SSH Medium Resolved WS-LAP-011