Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:48:20 UTC

Anomalous DNS Query

Low Resolved
ALR-00314 · 2026-10-08T20:41:44Z

Description

DNS query to known DGA-generated domain from WS-MAC-005. Firewall matched pattern against threat intelligence feed. User: system.

Alert Metadata

Alert ID
ALR-00314
Timestamp
2026-10-08T20:41:44Z
Severity
Low
Status
Resolved
Detection Source
Firewall
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-MAC-005
User Account
system
Source IP
185.20.220.36
Destination IP
10.2.126.45
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1568.002
Reference
attack.mitre.org/techniques/T1568.002

Investigation Timeline

20:41:44 Event ingested by SOC365 Engine
20:41:46 EmilyAI triage started — correlation enrichment
20:41:54 EmilyAI confidence: 92% — escalated to human analyst
20:42:18 Alert assigned to analyst: EmilyAI (auto)
20:43:23 Investigation started — querying SIEM and threat intelligence
20:49:58 Containment action taken — endpoint isolated
20:58:12 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00304 3h ago Anomalous DNS Query Medium Investigating SW-CORE-01
ALR-00051 4h ago Anomalous DNS Query Low Escalated SRV-SQL-01
ALR-00387 5h ago Privilege Escalation Attempt High Investigating WS-MAC-005
ALR-00262 8h ago Data Exfiltration Attempt High Escalated WS-MAC-005
ALR-00189 12h ago Anomalous DNS Query Low Resolved SRV-APP-01