Incidents
SCM-TP-2290HighContainedTrue Positive91%
Outbound C2 attempts to 185.220.101.47 blocked by Advanced Threat Prevention
Affected: ENG-WS-087, ENG-WS-131NGFWPrisma AccessUpdated 06:49 PT · Owner AI SOC
AI summary
Threat ID 86xxx (Cobalt Strike Malleable C2) reset-both on HQ-FW-01 and Prisma Access MU. Linked to XDR-4821.
Verdict
True Positive91%
Customer-approved model · AWS GovCloud (us-gov-west-1) · inside Halcyon's account. Time to verdict 47s.