C2 Beacon Activity
Low
Escalated
ALR-00358 · 2026-07-09T17:24:36Z
Description
Suspected C2 beacon detected from WS-LAP-010. Regular 60-second interval HTTPS POST to suspicious domain. DLP Module blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:24:36
Event ingested by SOC365 Engine
17:24:37
EmilyAI triage started — correlation enrichment
17:24:48
EmilyAI confidence: 82% — escalated to human analyst
17:25:05
Alert assigned to analyst: EmilyAI (auto)
17:26:59
Investigation started — querying SIEM and threat intelligence
17:32:49
Containment action taken — endpoint isolated
17:37:25
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00131 | 6h ago | Unusual Outbound Traffic | Medium | False Positive | WS-LAP-010 |
| ALR-00292 | 11h ago | C2 Beacon Activity | Informational | Resolved | WS-LAP-010 |
| ALR-00476 | 13h ago | C2 Beacon Activity | Low | False Positive | WS-PC-006 |
| ALR-00483 | 15h ago | Failed MFA Challenge | Informational | False Positive | WS-LAP-010 |
| ALR-00296 | 18h ago | Tor Exit Node Connection | Medium | Investigating | WS-LAP-010 |