DecoyPulse Honeypot Triggered
Medium
Open
ALR-00388 · 2026-07-06T19:43:05Z
Description
DecoyPulse honeypot on SRV-WEB-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
19:43:05
Event ingested by SOC365 Engine
19:43:10
EmilyAI triage started — correlation enrichment
19:43:17
EmilyAI confidence: 88% — escalated to human analyst
19:43:26
Alert assigned to analyst: Sarah Chen
19:44:20
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00379 | 5h ago | DLP Policy Violation | Informational | Open | SRV-WEB-01 |
| ALR-00302 | 6h ago | DecoyPulse Honeypot Triggered | Informational | Resolved | WS-LAP-010 |
| ALR-00119 | 14h ago | Kerberoasting Attempt | Informational | False Positive | SRV-WEB-01 |
| ALR-00289 | 1d ago | Port Scan Detected | Informational | False Positive | SRV-WEB-01 |
| ALR-00139 | 1d ago | Suspicious PowerShell Execution | Low | False Positive | SRV-WEB-01 |