Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:40:24 UTC

Rogue DHCP Server

Informational False Positive
ALR-00271 · 2026-10-05T06:25:46Z

Description

Rogue DHCP server detected on VLAN 10 from SRV-APP-01. Offering IPs in unexpected range. Cloud Connector quarantined the device.

Alert Metadata

Alert ID
ALR-00271
Timestamp
2026-10-05T06:25:46Z
Severity
Informational
Status
False Positive
Detection Source
Cloud Connector
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-APP-01
User Account
j.smith
Source IP
45.50.148.87
Destination IP
10.0.149.106
Origin Country
RO Romania

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

06:25:46 Event ingested by SOC365 Engine
06:25:50 EmilyAI triage started — correlation enrichment
06:25:54 EmilyAI confidence: 81% — escalated to human analyst
06:26:25 Alert assigned to analyst: EmilyAI (auto)
06:26:55 Investigation started — querying SIEM and threat intelligence
06:28:49 Containment action taken — endpoint isolated
06:36:03 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00439 1h ago Rogue DHCP Server Medium False Positive WS-PC-001
ALR-00013 1h ago Credential Stuffing Attempt Informational Resolved SRV-APP-01
ALR-00306 3h ago Data Exfiltration Attempt Informational Investigating SRV-APP-01
ALR-00120 6h ago Suspicious Scheduled Task Informational False Positive SRV-APP-01
ALR-00308 7h ago Rogue DHCP Server High Open SW-CORE-01