Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:49:41 UTC

Rogue DHCP Server

Medium False Positive
ALR-00426 · 2026-10-07T22:33:51Z

Description

Rogue DHCP server detected on VLAN 10 from SRV-MAIL-01. Offering IPs in unexpected range. EmilyAI Triage quarantined the device.

Alert Metadata

Alert ID
ALR-00426
Timestamp
2026-10-07T22:33:51Z
Severity
Medium
Status
False Positive
Detection Source
EmilyAI Triage
Assigned Analyst
Sarah Chen

Endpoint Information

Hostname
SRV-MAIL-01
User Account
n.clark
Source IP
103.176.216.69
Destination IP
10.1.167.180
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

22:33:51 Event ingested by SOC365 Engine
22:33:56 EmilyAI triage started — correlation enrichment
22:34:00 EmilyAI confidence: 95% — escalated to human analyst
22:34:18 Alert assigned to analyst: Sarah Chen
22:36:13 Investigation started — querying SIEM and threat intelligence
22:43:12 Containment action taken — endpoint isolated
22:48:03 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00059 5h ago Rogue DHCP Server Informational Escalated WS-PC-002
ALR-00460 7h ago Failed MFA Challenge Medium Escalated SRV-MAIL-01
ALR-00455 9h ago Rogue DHCP Server Medium Investigating WS-PC-003
ALR-00442 11h ago Rogue DHCP Server High Escalated WS-MAC-005
ALR-00133 1d ago Suspicious Scheduled Task Low Investigating SRV-MAIL-01