Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:48:41 UTC

DecoyPulse Honeypot Triggered

Low Resolved
ALR-00472 · 2026-10-10T19:20:35Z

Description

DecoyPulse honeypot on SRV-MAIL-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.

Alert Metadata

Alert ID
ALR-00472
Timestamp
2026-10-10T19:20:35Z
Severity
Low
Status
Resolved
Detection Source
Email Gateway
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-MAIL-01
User Account
s.jones
Source IP
103.14.216.39
Destination IP
10.2.31.83
Origin Country
GB United Kingdom

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1018
Reference
attack.mitre.org/techniques/T1018

Investigation Timeline

19:20:35 Event ingested by SOC365 Engine
19:20:38 EmilyAI triage started — correlation enrichment
19:20:49 EmilyAI confidence: 81% — escalated to human analyst
19:20:50 Alert assigned to analyst: EmilyAI (auto)
19:23:34 Investigation started — querying SIEM and threat intelligence
19:25:08 Containment action taken — endpoint isolated
19:36:10 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00149 5h ago DecoyPulse Honeypot Triggered Informational False Positive WS-LAP-010
ALR-00489 6h ago DecoyPulse Honeypot Triggered Medium Investigating WS-LAP-011
ALR-00041 8h ago Ransomware Behaviour Detected Low Open SRV-MAIL-01
ALR-00277 10h ago Phishing Email Blocked Informational Escalated SRV-MAIL-01
ALR-00229 12h ago Brute Force SSH Informational Escalated SRV-MAIL-01