Incident Workspace: INC-2026-0815

SecOps Admin (Enterprise SuperAdmin)HIGH • OPEN

Suspected Emotet C2 Ingress via Workstation Subnet • Correlated from 2 active alerts with threat telemetry.

Chronological Forensic Timeline

High-Severity C2 Beacon Detected18:42:10 UTC

Internal endpoint established communication with malicious IOC 185.220.101.4.

Automated Scoring & Incident Correlation18:42:15 UTC

ThreatLens correlation engine created incident cluster for 185.220.101.4.

Containment Checklist

Isolate affected internal host at EDR layerPush edge firewall block for 185.220.101.4Revoke associated session tokens and credentialsTrigger SIEM correlation rule backtrace (last 48h)