Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 21:50:49 UTC

Anomalous DNS Query

High Escalated
ALR-00311 · 2026-07-08T05:14:37Z

Description

DNS query to known DGA-generated domain from SRV-DC-01. DecoyPulse matched pattern against threat intelligence feed. User: f.hall.

Alert Metadata

Alert ID
ALR-00311
Timestamp
2026-07-08T05:14:37Z
Severity
High
Status
Escalated
Detection Source
DecoyPulse
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-DC-01
User Account
f.hall
Source IP
45.1.148.17
Destination IP
10.2.178.54
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1568.002
Reference
attack.mitre.org/techniques/T1568.002

Investigation Timeline

05:14:37 Event ingested by SOC365 Engine
05:14:39 EmilyAI triage started — correlation enrichment
05:14:44 EmilyAI confidence: 95% — escalated to human analyst
05:15:22 Alert assigned to analyst: James Okonkwo
05:15:39 Investigation started — querying SIEM and threat intelligence
05:20:37 Containment action taken — endpoint isolated
05:29:42 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00290 5h ago Anomalous DNS Query High Open SRV-DC-01
ALR-00228 9h ago Suspicious Scheduled Task High Escalated SRV-DC-01
ALR-00047 10h ago Credential Stuffing Attempt Low False Positive SRV-DC-01
ALR-00349 17h ago Anomalous DNS Query Informational Open WS-PC-003
ALR-00460 18h ago Anomalous DNS Query Low Investigating WS-PC-003