Difference between revisions of "Event Records"

From Observer GigaFlow Support | VIAVI Solutions Inc.
Jump to: navigation, search
(→‎What is Recorded?)
 
(48 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 +
[[Category:Database]]
 +
[[Category:Scripts]]
 
An Observer GigaFlow Event is a record that is created when a monitored flow pattern matches certain criteria.  
 
An Observer GigaFlow Event is a record that is created when a monitored flow pattern matches certain criteria.  
  
Line 11: Line 13:
 
* A connected device that stops sending flows.
 
* A connected device that stops sending flows.
  
−
[http://wiki.anuview.net/manual/glossary.html See the Event definition in the Glossary]
+
[http://gigaflowsupport.viavisolutions.com/manual/glossary.html See the Event definition in the Glossary]
−
[http://wiki.anuview.net/manual/events.html and the main entry for Events in the Reference Manual]
+
[http://gigaflowsupport.viavisolutions.com/manual/events.html and the main entry for Events in the Reference Manual]
  
 
== What is Recorded? ==
 
== What is Recorded? ==
  
−
All GigaFlow flow records contain 29 fields or table columns. In the '''myipfix''' database associated with the GigaFlow installation, the '''netflow''' tables contain all flow records. See [http://wiki.anuviewsoftware.com/index.php/Flow_Record_Fields Flow Record Fields] for the complete list.   
+
All GigaFlow flow records contain 29 fields or table columns. In the '''myipfix''' database associated with the GigaFlow installation, the '''netflow''' tables contain all flow records. See [http://gigaflowsupport.viavisolutions.com/index.php/Flow_Record_Fields Flow Record Fields] for the complete list.   
  
−
Similarly, the Events tables contain all the Event records. See [http://wiki.anuviewsoftware.com/index.php/Event_Record_Fields Event Record Fields] for a complete list with descriptions. The Event record fields are:  
+
Similarly, the Events tables contain all the Event records. See [http://gigaflowsupport.viavisolutions.com/index.php/Event_Record_Fields Event Record Fields] for a complete list with descriptions. The Event record fields are:  
  
−
id, customerid, device, firstseen, eventtype, eventsrctype, eventsrc, message, datatype, data, datasource, confidence, severity, category, target, country_src, division_src, latit_src, longd_src, country_dst, division_dst, latit_dst,  
+
<code>
−
longd_dst
+
id, customerid, device, firstseen, eventtype, eventsrctype, eventsrc, message, datatype, data, datasource, confidence, severity, category, target, country_src, division_src, latit_src, longd_src, country_dst, division_dst, latit_dst, longd_dst
−
 
+
</code>
−
Three events have both '''eventtype''' and '''posture''' set in the database, i.e. these three event types can be determined immediately from Netflow records:
+
  
 +
Three events have both '''eventtype''' and '''posture''' set in the '''netflow''' and '''event''' tables in the database, i.e. these three event types can be determined immediately from Netflow records:
  
 
{| class="wikitable" style="text-align: left;"
 
{| class="wikitable" style="text-align: left;"
Line 30: Line 32:
 
|'''Type'''   
 
|'''Type'''   
 
|'''Code'''
 
|'''Code'''
 +
|'''Description'''
 
|-
 
|-
 
| postureBlackListSrc
 
| postureBlackListSrc
 
| int
 
| int
 
| -11
 
| -11
 +
| Attempted access by blacklisted resources. See also [http://gigaflowsupport.viavisolutions.com/manual/watchlists.html Watchlists in the Reference Manual].
 
|-
 
|-
 
| postureBlackListDst
 
| postureBlackListDst
 
| int
 
| int
 
| -12
 
| -12
 +
| Attempted access to blacklisted resources. See also [http://gigaflowsupport.viavisolutions.com/manual/watchlists.html Watchlists in the Reference Manual].
 
|-
 
|-
 
| profilerException
 
| profilerException
 
| int
 
| int
 
| -20
 
| -20
 +
| Profile exceptions, i.e. GigaFlow administrator-defined behaviours deviating from norms. See also [http://gigaflowsupport.viavisolutions.com/manual/configurationprofiling.html Profiling in the Reference Manual].
 
|}
 
|}
  
−
In addition, all of these event types have only '''eventtype''' set, i.e. these event types are classified with additional information or information from many records:
+
In addition, all of these event types have only '''eventtype''' set in the '''event''' tables, i.e. these event types are classified with additional information or information from many records and have no '''postureid''' set in the '''netflow''' tables:
  
 
{| class="wikitable" style="text-align: left;"
 
{| class="wikitable" style="text-align: left;"
Line 50: Line 56:
 
|'''Type'''   
 
|'''Type'''   
 
|'''Code'''
 
|'''Code'''
 +
|'''Description'''
 
|-
 
|-
 
| synSrc
 
| synSrc
 
| int
 
| int
 
| -100
 
| -100
 +
| SYN Source Network Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synSrcPortException
 
| synSrcPortException
 
| int
 
| int
 
| -101
 
| -101
 +
| SYN Source Port Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synSrcIPException
 
| synSrcIPException
 
| int
 
| int
 
| -102
 
| -102
 +
| SYN Source Unreachable IP. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synSrcIPAndPortException
 
| synSrcIPAndPortException
 
| int
 
| int
 
| -103
 
| -103
 +
| SYN Source Network And Port Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synDst
 
| synDst
 
| int
 
| int
 
| -120
 
| -120
 +
| SYN Destination Network Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synDstPortException
 
| synDstPortException
 
| int
 
| int
 
| -121
 
| -121
 +
| SYN Destination Port Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synDstIPException
 
| synDstIPException
 
| int
 
| int
 
| -122
 
| -122
 +
| SYN Destination Unreachable Server. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| synDstIPAndPortException
 
| synDstIPAndPortException
 
| int
 
| int
 
| -123
 
| -123
 +
| SYN Destination Network And Port Sweep. See also [http://gigaflowsupport.viavisolutions.com/manual/systemwidereports.html#synforensicsmonitoring SYN Forensics Monitoring in the Reference Manual].
 
|-
 
|-
 
| lldpNewNeighbour
 
| lldpNewNeighbour
 
| int
 
| int
 
| -130
 
| -130
 +
| A new connected device sending flows.
 
|-  
 
|-  
 
| lldpLostNeighbour
 
| lldpLostNeighbour
 
| int
 
| int
 
| -131
 
| -131
 +
| A lost neighbour.
 
|-  
 
|-  
 
| deviceRestartsSendingFlows
 
| deviceRestartsSendingFlows
 
| int
 
| int
 
| -150
 
| -150
 +
| A connected device that stopped sending flows restarts sending flows.
 
|-  
 
|-  
 
| deviceStopsSendingFlows
 
| deviceStopsSendingFlows
 
| int
 
| int
 
| -151
 
| -151
 +
| A connected device that stops sending flows.
 
|}
 
|}
  
Line 104: Line 123:
 
Data can be accessed:
 
Data can be accessed:
  
−
# As a normal user, via the GigaFlow interface. See [http://wiki.anuview.net/manual/events.html Events in the Reference Manual].
+
# As a normal user, via the GigaFlow interface. See [http://gigaflowsupport.viavisolutions.com/manual/events.html Events in the Reference Manual].
−
# As an automated portal user, via the GigaFlow API. See [http://wiki.anuviewsoftware.com/index.php/Forensics/APIs/forensics Forensic Data Using the API].
+
# As an automated portal user, via the GigaFlow API. See [http://gigaflowsupport.viavisolutions.com/index.php/Forensics/APIs/forensics Forensic Data Using the API].
 
# From the database directly using a viewer such as [https://www.pgadmin.org/ pgAdmin] or in code using a [https://wiki.postgresql.org/ postgreSQL] connector such as [https://wiki.postgresql.org/wiki/Psycopg2_Tutorial Psycopg2] for Python.
 
# From the database directly using a viewer such as [https://www.pgadmin.org/ pgAdmin] or in code using a [https://wiki.postgresql.org/ postgreSQL] connector such as [https://wiki.postgresql.org/wiki/Psycopg2_Tutorial Psycopg2] for Python.
  
 
== Sample Records ==
 
== Sample Records ==
  
−
Typical records from an Event table:
+
See [http://gigaflowsupport.viavisolutions.com/index.php/Event_Record_Fields#Sample_Records Event Record Fields for some typical records from an Event table with obfuscated IP addresses and locations]. As an example:
  
−
* 805729  0              "-1407899398"  "1541583542242"            -11         8              "60.165.208.28"                "Black List Src Hit(Botnet Strong) 60.165.208.28->77.95.166.159"            1              "{"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/strongips.txt","Black List Type":"Source","Eventer":"60.165.208.28","appid":393238,"bytes":44,"device":"172.21.40.250","domain":"","dstadd":"77.95.166.159","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"60.165.208.28","srcport":28148,"time":1541583574022,"timeH":"7-Nov-2018 09:39:34.22","tos":0,"user":""}"            "https://lists.blocklist.de/lists/strongips.txt"      75          80                "Botnet Strong" "77.95.166.159"                "CN"      "Gansu"              "36.05640000000"            "103.79220000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
'''postureBlackListSrc (-11)'''
  
−
* 805738  0              "29885185"        "1541583568627"            -120      8              "Many" "Syn Dst Unreachable Server 1.3.80.248->91.220.45.208"          1              "{"Application":"HTTP TCP/80","Eventer":"91.220.45.208","Syn Type":"Destination","appid":393296,"bytes":44,"device":"1.200.3.1","domain":"","dstadd":"91.220.45.208","dstport":80,"duration":0,"eventname":"Syn Dst Unreachable Server","flags":2,"fwevent":0,"fwextcode":0,"inif":8,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":3,"packets":1,"proto":6,"srcadd":"1.3.80.248","srcport":54028,"time":1541583584143,"timeH":"7-Nov-2018 09:39:44.143","tos":32,"user":""}"        "Syn Destination"            100        100        "Syn Dst Unreachable Server"                "91.220.45.208"                "CN"      "Guangdong"    "23.11670000000"            "113.25000000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
Cut and pasted directly from an Events table:
  
−
* 805752 0             "-1407899398"  "1541583572146"            -100      8              "5.188.86.55"     "Syn Src Port Sweep 5.188.86.55->88.151.85.74"         1             "{"Application":"TCP/3392","Eventer":"5.188.86.55","Syn Type":"Source","appid":396608,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.74","dstport":3392,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"5.188.86.55","srcport":43017,"time":1541583603834,"timeH":"7-Nov-2018 09:40:03.834","tos":40,"user":""}"       "Syn Source"     100        100        "Syn Src Port Sweep"     "Many" "RU"               "St.-Petersburg"              "59.89440000000"            "30.26420000000"           "IE"        "County Sligo"               "54.26670000000"            "-8.48330000000"
+
<code>
 +
805729 0 "-1407899398"  "1541583542242"            -11          8              "xxx.xxx.208.28"                 "Black List Src Hit(Botnet Strong) xxx.xxx.208.28->xxx.xxx.166.159"             1 {"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/strongips.txt","Black List Type":"Source","Eventer":"xxx.xxx.208.28","appid":393238,"bytes":44,"device":"xxx.xxx.40.250","domain":"","dstadd":"xx.xxx.166.159","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"xxx.xxx.208.28","srcport":28148,"time":1541583574022,"timeH":"7-Nov-2018 09:39:34.22","tos":0,"user":""}"           "https://lists.blocklist.de/lists/strongips.txt"       75          80                "Botnet Strong" "xxx.xxx.166.159"                 "CN"     "Gansu"              "0.00000000000"            "0.00000000000"               "IE"        "County Sligo"   "0.00000000000"            "0.00000000000"
 +
</code>
  
−
* 805763  0              "-1407899398"  "1541583582509"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->88.151.82.184"            1              "{"Application":"TCP/28017","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":421233,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.82.184","dstport":28017,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":58022,"time":1541583614309,"timeH":"7-Nov-2018 09:40:14.309","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "88.151.82.184"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Monaghan"        "54.27030000000"            "-6.88970000000"
+
Arranged more neatly in a table:
  
−
* 805774  0              "-1407899398"  "1541583591747"            -11          8              "66.240.219.146"              "Black List Src Hit(Botnet IMAP) 66.240.219.146->88.151.84.157"            1              "{"Application":"TCP/9999","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"66.240.219.146","appid":403215,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.84.157","dstport":9999,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"66.240.219.146","srcport":36877,"time":1541583622771,"timeH":"7-Nov-2018 09:40:22.771","tos":40,"user":""}"        "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "88.151.84.157"                "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"
+
{| class="wikitable" style="text-align: left;"
−
 
+
|'''Record Field'''
−
* 805775  0              "29885185"        "1541583607043"            -120      8              "Many" "Syn Dst Unreachable Server 1.3.38.248->91.220.45.221"          1              "{"Application":"HTTP TCP/80","Eventer":"91.220.45.221","Syn Type":"Destination","appid":393296,"bytes":44,"device":"1.200.3.1","domain":"","dstadd":"91.220.45.221","dstport":80,"duration":0,"eventname":"Syn Dst Unreachable Server","flags":2,"fwevent":0,"fwextcode":0,"inif":8,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":3,"packets":1,"proto":6,"srcadd":"1.3.38.248","srcport":14126,"time":1541583622843,"timeH":"7-Nov-2018 09:40:22.843","tos":32,"user":""}"        "Syn Destination"            100        100        "Syn Dst Unreachable Server"                "91.220.45.221"                "CN"      "Guangdong"    "23.11670000000"            "113.25000000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
|'''Value'''
−
 
+
|-
−
* 805776  0              "-1407899398"  "1541583563149"            -11          8              "17.130.74.5"    "Black List Src Hit(Apache(WWW) Scan/Brute) 17.130.74.5->77.95.163.93"        1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"17.130.74.5","appid":393659,"bytes":6351,"device":"172.21.40.250","domain":"","dstadd":"77.95.163.93","dstport":55574,"duration":25600,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":20,"proto":6,"srcadd":"17.130.74.5","srcport":443,"time":1541583625793,"timeH":"7-Nov-2018 09:40:25.793","tos":72,"user":""}"        "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "77.95.163.93"  "US"      "California"        "37.30420000000"            "-122.09460000000"            "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"
+
|id
−
 
+
|805729  
−
* 805784 0              "-1407899398"  "1541583606254"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.83.202"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":135,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.202","dstport":48404,"duration":0,"eventname":"Black List Src","flags":25,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":2,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541583637478,"timeH":"7-Nov-2018 09:40:37.478","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.202"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|customerid
−
* 805789  0              "-1407899398"  "1541583608247"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.83.138"  1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":198,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.138","dstport":58840,"duration":296,"eventname":"Black List Src","flags":25,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":3,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583639291,"timeH":"7-Nov-2018 09:40:39.291","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.138"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|0
−
 
+
|-
−
* 805798  0             "-1407899398"  "1541583579969"            -100      8              "88.151.82.32"  "Syn Src Port Sweep 88.151.82.32->73.7.139.44"          1              "{"Application":"TCP/20999","Eventer":"88.151.82.32","Syn Type":"Source","appid":414215,"bytes":156,"device":"172.21.40.250","domain":"","dstadd":"73.7.139.44","dstport":20999,"duration":9000,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":3,"proto":6,"srcadd":"88.151.82.32","srcport":50010,"time":1541583642313,"timeH":"7-Nov-2018 09:40:42.313","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "IE"                "County Monaghan"      "54.27030000000"            "-6.88970000000"            "US"      "Georgia"                "34.00170000000"            "-84.47100000000"
+
|device
−
 
+
|"-1407899398"
−
* 805800  0              "-1407899398"  "1541583614595"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.86.213"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":146,"device":"172.21.40.250","domain":"","dstadd":"178.20.86.213","dstport":51332,"duration":0,"eventname":"Black List Src","flags":25,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":2,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541583645335,"timeH":"7-Nov-2018 09:40:45.335","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.86.213"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|firstseen
−
* 805801  0              "-1407899398"  "1541583616150"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.86.213->179.60.195.7"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":104,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":0,"eventname":"Black List Dst","flags":16,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":2,"proto":6,"srcadd":"178.20.86.213","srcport":51330,"time":1541583646846,"timeH":"7-Nov-2018 09:40:46.846","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.86.213"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
|"1541583542242"
−
 
+
|-
−
* 805802  0              "-1407899398"  "1541583616154"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.86.213->179.60.195.7"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":104,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":0,"eventname":"Black List Dst","flags":16,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":2,"proto":6,"srcadd":"178.20.86.213","srcport":51332,"time":1541583646846,"timeH":"7-Nov-2018 09:40:46.846","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.86.213"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
|eventtype
−
 
+
| -11
−
* 805830  0              "-1407899398"  "1541583648804"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.83.202"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":5356,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.202","dstport":48413,"duration":344,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":8,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541583679280,"timeH":"7-Nov-2018 09:41:19.280","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.202"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|eventsrctype
−
* 805837  0              "-1407899398"  "1541583661268"            -11          8              "24.61.224.93"  "Black List Src Hit(SSH) 24.61.224.93->178.20.85.54"      1              "{"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/ssh.txt","Black List Type":"Source","Eventer":"24.61.224.93","appid":393238,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.85.54","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"24.61.224.93","srcport":60996,"time":1541583692072,"timeH":"7-Nov-2018 09:41:32.72","tos":0,"user":""}"            "https://lists.blocklist.de/lists/ssh.txt"  75          25          "SSH"                "178.20.85.54"  "US"      "New Hampshire"            "43.09480000000"            "-71.73060000000"          "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|8
−
 
+
|-
−
* 805851  0              "-1407899398"  "1541583676326"            -12          8              "199.249.223.79"              "Black List Dst Hit(tal) 88.151.85.14->199.249.223.79"  1              "{"Application":"SSH TCP/22","Black List":"http://homeworld.anuviewsoftware.com:7902/static/talos.txt","Black List Type":"Destination","Eventer":"199.249.223.79","appid":393238,"bytes":1634,"device":"172.21.40.250","domain":"","dstadd":"199.249.223.79","dstport":44669,"duration":3456,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":12,"proto":6,"srcadd":"88.151.85.14","srcport":22,"time":1541583707182,"timeH":"7-Nov-2018 09:41:47.182","tos":0,"user":""}"          "http://homeworld.anuviewsoftware.com:7902/static/talos.txt" 15                9              "tal"      "88.151.85.14"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "US"                "Texas" "31.46760000000"            "-100.43670000000"
+
|eventsrc
−
 
+
|"xxx.xxx.208.28"
−
* 805862  0              "-1407899398"  "1541583686624"            -100      8              "77.72.82.80"    "Syn Src Network Sweep 77.72.82.80->77.95.167.184"      1              "{"Application":"SSH TCP/22","Eventer":"77.72.82.80","Syn Type":"Source","appid":393238,"bytes":4920,"device":"172.21.40.250","domain":"","dstadd":"77.95.167.184","dstport":22,"duration":20,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":123,"proto":6,"srcadd":"77.72.82.80","srcport":48639,"time":1541583716752,"timeH":"7-Nov-2018 09:41:56.752","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "GB"      "Stoke-on-Trent"            "53.00000000000"            "-2.18330000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|message
−
* 805863  0              "-1407899398"  "1541583687836"            -100      8              "45.77.153.18"  "Syn Src Network Sweep 45.77.153.18->77.95.165.31"      1              "{"Application":"TCP/3398","Eventer":"45.77.153.18","Syn Type":"Source","appid":396614,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.165.31","dstport":3398,"duration":0,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"45.77.153.18","srcport":46359,"time":1541583717860,"timeH":"7-Nov-2018 09:41:57.860","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "US"      "New Jersey"    "40.46520000000"            "-74.23070000000"          "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
|"Black List Src Hit(Botnet Strong) xxx.xxx.208.28->xxx.xxx.166.159"
−
 
+
|-
−
* 805874  0              "-1407899398"  "1541583699912"            -11         8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->185.52.93.224"            1              "{"Application":"TCP/3542","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":396758,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.224","dstport":3542,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":58022,"time":1541583730148,"timeH":"7-Nov-2018 09:42:10.148","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.93.224"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
|datatype
−
 
+
|1
−
* 805876  0              "-1407899398"  "1541583672087"            -100      8              "88.151.81.242"                "Syn Src Port Sweep 88.151.81.242->41.204.244.146"                1              "{"Application":"TCP/42529","Eventer":"88.151.81.242","Syn Type":"Source","appid":435745,"bytes":152,"device":"172.21.40.250","domain":"","dstadd":"41.204.244.146","dstport":42529,"duration":9008,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":3,"proto":6,"srcadd":"88.151.81.242","srcport":59741,"time":1541583733775,"timeH":"7-Nov-2018 09:42:13.775","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"            "NG"    "Lagos" "6.45310000000"                "3.39580000000"
+
|-
−
 
+
|data
−
* 805900  0              "-1407899398"  "1541583728670"            -12          8             "197.231.221.211"            "Black List Dst Hit(Known Bad IP) 88.151.85.14->197.231.221.211"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Destination","Eventer":"197.231.221.211","appid":393238,"bytes":1826,"device":"172.21.40.250","domain":"","dstadd":"197.231.221.211","dstport":31472,"duration":1788,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":13,"proto":6,"srcadd":"88.151.85.14","srcport":22,"time":1541583758254,"timeH":"7-Nov-2018 09:42:38.254","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "LR"      "null"                "6.50000000000"              "-9.50000000000"
+
|{"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/strongips.txt","Black List Type":"Source","Eventer":"xxx.xxx.208.28","appid":393238,"bytes":44,"device":"xxx.xxx.40.250","domain":"","dstadd":"xx.xxx.166.159","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"xxx.xxx.208.28","srcport":28148,"time":1541583574022,"timeH":"7-Nov-2018 09:39:34.22","tos":0,"user":""}"  
−
 
+
|-
−
* 805906  0              "-1407899398"  "1541583708449"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.85.26"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":2596987,"device":"172.21.40.250","domain":"","dstadd":"178.20.85.26","dstport":41295,"duration":45520,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1905,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583769333,"timeH":"7-Nov-2018 09:42:49.333","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.26"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|datasource
−
 
+
|"https://lists.blocklist.de/lists/strongips.txt"
−
* 805915  0              "-1407899398"  "1541583747394"            -12          8              "197.231.221.211"            "Black List Dst Hit(Known Bad IP) 88.151.85.14->197.231.221.211"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Destination","Eventer":"197.231.221.211","appid":393238,"bytes":1826,"device":"172.21.40.250","domain":"","dstadd":"197.231.221.211","dstport":33636,"duration":1788,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":13,"proto":6,"srcadd":"88.151.85.14","srcport":22,"time":1541583777190,"timeH":"7-Nov-2018 09:42:57.190","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "LR"      "null"                "6.50000000000"              "-9.50000000000"
+
|-
−
 
+
|confidence
−
* 805924  0              "-1407899398"  "1541583757661"            -11          8              "17.130.74.5"    "Black List Src Hit(Apache(WWW) Scan/Brute) 17.130.74.5->88.151.81.219"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"17.130.74.5","appid":393659,"bytes":5326,"device":"172.21.40.250","domain":"","dstadd":"88.151.81.219","dstport":59758,"duration":3060,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":18,"proto":6,"srcadd":"17.130.74.5","srcport":443,"time":1541583786861,"timeH":"7-Nov-2018 09:43:06.861","tos":72,"user":""}"        "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "88.151.81.219"                "US"      "California"        "37.30420000000"            "-122.09460000000"            "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|75
−
 
+
|-
−
* 805931  0              "-1407899398"  "1541583763973"            -11          8              "197.231.221.211"            "Black List Src Hit(Known Bad IP) 197.231.221.211->88.151.85.14"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Source","Eventer":"197.231.221.211","appid":393238,"bytes":2128,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.14","dstport":22,"duration":1836,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":17,"proto":6,"srcadd":"197.231.221.211","srcport":35932,"time":1541583793005,"timeH":"7-Nov-2018 09:43:13.5","tos":0,"user":""}"              "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "LR"      "null"    "6.50000000000"              "-9.50000000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
|severity
−
 
+
|80
−
* 805932  0              "-1407899398"  "1541583763993"            -12          8              "197.231.221.211"            "Black List Dst Hit(Known Bad IP) 88.151.85.14->197.231.221.211"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Destination","Eventer":"197.231.221.211","appid":393238,"bytes":1878,"device":"172.21.40.250","domain":"","dstadd":"197.231.221.211","dstport":35932,"duration":1780,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":14,"proto":6,"srcadd":"88.151.85.14","srcport":22,"time":1541583793005,"timeH":"7-Nov-2018 09:43:13.5","tos":0,"user":""}"              "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "LR"      "null"                "6.50000000000"              "-9.50000000000"
+
|-
−
 
+
|category
−
* 805935  0              "-1407899398"  "1541583765850"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.83.195"  1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":233,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.195","dstport":51845,"duration":0,"eventname":"Black List Src","flags":25,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":3,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583794818,"timeH":"7-Nov-2018 09:43:14.818","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.195"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|"Botnet Strong"
−
 
+
|-
−
* 805939  0              "-1407899398"  "1541583736946"            -100      8              "88.151.81.242"                "Syn Src Network And Port Sweep 88.151.81.242->180.190.92.108"        1              "{"Application":"TCP/21011","Eventer":"88.151.81.242","Syn Type":"Source","appid":414227,"bytes":152,"device":"172.21.40.250","domain":"","dstadd":"180.190.92.108","dstport":21011,"duration":8996,"eventname":"Syn Src Network And Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":3,"proto":6,"srcadd":"88.151.81.242","srcport":59774,"time":1541583798646,"timeH":"7-Nov-2018 09:43:18.646","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Network And Port Sweep"                "Many" "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "PH"      "National Capital Region" "14.64880000000"            "121.05090000000"
+
|target
−
 
+
|"xxx.xxx.166.159"
−
* 805940  0              "-1407899398"  "1541583771243"            -12          8              "80.82.77.33"    "Black List Dst Hit(Botnet Mail) 88.151.87.138->80.82.77.33"            1              "{"Application":"TCP/37","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Destination","Eventer":"80.82.77.33","appid":393253,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"80.82.77.33","dstport":56218,"duration":0,"eventname":"Black List Dst","flags":20,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":1,"proto":6,"srcadd":"88.151.87.138","srcport":37,"time":1541583799855,"timeH":"7-Nov-2018 09:43:19.855","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "88.151.87.138"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "SC"      "null"                "-4.58330000000"            "55.66670000000"
+
|-
−
 
+
|country_src
−
* 805941  0              "-1407899398"  "1541583773651"            -11          8              "17.130.74.5"    "Black List Src Hit(Apache(WWW) Scan/Brute) 17.130.74.5->88.151.82.106"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"17.130.74.5","appid":393659,"bytes":4700,"device":"172.21.40.250","domain":"","dstadd":"88.151.82.106","dstport":54757,"duration":352,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":15,"proto":6,"srcadd":"17.130.74.5","srcport":443,"time":1541583801667,"timeH":"7-Nov-2018 09:43:21.667","tos":72,"user":""}"        "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "88.151.82.106"                "US"      "California"        "37.30420000000"            "-122.09460000000"            "IE"        "County Monaghan"      "54.27030000000"            "-6.88970000000"
+
|"CN"
−
 
+
|-
−
* 805942  0              "-1407899398"  "1541583740944"            -100      8              "88.151.82.32"  "Syn Src Port Sweep 88.151.82.32->184.23.8.9"            1             "{"Application":"TCP/50069","Eventer":"88.151.82.32","Syn Type":"Source","appid":443285,"bytes":156,"device":"172.21.40.250","domain":"","dstadd":"184.23.8.9","dstport":51413,"duration":8996,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":3,"proto":6,"srcadd":"88.151.82.32","srcport":50069,"time":1541583802272,"timeH":"7-Nov-2018 09:43:22.272","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "IE"                "County Monaghan"      "54.27030000000"            "-6.88970000000"            "US"      "California"                "37.79570000000"            "-122.42090000000"
+
|division_src
−
 
+
|"Gansu"
−
* 805945  0              "-1407899398"  "1541583776377"            -12          8              "80.82.77.139"  "Black List Dst Hit(Botnet Mail) 77.95.163.65->80.82.77.139"            1              "{"Application":"TCP/3001","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Destination","Eventer":"80.82.77.139","appid":396217,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"80.82.77.139","dstport":46640,"duration":0,"eventname":"Black List Dst","flags":20,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":1,"proto":6,"srcadd":"77.95.163.65","srcport":3001,"time":1541583804085,"timeH":"7-Nov-2018 09:43:24.85","tos":0,"user":""}"            "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "77.95.163.65"  "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"            "SC"      "null"    "-4.58330000000"                "55.66670000000"
+
|-
−
 
+
|latit_src
−
* 805946  0              "-1407899398"  "1541583777653"            -11          8              "197.231.221.211"            "Black List Src Hit(Known Bad IP) 197.231.221.211->88.151.85.14"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Source","Eventer":"197.231.221.211","appid":393238,"bytes":2024,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.14","dstport":22,"duration":1656,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":15,"proto":6,"srcadd":"197.231.221.211","srcport":39136,"time":1541583805897,"timeH":"7-Nov-2018 09:43:25.897","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "LR"      "null"    "6.50000000000"              "-9.50000000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
|"0.00000000000"
−
 
+
|-
−
* 805947  0              "-1407899398"  "1541583777673"            -12          8              "197.231.221.211"            "Black List Dst Hit(Known Bad IP) 88.151.85.14->197.231.221.211"          1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Destination","Eventer":"197.231.221.211","appid":393238,"bytes":1774,"device":"172.21.40.250","domain":"","dstadd":"197.231.221.211","dstport":39136,"duration":1604,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":12,"proto":6,"srcadd":"88.151.85.14","srcport":22,"time":1541583805897,"timeH":"7-Nov-2018 09:43:25.897","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "LR"      "null"                "6.50000000000"              "-9.50000000000"
+
|longd_src
−
 
+
|"0.00000000000"
−
* 805957  0              "-1407899398"  "1541583782747"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.83.138"  1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":266,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.138","dstport":58863,"duration":96,"eventname":"Black List Src","flags":29,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":5,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583810127,"timeH":"7-Nov-2018 09:43:30.127","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.138"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|country_dst
−
* 805965  0              "-1407899398"  "1541583791472"            -12          8              "78.198.69.64"  "Black List Dst Hit(SSH) 178.20.86.193->78.198.69.64"    1              "{"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/ssh.txt","Black List Type":"Destination","Eventer":"78.198.69.64","appid":393238,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"78.198.69.64","dstport":55736,"duration":0,"eventname":"Black List Dst","flags":20,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":1,"proto":6,"srcadd":"178.20.86.193","srcport":22,"time":1541583819192,"timeH":"7-Nov-2018 09:43:39.192","tos":0,"user":""}"          "https://lists.blocklist.de/lists/ssh.txt"  75          25          "SSH"                "178.20.86.193"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"            "FR"      "Var"                "43.42820000000"            "6.22090000000"
+
|"IE"
−
 
+
|-
−
* 805969  0              "-1407899398"  "1541583761642"            -12          8              "37.220.35.202"                "Black List Dst Hit(Known Bad IP) 77.95.163.239->37.220.35.202"            1              "{"Application":"TCP/49161","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Destination","Eventer":"37.220.35.202","appid":442377,"bytes":1819,"device":"172.21.40.250","domain":"","dstadd":"37.220.35.202","dstport":49161,"duration":6068,"eventname":"Black List Dst","flags":26,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":8,"proto":6,"srcadd":"77.95.163.239","srcport":50928,"time":1541583822214,"timeH":"7-Nov-2018 09:43:42.214","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "77.95.163.239"                "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"            "NL"      "null"                "52.38240000000"            "4.89950000000"
+
|division_dst
−
 
+
|"County Sligo"
−
* 805970  0              "-1407899398"  "1541583762751"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.85.90"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":4397,"device":"172.21.40.250","domain":"","dstadd":"178.20.85.90","dstport":54545,"duration":21704,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":10,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541583822819,"timeH":"7-Nov-2018 09:43:42.819","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.90"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
|-
−
 
+
|latit_dst
−
* 805973  0              "-1407899398"  "1541583766091"            -100      8              "77.95.163.150"                "Syn Src Port Sweep 77.95.163.150->103.217.166.149"              1              "{"Application":"TCP/32367","Eventer":"77.95.163.150","Syn Type":"Source","appid":425583,"bytes":156,"device":"172.21.40.250","domain":"","dstadd":"103.217.166.149","dstport":32367,"duration":9016,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":3,"proto":6,"srcadd":"77.95.163.150","srcport":58833,"time":1541583826847,"timeH":"7-Nov-2018 09:43:46.847","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "IE"                "County Sligo"  "54.25170000000"            "-8.89310000000"            "AU"      "New South Wales"        "-33.86120000000"              "151.19820000000"
+
|"0.00000000000"
−
 
+
|-
−
* 805989  0              "-1407899398"  "1541583784300"            -120      8              "Many" "Syn Dst Unreachable Server 85.245.91.77->88.151.81.242"    1              "
+
|longd_dst
−
{"Application":"TCP/57423","Eventer":"88.151.81.242","Syn Type":"Destination","appid":450639,"bytes":152,"device":"172.21.40.250","domain":"","dstadd":"88.151.81.242","dstport":57423,"duration":9280,"eventname":"Syn Dst Unreachable Server","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":3,"proto":6,"srcadd":"85.245.91.77","srcport":64779,"time":1541583842864,"timeH":"7-Nov-2018 09:44:02.864","tos":0,"user":""}"          "Syn Destination"            100        100        "Syn Dst Unreachable Server"                "88.151.81.242"                "PT"      "Faro"  "37.09810000000"            "-7.89430000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
|"0.00000000000"
−
 
+
|}
−
* 805992  0              "-1407899398"  "1541583826298"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.85.19->179.60.195.7"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":3591,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":2176,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":18,"proto":6,"srcadd":"178.20.85.19","srcport":54036,"time":1541583852030,"timeH":"7-Nov-2018 09:44:12.30","tos":0,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.19"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
−
 
+
−
* 805998  0              "-1407899398"  "1541583829647"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.85.19"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":7472,"device":"172.21.40.250","domain":"","dstadd":"178.20.85.19","dstport":54038,"duration":1336,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":14,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583855555,"timeH":"7-Nov-2018 09:44:15.555","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.19"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 805999  0              "-1407899398"  "1541583832020"            -12          8              "17.130.74.5"    "Black List Dst Hit(Apache(WWW) Scan/Brute) 77.95.163.180->17.130.74.5"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"17.130.74.5","appid":393659,"bytes":4705,"device":"172.21.40.250","domain":"","dstadd":"17.130.74.5","dstport":443,"duration":5700,"eventname":"Black List Dst","flags":27,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":24,"proto":6,"srcadd":"77.95.163.180","srcport":49241,"time":1541583857368,"timeH":"7-Nov-2018 09:44:17.368","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "77.95.163.180"                "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"                "US"      "California"        "37.30420000000"            "-122.09460000000"
+
−
 
+
−
* 806030  0              "-1407899398"  "1541583868795"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.85.19->179.60.195.7"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":135,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":0,"eventname":"Black List Dst","flags":28,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":2,"proto":6,"srcadd":"178.20.85.19","srcport":48795,"time":1541583892723,"timeH":"7-Nov-2018 09:44:52.723","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.19"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
−
 
+
−
* 806034  0              "-1407899398"  "1541583872322"            -12          8              "5.188.10.242"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 88.151.81.78->5.188.10.242"      1              "{"Application":"TCP/4654","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"5.188.10.242","appid":397870,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"5.188.10.242","dstport":50160,"duration":0,"eventname":"Black List Dst","flags":20,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":1,"proto":6,"srcadd":"88.151.81.78","srcport":4654,"time":1541583896350,"timeH":"7-Nov-2018 09:44:56.350","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "88.151.81.78"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "HR"      "Istarska Zupanija"          "44.86830000000"            "13.84810000000"
+
−
 
+
−
* 806035  0              "-1407899398"  "1541583845007"            -100      8              "77.95.163.150"                "Syn Src Network And Port Sweep 77.95.163.150->170.84.11.23"            1              "{"Application":"TCP/12962","Eventer":"77.95.163.150","Syn Type":"Source","appid":406178,"bytes":156,"device":"172.21.40.250","domain":"","dstadd":"170.84.11.23","dstport":12962,"duration":9024,"eventname":"Syn Src Network And Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":3,"proto":6,"srcadd":"77.95.163.150","srcport":58859,"time":1541583898767,"timeH":"7-Nov-2018 09:44:58.767","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Network And Port Sweep"                "Many" "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"            "TT"      "Chaguanas"                "10.51670000000"            "-61.41670000000"
+
−
 
+
−
* 806043  0              "-1407899398"  "1541583879949"            -11          8              "17.130.74.5"    "Black List Src Hit(Apache(WWW) Scan/Brute) 17.130.74.5->77.95.163.93"        1             "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"17.130.74.5","appid":393659,"bytes":96,"device":"172.21.40.250","domain":"","dstadd":"77.95.163.93","dstport":55574,"duration":0,"eventname":"Black List Src","flags":17,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":2,"proto":6,"srcadd":"17.130.74.5","srcport":443,"time":1541583904005,"timeH":"7-Nov-2018 09:45:04.5","tos":72,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "77.95.163.93"  "US"      "California"        "37.30420000000"            "-122.09460000000"            "IE"        "County Sligo"  "54.25170000000"            "-8.89310000000"
+
−
 
+
−
* 806045  0              "-1407899398"  "1541583853828"            -100      8              "77.95.162.169"                "Syn Src Port Sweep 77.95.162.169->42.61.176.113"  1              "{"Application":"TCP/23155","Eventer":"77.95.162.169","Syn Type":"Source","appid":416371,"bytes":104,"device":"172.21.40.250","domain":"","dstadd":"42.61.176.113","dstport":23155,"duration":2932,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":2,"proto":6,"srcadd":"77.95.162.169","srcport":58416,"time":1541583907632,"timeH":"7-Nov-2018 09:45:07.632","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"            "SG"      "Central Singapore Community Development Council"  "1.28550000000"              "103.85650000000"
+
−
 
+
−
* 806055  0              "-1407899398"  "1541583861512"            -11          8              "125.212.217.214"            "Black List Src Hit(Botnet IMAP) 125.212.217.214->178.20.86.120"          1              "{"Application":"TCP/5001","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"125.212.217.214","appid":398217,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.86.120","dstport":5001,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"125.212.217.214","srcport":46640,"time":1541583915132,"timeH":"7-Nov-2018 09:45:15.132","tos":0,"user":""}"          "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "178.20.86.120"                "VN"      "Thanh Pho Ha Noi"        "21.03330000000"            "105.85000000000"          "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806056  0              "-1407899398"  "1541583862797"            -11          8              "66.240.219.146"              "Black List Src Hit(Botnet IMAP) 66.240.219.146->88.151.86.230"            1              "{"Application":"TCP/5986","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"66.240.219.146","appid":399202,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.86.230","dstport":5986,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"66.240.219.146","srcport":46640,"time":1541583916341,"timeH":"7-Nov-2018 09:45:16.341","tos":40,"user":""}"        "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "88.151.86.230"                "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"                "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806061  0              "-1407899398"  "1541583868032"            -100      8              "201.208.11.212"              "Syn Src Port Sweep 201.208.11.212->185.52.93.162"                1              "{"Application":"TCP/16671","Eventer":"201.208.11.212","Syn Type":"Source","appid":409887,"bytes":1144,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.162","dstport":16671,"duration":8,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":26,"proto":6,"srcadd":"201.208.11.212","srcport":36893,"time":1541583921780,"timeH":"7-Nov-2018 09:45:21.780","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "VE"                "Aragua"              "10.24690000000"            "-67.59580000000"          "IE"        "null"    "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806062  0              "-1407899398"  "1541583868032"            -120      8              "Many" "Syn Dst Port Sweep 201.208.11.212->185.52.93.162"                1              "{"Application":"TCP/16671","Eventer":"185.52.93.162","Syn Type":"Destination","appid":409887,"bytes":1144,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.162","dstport":16671,"duration":8,"eventname":"Syn Dst Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":26,"proto":6,"srcadd":"201.208.11.212","srcport":36893,"time":1541583921780,"timeH":"7-Nov-2018 09:45:21.780","tos":0,"user":""}"          "Syn Destination"            100        100        "Syn Dst Port Sweep"                "185.52.93.162"                "VE"      "Aragua"              "10.24690000000"            "-67.59580000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806065  0              "-1407899398"  "1541583902720"            -11          8              "51.255.202.66"                "Black List Src Hit(Known Bad IP) 51.255.202.66->88.151.85.14"                1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Source","Eventer":"51.255.202.66","appid":393238,"bytes":2076,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.14","dstport":22,"duration":1916,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":16,"proto":6,"srcadd":"51.255.202.66","srcport":45822,"time":1541583926616,"timeH":"7-Nov-2018 09:45:26.616","tos":0,"user":""}"          "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "FR"      "null"    "48.85820000000"            "2.33870000000"              "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806076  0              "-1407899398"  "1541583913911"            -12          8              "17.130.74.5"    "Black List Dst Hit(Apache(WWW) Scan/Brute) 88.151.86.163->17.130.74.5"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"17.130.74.5","appid":393659,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"17.130.74.5","dstport":443,"duration":0,"eventname":"Black List Dst","flags":20,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":1,"proto":6,"srcadd":"88.151.86.163","srcport":59859,"time":1541583938703,"timeH":"7-Nov-2018 09:45:38.703","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "88.151.86.163"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "California"        "37.30420000000"            "-122.09460000000"
+
−
 
+
−
* 806081  0              "-1407899398"  "1541583889774"            -100      8              "5.188.86.55"    "Syn Src Port Sweep 5.188.86.55->83.245.74.166"      1              "{"Application":"TCP/4001","Eventer":"5.188.86.55","Syn Type":"Source","appid":397217,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"83.245.74.166","dstport":4001,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"5.188.86.55","srcport":43017,"time":1541583943438,"timeH":"7-Nov-2018 09:45:43.438","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "RU"                "St.-Petersburg"              "59.89440000000"            "30.26420000000"            "GB"      "null"    "51.49640000000"                "-0.12240000000"
+
−
 
+
−
* 806082  0              "-1407899398"  "1541583890458"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->77.95.160.177"          1              "{"Application":"ISAKMP UDP/500","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":1114612,"bytes":844,"device":"172.21.40.250","domain":"","dstadd":"77.95.160.177","dstport":500,"duration":0,"eventname":"Black List Src","flags":16,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":17,"srcadd":"80.82.77.139","srcport":500,"time":1541583944042,"timeH":"7-Nov-2018 09:45:44.42","tos":40,"user":""}"          "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "77.95.160.177"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806083  0              "-1407899398"  "1541583890470"            -100      8              "27.68.100.88"  "Syn Src Port Sweep 27.68.100.88->185.52.92.87"      1              "{"Application":"TCP/47115","Eventer":"27.68.100.88","Syn Type":"Source","appid":440331,"bytes":44,"device":"172.21.40.250","domain":"","dstadd":"185.52.92.87","dstport":47115,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"27.68.100.88","srcport":51794,"time":1541583944042,"timeH":"7-Nov-2018 09:45:44.42","tos":0,"user":""}"            "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "VN"                "Thanh Pho Ha Noi"        "21.03330000000"            "105.85000000000"          "IE"        "null"    "53.34720000000"                "-6.24390000000"
+
−
 
+
−
* 806084  0              "-1407899398"  "1541583890470"            -120      8              "Many" "Syn Dst Port Sweep 27.68.100.88->185.52.92.87"  1              "{"Application":"TCP/47115","Eventer":"185.52.92.87","Syn Type":"Destination","appid":440331,"bytes":44,"device":"172.21.40.250","domain":"","dstadd":"185.52.92.87","dstport":47115,"duration":0,"eventname":"Syn Dst Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"27.68.100.88","srcport":51794,"time":1541583944042,"timeH":"7-Nov-2018 09:45:44.42","tos":0,"user":""}"            "Syn Destination"            100        100        "Syn Dst Port Sweep"                "185.52.92.87"  "VN"      "Thanh Pho Ha Noi"        "21.03330000000"            "105.85000000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806099  0              "-1407899398"  "1541583910421"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.83.104"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":671,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.104","dstport":43688,"duration":5040,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":8,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541583964189,"timeH":"7-Nov-2018 09:46:04.189","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.104"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806103  0              "-1407899398"  "1541583913085"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->77.95.162.174"            1              "{"Application":"TCP/6664","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":399880,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.162.174","dstport":6664,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":58022,"time":1541583967813,"timeH":"7-Nov-2018 09:46:07.813","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "77.95.162.174"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806104  0              "-1407899398"  "1541583913741"            -100      8              "89.46.72.168"  "Syn Src Network Sweep 89.46.72.168->178.20.82.39"      1              "{"Application":"SSH TCP/22","Eventer":"89.46.72.168","Syn Type":"Source","appid":393238,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.82.39","dstport":22,"duration":0,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"89.46.72.168","srcport":48675,"time":1541583968417,"timeH":"7-Nov-2018 09:46:08.417","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "IT"        "Province of Arezzo"      "43.41670000000"            "11.88330000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806105  0              "-1407899398"  "1541583914361"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.83.195"    1              "{"Application":"HTTP TCP/80","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393296,"bytes":315,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.195","dstport":36683,"duration":44,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":3,"proto":6,"srcadd":"179.60.195.7","srcport":80,"time":1541583969021,"timeH":"7-Nov-2018 09:46:09.21","tos":0,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75           25                "Apache(WWW) Scan/Brute"    "178.20.83.195"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806123  0              "-1407899398"  "1541583932638"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->88.151.82.79"              1              "{"Application":"TCP/7777","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":400993,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.82.79","dstport":7777,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":58022,"time":1541583986650,"timeH":"7-Nov-2018 09:46:26.650","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "88.151.82.79"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Monaghan"                "54.27030000000"            "-6.88970000000"
+
−
 
+
−
* 806124  0              "-1407899398"  "1541583934872"            -100      8              "195.154.183.207"            "Syn Src Port Sweep 195.154.183.207->77.95.162.246"              1              "{"Application":"TCP/21118","Eventer":"195.154.183.207","Syn Type":"Source","appid":414334,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.162.246","dstport":56829,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"195.154.183.207","srcport":21118,"time":1541583988664,"timeH":"7-Nov-2018 09:46:28.664","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "FR"                "null"    "48.85820000000"            "2.33870000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806130  0              "-1407899398"  "1541583944890"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.86.44"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":107648,"device":"172.21.40.250","domain":"","dstadd":"178.20.86.44","dstport":56425,"duration":3536,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":97,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541583999542,"timeH":"7-Nov-2018 09:46:39.542","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.86.44"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806131  0              "-1407899398"  "1541583944906"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->88.151.87.138"            1              "{"Application":"TCP/37","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":393253,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.87.138","dstport":37,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":56218,"time":1541583999542,"timeH":"7-Nov-2018 09:46:39.542","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "88.151.87.138"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806140  0              "-1407899398"  "1541583951660"            -100      8              "5.188.86.55"    "Syn Src Port Sweep 5.188.86.55->178.20.83.41"          1              "{"Application":"TCP/3375","Eventer":"5.188.86.55","Syn Type":"Source","appid":396591,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.41","dstport":3375,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"5.188.86.55","srcport":43017,"time":1541584005380,"timeH":"7-Nov-2018 09:46:45.380","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "RU"                "St.-Petersburg"              "59.89440000000"            "30.26420000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806141  0              "-1407899398"  "1541583951664"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->77.95.163.65"            1              "{"Application":"TCP/3001","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":396217,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.163.65","dstport":3001,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"80.82.77.139","srcport":46640,"time":1541584005380,"timeH":"7-Nov-2018 09:46:45.380","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "77.95.163.65"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.25170000000"            "-8.89310000000"
+
−
 
+
−
* 806147  0              "-1407899398"  "1541583956412"            -11          8              "5.188.10.242"  "Black List Src Hit(Apache(WWW) Scan/Brute) 5.188.10.242->88.151.82.12"      1              "{"Application":"TCP/4654","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"5.188.10.242","appid":397870,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.82.12","dstport":4654,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"5.188.10.242","srcport":50160,"time":1541584010820,"timeH":"7-Nov-2018 09:46:50.820","tos":40,"user":""}"        "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "88.151.82.12"  "HR"      "Istarska Zupanija"          "44.86830000000"                "13.84810000000"            "IE"        "County Monaghan"      "54.27030000000"            "-6.88970000000"
+
−
 
+
−
* 806156  0              "-1407899398"  "1541583966806"            -100      8              "45.77.155.251"                "Syn Src Network Sweep 45.77.155.251->185.52.92.161"    1              "{"Application":"TCP/3393","Eventer":"45.77.155.251","Syn Type":"Source","appid":396609,"bytes":4800,"device":"172.21.40.250","domain":"","dstadd":"185.52.92.161","dstport":3393,"duration":20,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":120,"proto":6,"srcadd":"45.77.155.251","srcport":46255,"time":1541584020186,"timeH":"7-Nov-2018 09:47:00.186","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "US"      "New Jersey"    "40.46520000000"            "-74.23070000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806171  0              "-1407899398"  "1541584007990"            -100      8              "5.188.86.55"    "Syn Src Network And Port Sweep 5.188.86.55->88.151.81.10"          1              "{"Application":"TCP/3020","Eventer":"5.188.86.55","Syn Type":"Source","appid":396236,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.81.10","dstport":3020,"duration":0,"eventname":"Syn Src Network And Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"5.188.86.55","srcport":43017,"time":1541584039422,"timeH":"7-Nov-2018 09:47:19.422","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network And Port Sweep"                "Many" "RU"      "St.-Petersburg"              "59.89440000000"            "30.26420000000"            "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806191  0              "-1407899398"  "1541584031282"            -11          8              "179.60.195.7"  "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.7->178.20.83.202"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.7","appid":393659,"bytes":5356,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.202","dstport":48404,"duration":432,"eventname":"Black List Src","flags":26,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":8,"proto":6,"srcadd":"179.60.195.7","srcport":443,"time":1541584062346,"timeH":"7-Nov-2018 09:47:42.346","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.202"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806195  0              "-1407899398"  "1541584010556"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.85.19->179.60.195.7"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":932,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":12004,"eventname":"Black List Dst","flags":24,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":7,"proto":6,"srcadd":"178.20.85.19","srcport":49201,"time":1541584067172,"timeH":"7-Nov-2018 09:47:47.172","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.19"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
−
 
+
−
* 806208  0              "-1407899398"  "1541584051202"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->178.20.83.51"            1              "{"Application":"UDP/520","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":1114632,"bytes":52,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.51","dstport":520,"duration":0,"eventname":"Black List Src","flags":16,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":17,"srcadd":"80.82.77.139","srcport":12902,"time":1541584083262,"timeH":"7-Nov-2018 09:48:03.262","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "178.20.83.51"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806209  0              "-1407899398"  "1541584031399"            -11          8              "71.6.146.185"  "Black List Src Hit(Botnet Mail) 71.6.146.185->185.52.92.159"          1              "{"Application":"TCP/1572","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"71.6.146.185","appid":394788,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"185.52.92.159","dstport":2628,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"71.6.146.185","srcport":1572,"time":1541584088087,"timeH":"7-Nov-2018 09:48:08.87","tos":40,"user":""}"          "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.92.159"                "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806220  0              "-1407899398"  "1541584062208"            -11          8              "198.96.155.3"  "Black List Src Hit(Known Bad IP) 198.96.155.3->88.151.85.14"                1              "{"Application":"SSH TCP/22","Black List":"http://127.0.0.1/static/talos.txt","Black List Type":"Source","Eventer":"198.96.155.3","appid":393238,"bytes":2076,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.14","dstport":22,"duration":2620,"eventname":"Black List Src","flags":27,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":16,"proto":6,"srcadd":"198.96.155.3","srcport":50155,"time":1541584094120,"timeH":"7-Nov-2018 09:48:14.120","tos":40,"user":""}"        "http://127.0.0.1/static/talos.txt"            90          80          "Known Bad IP"          "88.151.85.14"  "CA"      "null"    "43.63190000000"            "-79.37160000000"          "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806225  0              "-1407899398"  "1541584066819"            -100      8              "5.188.86.55"    "Syn Src Port Sweep 5.188.86.55->88.151.85.200"      1              "{"Application":"TCP/3385","Eventer":"5.188.86.55","Syn Type":"Source","appid":396601,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.85.200","dstport":3385,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"5.188.86.55","srcport":43017,"time":1541584098243,"timeH":"7-Nov-2018 09:48:18.243","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "RU"                "St.-Petersburg"              "59.89440000000"            "30.26420000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806226  0              "-1407899398"  "1541584068141"            -11          8              "5.188.10.242"  "Black List Src Hit(Apache(WWW) Scan/Brute) 5.188.10.242->185.52.93.250"    1              "
+
−
{"Application":"TCP/4668","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"5.188.10.242","appid":397884,"bytes":4920,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.250","dstport":4668,"duration":24,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":123,"proto":6,"srcadd":"5.188.10.242","srcport":50160,"time":1541584100257,"timeH":"7-Nov-2018 09:48:20.257","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "185.52.93.250"                "HR"      "Istarska Zupanija"          "44.86830000000"                "13.84810000000"            "IE"        "null"    "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806232  0              "-1407899398"  "1541584048020"            -11          8              "71.6.146.185"  "Black List Src Hit(Botnet Mail) 71.6.146.185->185.52.93.171"          1              "{"Application":"TCP/10000","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"71.6.146.185","appid":403216,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.171","dstport":10000,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"71.6.146.185","srcport":46640,"time":1541584104980,"timeH":"7-Nov-2018 09:48:24.980","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.93.171"                "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806233  0              "-1407899398"  "1541584048020"            -11          8              "71.6.146.185"  "Black List Src Hit(Botnet Mail) 71.6.146.185->185.52.93.171"          1              "{"Application":"TCP/10000","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"71.6.146.185","appid":403216,"bytes":2160,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.171","dstport":10000,"duration":12,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":54,"proto":6,"srcadd":"71.6.146.185","srcport":46640,"time":1541584104980,"timeH":"7-Nov-2018 09:48:24.980","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.93.171"                "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806237  0              "-1407899398"  "1541584048663"            -100      8              "45.63.74.105"  "Syn Src Network Sweep 45.63.74.105->178.20.81.38"      1              "{"Application":"TCP/3390","Eventer":"45.63.74.105","Syn Type":"Source","appid":396606,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.81.38","dstport":3390,"duration":0,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"45.63.74.105","srcport":46191,"time":1541584105583,"timeH":"7-Nov-2018 09:48:25.583","tos":0,"user":""}"          "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "US"      "Illinois"              "42.01520000000"            "-87.99010000000"          "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806241  0              "-1407899398"  "1541584080846"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->77.95.160.48"              1              "{"Application":"TCP/1604","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":394820,"bytes":2360,"device":"172.21.40.250","domain":"","dstadd":"77.95.160.48","dstport":1604,"duration":12,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":59,"proto":6,"srcadd":"80.82.77.33","srcport":49717,"time":1541584112622,"timeH":"7-Nov-2018 09:48:32.622","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "77.95.160.48"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806247  0              "-1407899398"  "1541584084968"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->88.151.82.239"            1              "{"Application":"TCP/5672","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":398888,"bytes":2360,"device":"172.21.40.250","domain":"","dstadd":"88.151.82.239","dstport":5672,"duration":12,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":59,"proto":6,"srcadd":"80.82.77.33","srcport":6440,"time":1541584116440,"timeH":"7-Nov-2018 09:48:36.440","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "88.151.82.239"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Monaghan"        "54.27030000000"            "-6.88970000000"
+
−
 
+
−
* 806252  0              "-1407899398"  "1541584041133"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.83.28"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":631810,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.28","dstport":53979,"duration":51308,"eventname":"Black List Src","flags":24,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":484,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541584126097,"timeH":"7-Nov-2018 09:48:46.97","tos":0,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.28"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806260  0              "-1407899398"  "1541584100479"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->185.52.93.158"            1              "{"Application":"TCP/28017","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":421233,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.158","dstport":28017,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":58022,"time":1541584131931,"timeH":"7-Nov-2018 09:48:51.931","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.93.158"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806264  0              "-1407899398"  "1541584078663"            -11          8              "5.188.10.242"  "Black List Src Hit(Apache(WWW) Scan/Brute) 5.188.10.242->185.52.93.251"    1              "{"Application":"TCP/4668","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"5.188.10.242","appid":397884,"bytes":4840,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.251","dstport":4668,"duration":28,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":121,"proto":6,"srcadd":"5.188.10.242","srcport":50160,"time":1541584136659,"timeH":"7-Nov-2018 09:48:56.659","tos":40,"user":""}"        "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "185.52.93.251"                "HR"      "Istarska Zupanija"          "44.86830000000"                "13.84810000000"            "IE"        "null"    "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806265  0              "-1407899398"  "1541584078735"            -11          8              "66.240.219.146"              "Black List Src Hit(Botnet IMAP) 66.240.219.146->88.151.83.49"              1              "{"Application":"TCP/25105","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"66.240.219.146","appid":418321,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"88.151.83.49","dstport":25105,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"66.240.219.146","srcport":58022,"time":1541584136659,"timeH":"7-Nov-2018 09:48:56.659","tos":40,"user":""}"        "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "88.151.83.49"  "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"        "County Monaghan"        "54.27030000000"            "-6.88970000000"
+
−
 
+
−
* 806266  0              "-1407899398"  "1541584080748"            -11          8              "66.240.219.146"              "Black List Src Hit(Botnet IMAP) 66.240.219.146->178.20.80.0"  1              "{"Application":"UDP/4070","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"66.240.219.146","appid":1118182,"bytes":2214,"device":"172.21.40.250","domain":"","dstadd":"178.20.80.0","dstport":4070,"duration":12,"eventname":"Black List Src","flags":16,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":54,"proto":17,"srcadd":"66.240.219.146","srcport":20365,"time":1541584138472,"timeH":"7-Nov-2018 09:48:58.472","tos":40,"user":""}"        "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "178.20.80.0"    "US"      "California"        "32.80730000000"            "-117.13240000000"        "IE"        "County Sligo"    "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806271  0              "-1407899398"  "1541584081456"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->178.20.82.51"              1              "{"Application":"TCP/104","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":393320,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"178.20.82.51","dstport":104,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"80.82.77.33","srcport":38660,"time":1541584139076,"timeH":"7-Nov-2018 09:48:59.76","tos":40,"user":""}"          "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "178.20.82.51"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806272  0              "-1407899398"  "1541584081456"            -11          8              "80.82.77.33"    "Black List Src Hit(Botnet Mail) 80.82.77.33->178.20.82.51"              1              "{"Application":"TCP/104","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.33","appid":393320,"bytes":2360,"device":"172.21.40.250","domain":"","dstadd":"178.20.82.51","dstport":104,"duration":8,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":59,"proto":6,"srcadd":"80.82.77.33","srcport":38660,"time":1541584139076,"timeH":"7-Nov-2018 09:48:59.76","tos":40,"user":""}"          "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "178.20.82.51"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806281  0              "-1407899398"  "1541584120523"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.83.42"    1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":226,"device":"172.21.40.250","domain":"","dstadd":"178.20.83.42","dstport":60188,"duration":104,"eventname":"Black List Src","flags":29,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":4,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541584152071,"timeH":"7-Nov-2018 09:49:12.71","tos":0,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.83.42"  "US"      "null"    "37.75100000000"            "-97.82200000000"                "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806295  0              "-1407899398"  "1541584135583"            -100      8              "45.77.107.8"    "Syn Src Network Sweep 45.77.107.8->185.52.93.236"      1              "{"Application":"TCP/3396","Eventer":"45.77.107.8","Syn Type":"Source","appid":396612,"bytes":4840,"device":"172.21.40.250","domain":"","dstadd":"185.52.93.236","dstport":3396,"duration":24,"eventname":"Syn Src Network Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":121,"proto":6,"srcadd":"45.77.107.8","srcport":46319,"time":1541584167375,"timeH":"7-Nov-2018 09:49:27.375","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Network Sweep"                "Many" "US"      "New Jersey"    "40.46520000000"            "-74.23070000000"          "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806299  0              "-1407899398"  "1541584139272"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->185.52.95.175"          1              "{"Application":"XMPP/JABBER-SERVER TCP/5269","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":398485,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"185.52.95.175","dstport":5269,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"80.82.77.139","srcport":14898,"time":1541584171600,"timeH":"7-Nov-2018 09:49:31.600","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.95.175"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806300  0              "-1407899398"  "1541584139272"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->185.52.95.175"          1              "{"Application":"XMPP/JABBER-SERVER TCP/5269","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":398485,"bytes":2360,"device":"172.21.40.250","domain":"","dstadd":"185.52.95.175","dstport":5269,"duration":12,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":59,"proto":6,"srcadd":"80.82.77.139","srcport":14898,"time":1541584171600,"timeH":"7-Nov-2018 09:49:31.600","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "185.52.95.175"                "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "null"                "53.34720000000"            "-6.24390000000"
+
−
 
+
−
* 806304  0              "-1407899398"  "1541584092268"            -12          8              "179.60.195.7"  "Black List Dst Hit(Apache(WWW) Scan/Brute) 178.20.85.19->179.60.195.7"      1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Destination","Eventer":"179.60.195.7","appid":393659,"bytes":1308,"device":"172.21.40.250","domain":"","dstadd":"179.60.195.7","dstport":443,"duration":50624,"eventname":"Black List Dst","flags":24,"fwevent":0,"fwextcode":0,"inif":30,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":12,"packets":8,"proto":6,"srcadd":"178.20.85.19","srcport":59401,"time":1541584177032,"timeH":"7-Nov-2018 09:49:37.32","tos":0,"user":""}"            "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.85.19"  "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"                "US"      "null"    "37.75100000000"            "-97.82200000000"
+
−
 
+
−
* 806318  0              "-1407899398"  "1541584160745"            -11          8              "179.60.195.12"                "Black List Src Hit(Apache(WWW) Scan/Brute) 179.60.195.12->178.20.87.218"  1              "{"Application":"HTTPS TCP/443","Black List":"https://lists.blocklist.de/lists/apache.txt","Black List Type":"Source","Eventer":"179.60.195.12","appid":393659,"bytes":94,"device":"172.21.40.250","domain":"","dstadd":"178.20.87.218","dstport":18585,"duration":0,"eventname":"Black List Src","flags":25,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"179.60.195.12","srcport":443,"time":1541584192817,"timeH":"7-Nov-2018 09:49:52.817","tos":0,"user":""}"          "https://lists.blocklist.de/lists/apache.txt"            75          25                "Apache(WWW) Scan/Brute"    "178.20.87.218"                "US"      "null"    "37.75100000000"            "-97.82200000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806322  0              "-1407899398"  "1541584137078"            -11          8              "80.82.77.139"  "Black List Src Hit(Botnet Mail) 80.82.77.139->178.20.87.33"            1              "{"Application":"IMAPS TCP/993","Black List":"http://lists.blocklist.de/lists/mail.txt","Black List Type":"Source","Eventer":"80.82.77.139","appid":394209,"bytes":2360,"device":"172.21.40.250","domain":"","dstadd":"178.20.87.33","dstport":993,"duration":12,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":13,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":59,"proto":6,"srcadd":"80.82.77.139","srcport":63604,"time":1541584195230,"timeH":"7-Nov-2018 09:49:55.230","tos":40,"user":""}"        "http://lists.blocklist.de/lists/mail.txt"  75          25          "Botnet Mail"                "178.20.87.33"  "SC"      "null"    "-4.58330000000"            "55.66670000000"            "IE"        "County Sligo"                "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806334  0              "-1407899398"  "1541584175436"            -11          8              "125.212.217.214"            "Black List Src Hit(Botnet IMAP) 125.212.217.214->77.95.163.223"          1              "{"Application":"POP3S TCP/995","Black List":"https://lists.blocklist.de/lists/imap.txt","Black List Type":"Source","Eventer":"125.212.217.214","appid":394211,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.163.223","dstport":995,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"125.212.217.214","srcport":41665,"time":1541584206696,"timeH":"7-Nov-2018 09:50:06.696","tos":0,"user":""}"          "https://lists.blocklist.de/lists/imap.txt" 75          25          "Botnet IMAP"  "77.95.163.223"                "VN"      "Thanh Pho Ha Noi"        "21.03330000000"            "105.85000000000"          "IE"                "County Sligo"  "54.25170000000"            "-8.89310000000"
+
−
 
+
−
* 806335  0              "-1407899398"  "1541584150227"            -100      8              "195.154.183.207"            "Syn Src Port Sweep 195.154.183.207->77.95.162.246"              1              "{"Application":"TCP/21118","Eventer":"195.154.183.207","Syn Type":"Source","appid":414334,"bytes":40,"device":"172.21.40.250","domain":"","dstadd":"77.95.162.246","dstport":56713,"duration":0,"eventname":"Syn Src Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":12,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":1,"proto":6,"srcadd":"195.154.183.207","srcport":21118,"time":1541584209111,"timeH":"7-Nov-2018 09:50:09.111","tos":40,"user":""}"        "Syn Source"      100        100        "Syn Src Port Sweep"    "Many" "FR"                "null"    "48.85820000000"            "2.33870000000"              "IE"        "County Sligo"  "54.26670000000"            "-8.48330000000"
+
−
 
+
−
* 806336  0              "-1407899396"  "1541584196519"            -12          8              "1.1.1.1"              "Black List Dst Hit(kw1) 172.21.40.128->1.1.1.1"                1              "{"Application":"SNMP UDP/161","Black List":"Local List 4","Black List Type":"Destination","Eventer":"1.1.1.1","appid":1114273,"bytes":210,"device":"172.21.40.252","domain":"","dstadd":"1.1.1.1","dstport":161,"duration":2492,"eventname":"Black List Dst","flags":16,"fwevent":0,"fwextcode":0,"inif":16,"macdst":"00:00:00:00:00:00","macsrc":"18:03:73:2c:3c:1f","outif":19,"packets":3,"proto":17,"srcadd":"172.21.40.128","srcport":58407,"time":1541584209815,"timeH":"7-Nov-2018 09:50:09.815","tos":0,"user":""}"          "Local List 4"      19          18          "kw1"    "172.21.40.128"                                                "0.00000000000"              "0.00000000000"              "AU"      "Victoria"            "-37.70000000000"                "145.18330000000"
+

Latest revision as of 11:31, 29 November 2018

An Observer GigaFlow Event is a record that is created when a monitored flow pattern matches certain criteria.

Contents

What Generates an Event?

Some things that will trigger an event record include:

  • Attempts to access blacklisted resources.
  • Profile exceptions, i.e. behaviours deviating from norms.
  • A SYN flood event.
  • A lost neighbour.
  • A new connected device sending flows.
  • A connected device that stops sending flows.

See the Event definition in the Glossary and the main entry for Events in the Reference Manual

What is Recorded?

All GigaFlow flow records contain 29 fields or table columns. In the myipfix database associated with the GigaFlow installation, the netflow tables contain all flow records. See Flow Record Fields for the complete list.

Similarly, the Events tables contain all the Event records. See Event Record Fields for a complete list with descriptions. The Event record fields are:

id, customerid, device, firstseen, eventtype, eventsrctype, eventsrc, message, datatype, data, datasource, confidence, severity, category, target, country_src, division_src, latit_src, longd_src, country_dst, division_dst, latit_dst, longd_dst

Three events have both eventtype and posture set in the netflow and event tables in the database, i.e. these three event types can be determined immediately from Netflow records:

Record Field Type Code Description
postureBlackListSrc int -11 Attempted access by blacklisted resources. See also Watchlists in the Reference Manual.
postureBlackListDst int -12 Attempted access to blacklisted resources. See also Watchlists in the Reference Manual.
profilerException int -20 Profile exceptions, i.e. GigaFlow administrator-defined behaviours deviating from norms. See also Profiling in the Reference Manual.

In addition, all of these event types have only eventtype set in the event tables, i.e. these event types are classified with additional information or information from many records and have no postureid set in the netflow tables:

Record Field Type Code Description
synSrc int -100 SYN Source Network Sweep. See also SYN Forensics Monitoring in the Reference Manual.
synSrcPortException int -101 SYN Source Port Sweep. See also SYN Forensics Monitoring in the Reference Manual.
synSrcIPException int -102 SYN Source Unreachable IP. See also SYN Forensics Monitoring in the Reference Manual.
synSrcIPAndPortException int -103 SYN Source Network And Port Sweep. See also SYN Forensics Monitoring in the Reference Manual.
synDst int -120 SYN Destination Network Sweep. See also SYN Forensics Monitoring in the Reference Manual.
synDstPortException int -121 SYN Destination Port Sweep. See also SYN Forensics Monitoring in the Reference Manual.
synDstIPException int -122 SYN Destination Unreachable Server. See also SYN Forensics Monitoring in the Reference Manual.
synDstIPAndPortException int -123 SYN Destination Network And Port Sweep. See also SYN Forensics Monitoring in the Reference Manual.
lldpNewNeighbour int -130 A new connected device sending flows.
lldpLostNeighbour int -131 A lost neighbour.
deviceRestartsSendingFlows int -150 A connected device that stopped sending flows restarts sending flows.
deviceStopsSendingFlows int -151 A connected device that stops sending flows.

How are the Records Accessed?

Data can be accessed:

  1. As a normal user, via the GigaFlow interface. See Events in the Reference Manual.
  2. As an automated portal user, via the GigaFlow API. See Forensic Data Using the API.
  3. From the database directly using a viewer such as pgAdmin or in code using a postgreSQL connector such as Psycopg2 for Python.

Sample Records

See Event Record Fields for some typical records from an Event table with obfuscated IP addresses and locations. As an example:

postureBlackListSrc (-11)

Cut and pasted directly from an Events table:

805729 0 "-1407899398" "1541583542242" -11 8 "xxx.xxx.208.28" "Black List Src Hit(Botnet Strong) xxx.xxx.208.28->xxx.xxx.166.159" 1 {"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/strongips.txt","Black List Type":"Source","Eventer":"xxx.xxx.208.28","appid":393238,"bytes":44,"device":"xxx.xxx.40.250","domain":"","dstadd":"xx.xxx.166.159","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"xxx.xxx.208.28","srcport":28148,"time":1541583574022,"timeH":"7-Nov-2018 09:39:34.22","tos":0,"user":""}" "https://lists.blocklist.de/lists/strongips.txt" 75 80 "Botnet Strong" "xxx.xxx.166.159" "CN" "Gansu" "0.00000000000" "0.00000000000" "IE" "County Sligo" "0.00000000000" "0.00000000000"

Arranged more neatly in a table:

Record Field Value
id 805729
customerid 0
device "-1407899398"
firstseen "1541583542242"
eventtype -11
eventsrctype 8
eventsrc "xxx.xxx.208.28"
message "Black List Src Hit(Botnet Strong) xxx.xxx.208.28->xxx.xxx.166.159"
datatype 1
data {"Application":"SSH TCP/22","Black List":"https://lists.blocklist.de/lists/strongips.txt","Black List Type":"Source","Eventer":"xxx.xxx.208.28","appid":393238,"bytes":44,"device":"xxx.xxx.40.250","domain":"","dstadd":"xx.xxx.166.159","dstport":22,"duration":0,"eventname":"Black List Src","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":13,"packets":1,"proto":6,"srcadd":"xxx.xxx.208.28","srcport":28148,"time":1541583574022,"timeH":"7-Nov-2018 09:39:34.22","tos":0,"user":""}"
datasource "https://lists.blocklist.de/lists/strongips.txt"
confidence 75
severity 80
category "Botnet Strong"
target "xxx.xxx.166.159"
country_src "CN"
division_src "Gansu"
latit_src "0.00000000000"
longd_src "0.00000000000"
country_dst "IE"
division_dst "County Sligo"
latit_dst "0.00000000000"
longd_dst "0.00000000000"
Retrieved from "https://gigaflowsupport.viavisolutions.com/index.php?title=Event_Records&oldid=1156"