Triage Queue
Raw security alerts, triaged by AI: ATT&CK mapping, priority with reasoning, recommended next steps, and a hunting query. Reviewed like a junior analyst's queue.
engine: heuristicview overview →
18
Alerts triaged
3
Critical
8
High
7
ATT&CK tactics
18 / 18
priorityalertATT&CKassetstatus
- CriticalSYN Flood DetectedLikely dos/ddos: SYN Flood Detected from external source 184.201.58.207 against mail-relay-01 (10.20.5.9) over TCP, 124,905 events observed.T1498Impactmail-relay-01● unreviewed
- CriticalSensitive Data Egress Over HTTPSLikely data exfiltration: Sensitive Data Egress Over HTTPS from internal host 10.22.7.99 against mail-relay-01 (10.20.5.9) over DNS, 4,671 events observed.T1048Exfiltrationmail-relay-01● unreviewed
- CriticalUnusual Admin Share Access Across HostsLikely port scan: Unusual Admin Share Access Across Hosts from internal host 10.47.7.248 against billing-app-01 (10.20.6.21) over TCP, 458 events observed.T1219Command and Controlbilling-app-01● unreviewed
- HighMeterpreter Reverse Shell PatternLikely port scan: Meterpreter Reverse Shell Pattern from internal host 10.26.9.109 against billing-app-01 (10.20.6.21) over TCP, 764 events observed.T1071Command and Controlbilling-app-01● unreviewed
- HighPossible DNS Tunneling DetectedLikely data exfiltration: Possible DNS Tunneling Detected from internal host 10.26.6.28 against dc-01-domain-controller (10.20.2.10) over DNS, 1,011 events observed.T1048Exfiltrationdc-01-domain-controller● unreviewed
- HighRDP Failed Logins Threshold ExceededLikely brute force: RDP Failed Logins Threshold Exceeded from external source 98.79.243.215 against vpn-gw-01 (10.20.1.2) over TCP, 3,110 events observed.T1110Credential Accessvpn-gw-01● unreviewed
- HighDirectory Traversal Against Web ServerLikely web attack: Directory Traversal Against Web Server from external source 156.240.2.115 against vpn-gw-01 (10.20.1.2) over HTTP, 214 events observed.T1190Initial Accessvpn-gw-01● unreviewed
- HighSuspected Lateral Movement (SMB)Likely port scan: Suspected Lateral Movement (SMB) from internal host 10.33.7.94 against mail-relay-01 (10.20.5.9) over TCP, 162 events observed.T1570Lateral Movementmail-relay-01● unreviewed
- HighSensitive Data Egress Over HTTPSLikely data exfiltration: Sensitive Data Egress Over HTTPS from internal host 10.34.1.246 against dc-01-domain-controller (10.20.2.10) over DNS, 8,617 events observed.T1048Exfiltrationdc-01-domain-controller● unreviewed
- HighSSH Brute Force Against ServerLikely brute force: SSH Brute Force Against Server from external source 200.84.16.143 against billing-app-01 (10.20.6.21) over TCP, 1,116 events observed.T1110Credential Accessbilling-app-01● unreviewed
- HighUDP Amplification FloodLikely dos/ddos: UDP Amplification Flood from external source 104.18.48.58 against web-prod-01 (10.20.4.11) over TCP, 331,168 events observed.T1498Impactweb-prod-01● unreviewed
- MediumCommunication With Known Botnet IPLikely bot: Communication With Known Botnet IP from internal host 10.41.9.24 against vpn-gw-01 (10.20.1.2) over TCP, 576 events observed.T1071Command and Controlvpn-gw-01● unreviewed
- MediumHorizontal Port Scan DetectedLikely port scan: Horizontal Port Scan Detected from external source 146.62.77.226 against file-srv-02 (10.20.4.30) over TCP, 925 events observed.T1595Reconnaissancefile-srv-02● unreviewed
- LowPolicy Violation: Unapproved Cloud StorageLikely port scan: Policy Violation: Unapproved Cloud Storage from internal host 10.22.9.77 against hmi-station-03 (10.50.3.44) over TCP, 17 events observed.T1590Reconnaissancehmi-station-03● unreviewed
- LowNmap SYN Scan From Single HostLikely port scan: Nmap SYN Scan From Single Host from external source 57.56.179.38 against billing-app-01 (10.20.6.21) over TCP, 2,043 events observed.T1595Reconnaissancebilling-app-01● unreviewed
- LowNmap SYN Scan From Single HostLikely port scan: Nmap SYN Scan From Single Host from external source 18.65.37.198 against file-srv-02 (10.20.4.30) over TCP, 2,388 events observed.T1595Reconnaissancefile-srv-02● unreviewed
- InformationalSingle User Multiple Failed Logins (Typo)Likely port scan: Single User Multiple Failed Logins (Typo) from internal host 10.34.2.65 against billing-app-01 (10.20.6.21) over TCP, 17 events observed.T1590Reconnaissancebilling-app-01● unreviewed
- InformationalSingle User Multiple Failed Logins (Typo)Likely port scan: Single User Multiple Failed Logins (Typo) from internal host 10.45.8.208 against file-srv-02 (10.20.4.30) over TCP, 30 events observed.T1590Reconnaissancefile-srv-02● unreviewed