C2 Beacon Activity
Informational
Open
ALR-00411 · 2026-07-10T05:36:59Z
Description
Suspected C2 beacon detected from WS-PC-004. Regular 60-second interval HTTPS POST to suspicious domain. Endpoint Agent blocked outbound.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
05:36:59
Event ingested by SOC365 Engine
05:37:00
EmilyAI triage started — correlation enrichment
05:37:09
EmilyAI confidence: 79% — escalated to human analyst
05:37:38
Alert assigned to analyst: EmilyAI (auto)
05:37:52
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00356 | 2h ago | Anomalous DNS Query | Medium | Open | WS-PC-004 |
| ALR-00285 | 2h ago | Port Scan Detected | Low | False Positive | WS-PC-004 |
| ALR-00390 | 3h ago | C2 Beacon Activity | Low | Open | SRV-DC-01 |
| ALR-00150 | 9h ago | Shadow IT Discovery | Informational | Investigating | WS-PC-004 |
| ALR-00019 | 23h ago | Failed MFA Challenge | Medium | Resolved | WS-PC-004 |