Anomalous DNS Query
Low
Open
ALR-00499 · 2026-07-11T11:14:44Z
Description
DNS query to known DGA-generated domain from VM-DEV-01. Cloud Connector matched pattern against threat intelligence feed. User: j.smith.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:14:44
Event ingested by SOC365 Engine
11:14:45
EmilyAI triage started — correlation enrichment
11:14:49
EmilyAI confidence: 86% — escalated to human analyst
11:15:05
Alert assigned to analyst: EmilyAI (auto)
11:16:01
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00433 | 1h ago | Data Exfiltration Attempt | Low | Resolved | VM-DEV-01 |
| ALR-00149 | 1h ago | Certificate Anomaly | Informational | Open | VM-DEV-01 |
| ALR-00475 | 8h ago | Anomalous DNS Query | Medium | False Positive | WS-PC-004 |
| ALR-00180 | 9h ago | Malware Signature Match | Low | Resolved | VM-DEV-01 |
| ALR-00113 | 10h ago | Unauthorised USB Device | Critical | Open | VM-DEV-01 |