DecoyPulse Honeypot Triggered
Informational
False Positive
ALR-00452 · 2026-07-08T12:40:05Z
Description
DecoyPulse honeypot on FW-EDGE-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
12:40:05
Event ingested by SOC365 Engine
12:40:09
EmilyAI triage started — correlation enrichment
12:40:14
EmilyAI confidence: 80% — escalated to human analyst
12:40:25
Alert assigned to analyst: EmilyAI (auto)
12:42:27
Investigation started — querying SIEM and threat intelligence
12:48:45
Containment action taken — endpoint isolated
12:52:55
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00415 | 5h ago | Insider Threat Indicator | High | Investigating | FW-EDGE-01 |
| ALR-00141 | 6h ago | Privilege Escalation Attempt | Informational | Escalated | FW-EDGE-01 |
| ALR-00091 | 1d ago | DecoyPulse Honeypot Triggered | Medium | Investigating | WS-LAP-011 |
| ALR-00291 | 1d ago | C2 Beacon Activity | Low | Investigating | FW-EDGE-01 |
| ALR-00351 | 1d ago | DecoyPulse Honeypot Triggered | Low | Investigating | WS-PC-004 |