Dunia Canggih SOC · Remote
Syarikat Contoh Sdn Bhd
Open cases
2
1 × P2 · 1 × P3 · 0 × P1
Log sources reporting
37 / 37
Last silent source: VPN-HQ, 04 Nov, 3 hrs
P1/P2 triaged in SLA
100%
3 of 3 this month · median 5 min
Time to contain Nov, median
8 min
From confirmation · target 60 min (P1)
Alerts per hour · last 24 hours after automatic de-duplication
Closed as false positive or benignInvestigatedBecame an incident
Alert funnel Nov to date
Open cases SLA timers
| Severity | Case | Since | Triaged | Status |
|---|---|---|---|---|
| P2 | Malicious macro executed on FIN-LT-07 Defender for Endpoint · user nadia.h · T1204.002 | 02:04 | 02:08 (4 min) | Laptop isolated 02:09 per Authorisation · IT on-call called 02:12 · next update 06:00 |
| P3 | Password spray against 41 accounts Entra ID · 3 source IPs · T1110.003 | Wed 21:40 | 22:31 (51 min) | No successful sign-in · IPs blocked · client asked to confirm MFA on 2 accounts |
Containment actions · last 7 days
| When | Action | State |
|---|---|---|
| Thu 02:09 | Isolate FIN-LT-07 Authorisation item C1 · no call needed | ACTIVE |
| Wed 22:35 | Block 3 IPs on FW-HQ-01 Item C4 · auto-expires 30 days | ACTIVE |
| Mon 10:12 | Quarantine "DHL notice" email ×14 Item C5 | DONE |
| Fri 15:40 | Disable account intern.03 Item C2 · called IT first (VIP list) | LIFTED |
AI assistant · open P2 on FIN-LT-07 evidence gathered, analyst decides
Correlated
4 alerts into 1 case: Word spawned PowerShell, encoded command, outbound HTTPS to a 2-day-old domain, new scheduled task. Started 02:04:11.
Enriched
Attachment "Penyata_Okt.docm" from an external sender at 01:58; 3 other mailboxes received it, none opened. Domain flagged by 2 threat feeds as a loader host.
Suggested
Verdict: malicious High. Severity P2 (one host, no lateral movement seen). ATT&CK T1204.002, T1059.001, T1053.005.
Analyst actions
Confirmed 02:08. Isolated the laptop (C1), quarantined the email from 4 mailboxes (C5), blocked the domain (C4). AI is now checking all hosts for the same domain: 0 hits.
Log sources by type
Top blocked threats last 7 days
| Phishing emails quarantined | 62 |
| Connections to known-bad IPs blocked | 1,940 |
| Failed sign-ins from password sprays | 1,312 |
| Malware blocked by EDR | 5 |
| VPN logins from blocked countries | 88 |
Incidents this month
| P1 | Finance mailbox taken over, fake payment request sent 03 Nov · contained in 2 min · SIR-2026-011 |
| P2 | Infostealer on contractor laptop 07 Nov · isolated · rebuilt by IT |
| P2 | Malicious macro on FIN-LT-07 12 Nov · open |