Rogue DHCP Server
Informational
Open
ALR-00457 · 2026-07-09T03:31:23Z
Description
Rogue DHCP server detected on VLAN 10 from WS-LAP-012. Offering IPs in unexpected range. DLP Module quarantined the device.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
03:31:23
Event ingested by SOC365 Engine
03:31:28
EmilyAI triage started — correlation enrichment
03:31:34
EmilyAI confidence: 98% — escalated to human analyst
03:31:49
Alert assigned to analyst: EmilyAI (auto)
03:33:48
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00222 | 15m ago | Anomalous DNS Query | Medium | Investigating | WS-LAP-012 |
| ALR-00464 | 1h ago | Certificate Anomaly | Low | Escalated | WS-LAP-012 |
| ALR-00109 | 5h ago | DLP Policy Violation | Low | False Positive | WS-LAP-012 |
| ALR-00092 | 12h ago | Rogue DHCP Server | Low | Investigating | SRV-DC-01 |
| ALR-00488 | 12h ago | C2 Beacon Activity | Low | False Positive | WS-LAP-012 |