Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:08 UTC

Anomalous DNS Query

Informational Escalated
ALR-00429 · 2026-10-07T10:17:48Z

Description

DNS query to known DGA-generated domain from SRV-WEB-01. DLP Module matched pattern against threat intelligence feed. User: system.

Alert Metadata

Alert ID
ALR-00429
Timestamp
2026-10-07T10:17:48Z
Severity
Informational
Status
Escalated
Detection Source
DLP Module
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-WEB-01
User Account
system
Source IP
91.194.195.43
Destination IP
10.1.168.83
Origin Country
NG Nigeria

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1568.002
Reference
attack.mitre.org/techniques/T1568.002

Investigation Timeline

10:17:48 Event ingested by SOC365 Engine
10:17:50 EmilyAI triage started — correlation enrichment
10:18:03 EmilyAI confidence: 91% — escalated to human analyst
10:18:04 Alert assigned to analyst: EmilyAI (auto)
10:19:14 Investigation started — querying SIEM and threat intelligence
10:26:46 Containment action taken — endpoint isolated
10:30:19 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00497 35m ago Unusual Outbound Traffic Medium Investigating SRV-WEB-01
ALR-00347 1h ago Anomalous DNS Query Informational Resolved SRV-BACKUP-01
ALR-00086 4h ago Anomalous DNS Query Medium Investigating WS-PC-004
ALR-00359 6h ago Anomalous DNS Query High Escalated SRV-SQL-01
ALR-00397 11h ago Phishing Email Blocked Medium Open SRV-WEB-01