CriticalALERT-4207engine: heuristic

SYN Flood Detected

analyst review

Raw alert — normalized QRadar offense

asset: mail-relay-01
protocol: TCP :443
src_ip: 184.201.58.207
dest_ip: 10.20.5.9
magnitude: 8/10
severity: 9/10
credibility: 9/10
relevance: 9/10
src network: external
events / flows: 124,905 / 54,718

triggered rules

▹ DoS: Possible Network DoS Detected
▹ DoS: SYN Flood Against Single Destination

full offense JSON

{
  "offense_id": 4207,
  "description": "SYN Flood Detected :: DoS/DDoS targeting mail-relay-01",
  "offense_type": "Destination IP",
  "offense_source": "184.201.58.207",
  "magnitude": 8,
  "severity": 9,
  "credibility": 9,
  "relevance": 9,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 124905,
  "flow_count": 54718,
  "start_time": "2025-11-03T11:37:00+00:00",
  "last_updated_time": "2025-11-03T12:09:00+00:00",
  "categories": [
    "Denial of Service",
    "Network DoS Attack"
  ],
  "rules": [
    "DoS: Possible Network DoS Detected",
    "DoS: SYN Flood Against Single Destination"
  ],
  "assigned_to": null,
  "dest_port": 443
}

AI triage

Likely dos/ddos: SYN Flood Detected from external source 184.201.58.207 against mail-relay-01 (10.20.5.9) over TCP, 124,905 events observed.

MITRE ATT&CK

T1498Network Denial of ServiceImpactconfidence 95%

Alert indicators (SYN Flood Detected; rules: DoS: Possible Network DoS Detected) overlap most strongly with T1498 Network Denial of Service among the ATT&CK shortlist.

Priority — Critical

Scored Critical based on: QRadar magnitude 8/10; high severity (9/10); source is external to the network; credibility 9/10.

Recommended next steps

1.Confirm impact: is the destination service degraded or still responsive?
2.Identify whether traffic is from a single source or distributed; engage upstream/ISP scrubbing if distributed.
3.Apply rate-limiting / SYN-cookie protections on the targeted service.
4.Preserve NetFlow for the attack window for post-incident review.

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "184.201.58.207" and DestinationIP == "10.20.5.9"
| summarize Events=count() by DestinationPort, Protocol
| order by Events desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1498Network Denial of Service·13.5T1499Endpoint Denial of Service·11.5T1498.001Direct Network Flood·8T1499.001OS Exhaustion Flood·7.5T1499.002Service Exhaustion Flood·7T1499.003Application Exhaustion Flood·5.5T1046Network Service Discovery·4