Anomalous DNS Query
Low
Open
ALR-00256 · 2026-07-07T00:00:36Z
Description
DNS query to known DGA-generated domain from WS-PC-003. DLP Module matched pattern against threat intelligence feed. User: d.walker.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:00:36
Event ingested by SOC365 Engine
00:00:41
EmilyAI triage started — correlation enrichment
00:00:48
EmilyAI confidence: 97% — escalated to human analyst
00:00:52
Alert assigned to analyst: EmilyAI (auto)
00:03:13
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00073 | 5h ago | Anomalous DNS Query | Medium | Escalated | SRV-SQL-01 |
| ALR-00417 | 8h ago | Anomalous DNS Query | High | Open | WS-PC-002 |
| ALR-00467 | 12h ago | Anomalous DNS Query | Medium | Open | SRV-APP-01 |
| ALR-00463 | 16h ago | Certificate Anomaly | Low | False Positive | WS-PC-003 |
| ALR-00018 | 21h ago | Shadow IT Discovery | Medium | Open | WS-PC-003 |