Anomalous DNS Query
Low
False Positive
ALR-00304 · 2026-07-11T09:24:02Z
Description
DNS query to known DGA-generated domain from VM-DEV-01. EmilyAI Triage matched pattern against threat intelligence feed. User: h.roberts.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
09:24:02
Event ingested by SOC365 Engine
09:24:03
EmilyAI triage started — correlation enrichment
09:24:17
EmilyAI confidence: 98% — escalated to human analyst
09:24:30
Alert assigned to analyst: EmilyAI (auto)
09:25:12
Investigation started — querying SIEM and threat intelligence
09:32:39
Containment action taken — endpoint isolated
09:39:46
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00438 | 23h ago | Malware Signature Match | Low | Investigating | VM-DEV-01 |
| ALR-00327 | 1d ago | Anomalous DNS Query | High | Escalated | SRV-SQL-01 |
| ALR-00039 | 1d ago | Anomalous DNS Query | Medium | Investigating | WS-PC-003 |
| ALR-00370 | 1d ago | Privilege Escalation Attempt | Low | Open | VM-DEV-01 |
| ALR-00202 | 1d ago | Anomalous DNS Query | Medium | Open | WS-PC-002 |