Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:18 UTC

Rogue DHCP Server

High Investigating
ALR-00363 · 2026-10-07T09:48:25Z

Description

Rogue DHCP server detected on VLAN 10 from WS-PC-003. Offering IPs in unexpected range. Network IDS quarantined the device.

Alert Metadata

Alert ID
ALR-00363
Timestamp
2026-10-07T09:48:25Z
Severity
High
Status
Investigating
Detection Source
Network IDS
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
WS-PC-003
User Account
h.roberts
Source IP
91.37.195.58
Destination IP
10.2.124.146
Origin Country
BR Brazil

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

09:48:25 Event ingested by SOC365 Engine
09:48:26 EmilyAI triage started — correlation enrichment
09:48:32 EmilyAI confidence: 79% — escalated to human analyst
09:48:46 Alert assigned to analyst: Marcus Webb
09:50:13 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00422 3h ago Rogue DHCP Server Low Open SW-CORE-01
ALR-00473 6h ago Phishing Email Blocked Low Escalated WS-PC-003
ALR-00297 7h ago Shadow IT Discovery Informational Resolved WS-PC-003
ALR-00071 7h ago Rogue DHCP Server Medium Resolved WS-PC-006
ALR-00289 12h ago Rogue DHCP Server Low Investigating SW-CORE-01