C2 Beacon Activity
Medium
Investigating
ALR-00340 · 2026-07-09T17:07:10Z
Description
Suspected C2 beacon detected from WS-MAC-005. Regular 60-second interval HTTPS POST to suspicious domain. Network IDS blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:07:10
Event ingested by SOC365 Engine
17:07:11
EmilyAI triage started — correlation enrichment
17:07:16
EmilyAI confidence: 89% — escalated to human analyst
17:07:36
Alert assigned to analyst: Marcus Webb
17:08:22
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00043 | 8h ago | Anomalous DNS Query | Informational | Resolved | WS-MAC-005 |
| ALR-00015 | 10h ago | Shadow IT Discovery | High | Escalated | WS-MAC-005 |
| ALR-00129 | 21h ago | Privilege Escalation Attempt | Low | Open | WS-MAC-005 |
| ALR-00242 | 1d ago | Rogue DHCP Server | Informational | False Positive | WS-MAC-005 |
| ALR-00144 | 1d ago | Rogue DHCP Server | Low | Escalated | WS-MAC-005 |