Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:40:31 UTC

Rogue DHCP Server

Medium Open
ALR-00487 · 2026-10-11T11:06:06Z

Description

Rogue DHCP server detected on VLAN 10 from SRV-APP-01. Offering IPs in unexpected range. DLP Module quarantined the device.

Alert Metadata

Alert ID
ALR-00487
Timestamp
2026-10-11T11:06:06Z
Severity
Medium
Status
Open
Detection Source
DLP Module
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
SRV-APP-01
User Account
f.hall
Source IP
194.31.62.166
Destination IP
10.2.155.148
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Discovery
Technique
T1557.003
Reference
attack.mitre.org/techniques/T1557.003

Investigation Timeline

11:06:06 Event ingested by SOC365 Engine
11:06:11 EmilyAI triage started — correlation enrichment
11:06:16 EmilyAI confidence: 92% — escalated to human analyst
11:06:46 Alert assigned to analyst: James Okonkwo
11:07:32 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00439 1h ago Rogue DHCP Server Medium False Positive WS-PC-001
ALR-00013 1h ago Credential Stuffing Attempt Informational Resolved SRV-APP-01
ALR-00306 3h ago Data Exfiltration Attempt Informational Investigating SRV-APP-01
ALR-00120 6h ago Suspicious Scheduled Task Informational False Positive SRV-APP-01
ALR-00308 7h ago Rogue DHCP Server High Open SW-CORE-01