[SOC] 03:14:22 SCAN: Port sweep detected — src 10.0.3.41 [SOC] 03:14:23 ALERT: Brute-force SSH login attempt — threshold exceeded [SOC] 03:14:25 BLOCK: IP 192.168.44.12 added to deny-list [SOC] 03:14:27 AUDIT: Firewall rule #4421 applied — egress filtered [SOC] 03:14:30 INFO: SIEM correlation engine — 14 events merged [SOC] 03:14:32 WARN: Anomalous DNS query — entropy score 0.94 [SOC] 03:14:35 SCAN: Vulnerability assessment — CVE-2024-3094 check [SOC] 03:14:37 OK: Patch verification — kernel 6.8.1 confirmed [SOC] 03:14:40 ALERT: Lateral movement indicator — SMB relay detected [SOC] 03:14:42 CONTAIN: Endpoint isolated — host WIN-DC02 [SOC] 03:14:45 LOG: Threat intel feed updated — 2,847 IOCs ingested [SOC] 03:14:47 SCAN: TLS certificate expiry — 12 days remaining [SOC] 03:14:50 INFO: EDR heartbeat — 342 endpoints reporting [SOC] 03:14:52 ALERT: Phishing URL detected — quarantine applied [SOC] 03:14:55 AUDIT: Privileged account login — admin@med-srv01 [SOC] 03:14:57 OK: Backup integrity verified — SHA-256 match [SOC] 03:15:00 WARN: Unusual outbound traffic — port 8443 [SOC] 03:15:02 BLOCK: Malware signature match — Trojan.GenericKD [SOC] 03:15:05 INFO: Incident #1847 — status: investigating [SOC] 03:15:07 LOG: Network baseline recalculated — delta 0.3% [SOC] 03:14:22 SCAN: Port sweep detected — src 10.0.3.41 [SOC] 03:14:23 ALERT: Brute-force SSH login attempt — threshold exceeded [SOC] 03:14:25 BLOCK: IP 192.168.44.12 added to deny-list [SOC] 03:14:27 AUDIT: Firewall rule #4421 applied — egress filtered [SOC] 03:14:30 INFO: SIEM correlation engine — 14 events merged [SOC] 03:14:32 WARN: Anomalous DNS query — entropy score 0.94 [SOC] 03:14:35 SCAN: Vulnerability assessment — CVE-2024-3094 check [SOC] 03:14:37 OK: Patch verification — kernel 6.8.1 confirmed [SOC] 03:14:40 ALERT: Lateral movement indicator — SMB relay detected [SOC] 03:14:42 CONTAIN: Endpoint isolated — host WIN-DC02