Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:06 UTC

Ransomware Behaviour Detected

Informational False Positive
ALR-00388 · 2026-10-06T23:28:43Z

Description

File encryption behaviour detected on WS-PC-006. 142 files renamed with .locked extension in 30 seconds. DecoyPulse isolated endpoint.

Alert Metadata

Alert ID
ALR-00388
Timestamp
2026-10-06T23:28:43Z
Severity
Informational
Status
False Positive
Detection Source
DecoyPulse
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-PC-006
User Account
c.williams
Source IP
103.240.216.110
Destination IP
10.3.230.11
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Impact
Technique
T1486
Reference
attack.mitre.org/techniques/T1486

Investigation Timeline

23:28:43 Event ingested by SOC365 Engine
23:28:44 EmilyAI triage started — correlation enrichment
23:28:53 EmilyAI confidence: 93% — escalated to human analyst
23:29:09 Alert assigned to analyst: EmilyAI (auto)
23:29:48 Investigation started — querying SIEM and threat intelligence
23:36:22 Containment action taken — endpoint isolated
23:39:46 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00382 11h ago Ransomware Behaviour Detected Low Resolved SRV-SQL-01
ALR-00186 14h ago Ransomware Behaviour Detected High Escalated SRV-APP-01
ALR-00471 16h ago Certificate Anomaly Low Investigating WS-PC-006
ALR-00110 23h ago Ransomware Behaviour Detected Informational Escalated WS-LAP-010
ALR-00281 1d ago Ransomware Behaviour Detected Medium Escalated VM-DEV-01