6331 lines
4.5 MiB
JSON
6331 lines
4.5 MiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "2",
|
||
|
|
"date": "2024-09-04",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "OSINT - Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion",
|
||
|
|
"publish_timestamp": "1725527017",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "3",
|
||
|
|
"timestamp": "1725448717",
|
||
|
|
"uuid": "f1d154e7-f660-4146-8140-5985f0d69aa8",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "CIRCL",
|
||
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#004646",
|
||
|
|
"local": false,
|
||
|
|
"name": "type:OSINT",
|
||
|
|
"relationship_type": ""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0071c3",
|
||
|
|
"local": false,
|
||
|
|
"name": "osint:lifetime=\"perpetual\"",
|
||
|
|
"relationship_type": ""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"local": false,
|
||
|
|
"name": "tlp:white",
|
||
|
|
"relationship_type": ""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"local": false,
|
||
|
|
"name": "tlp:clear",
|
||
|
|
"relationship_type": ""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#5208b8",
|
||
|
|
"local": false,
|
||
|
|
"name": "misp-galaxy:threat-actor=\"Earth Lusca\"",
|
||
|
|
"relationship_type": "attributed-to"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"local": false,
|
||
|
|
"name": "misp-galaxy:country=\"china\"",
|
||
|
|
"relationship_type": "attributed-to"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"local": false,
|
||
|
|
"name": "misp-galaxy:target-information=\"China\"",
|
||
|
|
"relationship_type": "targets"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"local": false,
|
||
|
|
"name": "misp-galaxy:producer=\"Trend Micro\"",
|
||
|
|
"relationship_type": "authored-by"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#600034",
|
||
|
|
"local": true,
|
||
|
|
"name": "workflow:todo=\"review-the-source-credibility\"",
|
||
|
|
"relationship_type": ""
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "327eb6d9-b3d9-43f2-81cd-9f0342cd3d77",
|
||
|
|
"value": "9ceb37c55a1e55afe50e2b892d3756e5c89ee71131245f5da72c1b8dd0005b99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "68ed65b9-03cb-4aa1-9c3d-33eaf090b3c2",
|
||
|
|
"value": "6eec892054e6cb1addbde2fa92d3ccb5d56d37aa992f81f9106aaf124b9d3525"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "122e3e3a-09c6-4519-aceb-3822c9f2aed7",
|
||
|
|
"value": "20f09959706797b81b2a4de627c01d0c0d890d142954d455a0e50f7811bdc951"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "f5a9bd01-82cb-405f-8595-5a419c488a21",
|
||
|
|
"value": "7ff329e0a20a96dd4d0e8b42a216ade348161566250b7e39e166031c881f34d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "36cf2707-a5fb-4260-9c79-879c117c77c4",
|
||
|
|
"value": "12435ae8d190c4a0cae64009416f17195dbb7f7ca732b69e6178e9dd4c66fcb2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "e18d23a4-9082-4b9c-bb85-8fe35106e303",
|
||
|
|
"value": "19f94c523d4488a50584dd3d96500820e4f479cadcef4d14a1dd7cf939cd3154"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "1230aea2-ac12-43d5-b2c0-dcc5936a4565",
|
||
|
|
"value": "dc4277e5f6e76ef3f5c0da8a6703acd69a017747aac0413f7248911e51214641"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "15f87e56-b75e-4e08-aa92-5e74afbafaeb",
|
||
|
|
"value": "b66dab4fbdae54eea59313fd218abc96a54c0bbf0ab774dbe8776de9322510b2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "07f8a2cb-609f-49c0-bc88-ba0ddccd3ab1",
|
||
|
|
"value": "d095e636400ee633ae22488bba77d53f584f1ff279fd604bb6e60c0211d1957e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "e9158e44-6c6e-4d2f-94a7-9720817e66e1",
|
||
|
|
"value": "99027cf9f6fcce91d1d08a8cc15043912e51aff82804d4678c7b453e55899404"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "83f7afdd-5b98-428b-ab8d-67b2603d27b1",
|
||
|
|
"value": "3d753a9e8e6ab22a498f7c6702910ea3e77ca8ef524f8435ac4614a9d4cbf345"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "cbb3a4d0-117a-4b22-ab0f-21d25cde3209",
|
||
|
|
"value": "c75c5d7b4bdedcf5c6e78305d62f6830f4766c4517cf650a36493e19574c507d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "0c46fb33-7287-44cb-912d-8e479bc83da0",
|
||
|
|
"value": "a133b1839bad5616b51915f2dfe420be36e05ee5c5f1c8e81220177b14c12848"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "2ad49413-257e-4d4d-82df-6fb5cccb6432",
|
||
|
|
"value": "01ef286f55d1a15f308f2bed102bec0916d799d8e883a48117cecfe713a74267"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438671",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "ac4885cc-0c79-4b25-bece-cf7029e0a18d",
|
||
|
|
"value": "1887185af63849aea9cdd7855b638110447842f178fca9cd81b76c72acd16e68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "23e519e1-0ae9-47a6-9230-bd41011b25f3",
|
||
|
|
"value": "3dcad2fdebd68390ea4a80398593cfc3360ef51291b853cb3e9a607915ec74cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "80e01f69-f484-4e55-a3a4-4f21728aa03b",
|
||
|
|
"value": "aa7bc130c5340364f61074f7c98651e80db3b08396a4fb449f614e0889acfdd3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "d800cf1f-3016-4a56-afb5-026f60a92e35",
|
||
|
|
"value": "c0b1deaa2598936c284684b50a652f98771a129e882f382ac011d5ab984fd132"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "dddba924-7d26-43a6-9322-d3ca4bf9101e",
|
||
|
|
"value": "1185fa967aa989d5e072577e493d2b307c48181480129d4c45337da64d5bfd25"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "549419ad-48d7-4715-aae4-c9bf9b4a2d3b",
|
||
|
|
"value": "d18019064e5903dcf7c29921c10a7a90176cccd55d9cf3ba1e3e9805c1364df1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "a1608901-f48f-45a6-9247-556e9e9f769a",
|
||
|
|
"value": "644b88ce37d8ccb9258df6fcd74c6b485323dcfd9feb0f961252e6c311241703"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "c3c9a682-9570-4749-a7bf-e1cba7df2965",
|
||
|
|
"value": "0b2e9328d82a045ce00f6b1b449ae32d8997f631f691350ea39d85c78eb66216"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "be9cd757-24dc-4949-a7e6-64dddab746f2",
|
||
|
|
"value": "18e2b7df374a838a57ebf3186b13a26e523cf964afde50b7ba765ed4d5509670"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Backdoor SHA256 hashes",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1725438672",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "1b94e839-39b7-4c7f-bc6c-8841167bdaa0",
|
||
|
|
"value": "d72ea22e6f35e848a2e5870863e410f0434013ad43c3f5b6935168fc07c7d7b0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Object": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "24",
|
||
|
|
"timestamp": "1725438710",
|
||
|
|
"uuid": "738ed577-28cd-4770-a3d6-c483dad9f8f1",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Earth Lusca\u2019s archive",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1725438710",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "d0200c09-74e4-4277-bae3-b61ec9d85db1",
|
||
|
|
"value": "aa5ff64cadabd2d8aba7963c2372270bbfdafa155f85a9a9ec2b57674cf8173e"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "24",
|
||
|
|
"timestamp": "1725438741",
|
||
|
|
"uuid": "606ce5af-e560-40d5-a2f8-240fc0339275",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Earth Lusca\u2019s LNK file",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1725438741",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "4b89593a-540f-4a76-8d81-5b0654353970",
|
||
|
|
"value": "fcf0cf8a19fa16792771310462d36f3c059ed7d36ef90899316313f4626d24d7"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "24",
|
||
|
|
"timestamp": "1725438771",
|
||
|
|
"uuid": "9f87b9db-01c5-4d98-84cb-e17b2aa42cde",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Earth Lusca\u2019s DLL decryptor",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1725438771",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "390569d6-b268-40f6-84fa-746e9d3d3df8",
|
||
|
|
"value": "fd3205edef38248c059898274f5818abbcb757adb707ca47580d4b16772a38d1"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"uuid": "3703fdda-d3b8-474f-8a0c-9b695e321754",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "2f30940d-dd06-46f8-ac34-fe389a04f5b3",
|
||
|
|
"value": "39.105.121.123:9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "d470211b-2938-4868-8204-660b97180b60",
|
||
|
|
"value": "9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "8706dd12-59bb-45d2-b2f1-c4bb888e66ef",
|
||
|
|
"value": "39.105.121.123"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "109a646c-ab3c-41d9-8656-3287acc8935b",
|
||
|
|
"value": "39.105.121.123"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "a0a20df2-6086-4f75-82a3-6235b42f056c",
|
||
|
|
"value": "39.105.121.123"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"uuid": "d1ebc2e3-a1f9-4c2e-a4c1-b2bf15abb5a2",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "a47d4b8d-c895-47cc-b75d-cad114826961",
|
||
|
|
"value": "39.107.101.26:9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "3c304754-9158-4b55-bd9a-92c363a72419",
|
||
|
|
"value": "9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "51187bd4-e053-45fd-a01d-777c35c26a57",
|
||
|
|
"value": "39.107.101.26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "4e24c963-3f10-4cff-826a-f22ad179b173",
|
||
|
|
"value": "39.107.101.26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "483aab85-af94-4a2d-b454-9cb0fff57372",
|
||
|
|
"value": "39.107.101.26"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"uuid": "0d9623e0-2486-4cc6-a25e-d41c571145a4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "048fb4df-1708-4e58-9db2-7e558051e4bb",
|
||
|
|
"value": "47.94.223.124:9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "d430ff85-70e7-4f1a-adde-f05f7b71be2d",
|
||
|
|
"value": "9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "e33008c9-d258-4284-9585-62e804289ae2",
|
||
|
|
"value": "47.94.223.124"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9f49992f-1d90-490b-bb72-87327e8a1dd2",
|
||
|
|
"value": "47.94.223.124"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "e0b4053b-ca0a-4ac5-96fc-7e644ca9b669",
|
||
|
|
"value": "47.94.223.124"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"uuid": "a0238065-a9f8-4177-8906-28ae6e55e76f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "da916fa9-3e84-4e1e-9f4a-467c79faee1c",
|
||
|
|
"value": "47.94.166.190:9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "5bca79dc-1fa8-411c-90c2-86265b381a8e",
|
||
|
|
"value": "9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "fa207e3f-e9fd-445e-abd0-969a5d5c0254",
|
||
|
|
"value": "47.94.166.190"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "460e655e-b69f-448a-9fe7-6a8488a1345a",
|
||
|
|
"value": "47.94.166.190"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438822",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "c98cb6dd-dd3a-480f-a9a2-2b57887fdcf3",
|
||
|
|
"value": "47.94.166.190"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "5d4e8da0-337d-45f9-a5df-9cbcedb20d30",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "3b0ea4f0-52d4-4218-906e-0dbe00f54def",
|
||
|
|
"value": "59.110.136.109:9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "fb4d0bbb-7524-4863-97c8-a24368e4f5bf",
|
||
|
|
"value": "9999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "11e2d909-0666-4c85-a2bd-e06d656c0ed9",
|
||
|
|
"value": "59.110.136.109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "66ea7e8f-1faf-4395-bbd2-b503f723f7bc",
|
||
|
|
"value": "59.110.136.109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "ebc668e5-6f56-43c3-a74f-895bad4c29ab",
|
||
|
|
"value": "59.110.136.109"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "0972b7ae-d1e2-477a-9496-424cca8129fd",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "88588220-1249-424e-b3b3-a25c38738ed5",
|
||
|
|
"value": "123.56.45.175:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "2ca63fbd-c349-4282-809b-480675e422f9",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "38ec03a0-5951-491d-a648-d97cb7264ca9",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5246ae1a-d9f7-440b-892b-9d8b5bbc6f4f",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "332b824d-b86a-4cfc-98f8-f2880d262ac1",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "404d5596-ba49-44b9-84ea-543817eb32dc",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0ba5f40b-340a-4342-ab26-93a5ed121830",
|
||
|
|
"value": "123.57.223.22:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "8c63137f-7ae5-4d34-8dfd-e4bf1f3b3435",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "e252e8e7-8a78-4c53-b948-49b954067941",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "7d73c93b-a052-4642-a067-214358d72eb0",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "af4b8986-cb10-42b2-9206-78a24d01eaa0",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "41199058-3e48-4d8e-a0a7-ae55888c91dc",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "fdef88cb-80ab-4c06-9b85-7c3beb79413d",
|
||
|
|
"value": "39.107.75.91:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "b71c99de-6d63-4522-b35e-e2dfb7c54825",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "94b3a62d-4056-49d1-8e78-72c58c1e6ccf",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "75ebfced-4824-4597-96a1-45cea2168706",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0e54a3bd-ee51-4f82-b2e4-fdd8eb011abf",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "36354ca1-bbf0-4a2d-a6b6-540818cc4d89",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0ad8c155-80e3-4928-8b23-231dacace606",
|
||
|
|
"value": "182.92.101.4:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "6dda6443-e09a-4b27-b447-0ee6ea9f9cf8",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "fd03a9da-990a-4826-879d-77f4c2b14f87",
|
||
|
|
"value": "182.92.101.4"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"uuid": "bc9dbdb0-426e-4b2d-bd63-bd8b36c0bab0",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438823",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "a5fac885-52b4-44b6-bb41-1177c76ff6f2",
|
||
|
|
"value": "123.56.45.175:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "dab3992c-5631-451d-95af-ba6fc60d1655",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "ebe76626-a7f1-4818-98a9-4e6e0109bc97",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9e2c3e69-4b1a-45df-96b5-0d69e312ea50",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "b2253d7b-f604-4b5a-86d7-4e4d4b29e39e",
|
||
|
|
"value": "123.56.45.175"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "797a6a79-235b-4697-aeb7-c8bd7fe4493b",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c52173d7-e39b-49e9-a153-8929644ef369",
|
||
|
|
"value": "123.57.223.22:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "437a4f58-3f04-4c9b-af35-ad8319febf85",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "127d027a-c617-41e8-af5f-c7269c5fb151",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "7cf39415-6fba-4129-8012-1033eebf56b8",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "9973c4fd-f7ab-4132-bfdf-e3bd13ebff34",
|
||
|
|
"value": "123.57.223.22"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "ef37f5f7-546d-4199-b33d-0b7644f604c8",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "36100d1d-921e-4bb6-a7a3-e6f2756824bc",
|
||
|
|
"value": "39.107.75.91:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0810b5e1-3581-493a-95fe-911090a5f8ca",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "59ec8cca-82e9-4efc-a8bf-9aa882904361",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "e834e3db-6443-4872-8577-52e11e4d31c3",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "b496c0b9-4989-4271-ba81-8a999bdb692c",
|
||
|
|
"value": "39.107.75.91"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "772f7dc5-eb2c-43f2-809c-43e7f1759173",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "edb970a7-4ed5-480b-b1e5-ef37f55e61e8",
|
||
|
|
"value": "182.92.101.4:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e36c9163-175a-4e1c-a61b-d41d7a9e25df",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "455ee357-9f93-405c-932b-a9ed7eca65ca",
|
||
|
|
"value": "182.92.101.4"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "f6cebbbc-35a2-4e16-9088-561b0a17b154",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "d97e4189-d510-4e91-87e8-c2b9a1f1fba5",
|
||
|
|
"value": "123.57.6.3:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "4f9e7c86-bae8-418f-b82f-a35d3e251182",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "1d34ff5b-4717-4181-bb40-d8c1f67cafc9",
|
||
|
|
"value": "123.57.6.3"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "ca01d513-4b45-45cf-83f4-843f65f794ea",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "7b22b189-aa95-4ab4-ac8b-ce73c36a8e73",
|
||
|
|
"value": "39.107.67.131:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "7633abbc-e532-43d0-9f9d-a35756152cb9",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "58daa83d-b5b4-4a64-a364-56533c9c5a28",
|
||
|
|
"value": "39.107.67.131"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "75cba4a7-708f-475a-bac0-cc4a38529842",
|
||
|
|
"value": "39.107.67.131"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "72340480-27e5-4ab7-94b9-a9c61236f1b4",
|
||
|
|
"value": "39.107.67.131"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "89f3c179-ffcb-45ad-b2c9-e15bbfba373b",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "947230db-88b8-45c8-aa3a-e5a1b8e917d4",
|
||
|
|
"value": "101.200.156.217:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "f3a5038d-f573-43a2-b6c9-cf3ddf22982c",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "a483f215-b350-4853-9af7-b979df71cc8f",
|
||
|
|
"value": "101.200.156.217"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "2a1b1ee7-f128-4b3b-9049-505b6997403b",
|
||
|
|
"value": "101.200.156.217"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "82d36a26-65df-46c7-8389-85921def4d16",
|
||
|
|
"value": "101.200.156.217"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "61ccc272-dba5-4a5c-bb82-76bf6c2437dd",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5c24c674-9ce9-4947-bb1b-01a528240118",
|
||
|
|
"value": "182.92.155.149:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0c017cab-a0fc-4f1e-80ab-f9f488336877",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "c58e741d-93c5-43f2-ae67-e0b5abd41a03",
|
||
|
|
"value": "182.92.155.149"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "259629cd-bda6-4a8f-95c3-c9a7f7d3bac5",
|
||
|
|
"value": "182.92.155.149"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "66b79a81-926e-49d0-8fb7-682789815068",
|
||
|
|
"value": "182.92.155.149"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"uuid": "a77774d6-410e-43df-aafd-88d9ec7a3879",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438824",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0e62b5e2-4bcb-4281-8686-526e42f5f43d",
|
||
|
|
"value": "123.57.218.176:81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "fc6145ea-8205-43ef-a5f7-510188267cd4",
|
||
|
|
"value": "81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "3e1dd8dc-1e3b-4fc6-851c-236dd03bb008",
|
||
|
|
"value": "123.57.218.176"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "962c96ec-6a18-4975-b858-f5f56a3bfedd",
|
||
|
|
"value": "123.57.218.176"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "55b86780-99d5-4ed2-a51b-d246c7fb84c0",
|
||
|
|
"value": "123.57.218.176"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "1d949321-2421-4801-8782-b57e1f76f386",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "08e9783a-1864-4d58-9307-7ecd7a7bf38d",
|
||
|
|
"value": "47.99.78.41:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "2df8542b-7316-4eb5-8583-61427459619f",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "e8396ee1-3850-4479-a7d1-e28598f41082",
|
||
|
|
"value": "47.99.78.41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "f8a158bc-14da-4525-bdd2-1a6531d82f93",
|
||
|
|
"value": "47.99.78.41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "1721e45d-6d3d-4807-99b5-a39d3a680e9b",
|
||
|
|
"value": "47.99.78.41"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "0f17a32c-ab98-493d-9105-b227ca0af28b",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0ce900c9-e5f6-48f4-b064-a56396a6e4d6",
|
||
|
|
"value": "47.96.97.77:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "69d5a324-4c29-43d4-a3f9-7ede70db9377",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "3992420e-61b5-432c-8f2c-76a6643fad26",
|
||
|
|
"value": "47.96.97.77"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "a566341d-6c3d-4fc2-953e-76720b8e18ac",
|
||
|
|
"value": "47.96.97.77"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "11b4fbbf-c074-4628-a32d-1fb47510c98a",
|
||
|
|
"value": "47.96.97.77"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "2aa98172-9391-427b-b116-0677bfcb56c1",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "407abe79-9e58-4924-ab1c-03c080c6ab2f",
|
||
|
|
"value": "47.96.5.136:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "10020547-7ea3-44fe-b476-61e33bf59a72",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "1236873f-26d9-4a08-ac14-16bd879e9571",
|
||
|
|
"value": "47.96.5.136"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "76ebc7ef-e4af-49e9-a7f5-b7aac2b8f90f",
|
||
|
|
"value": "47.96.5.136"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "78d57749-d038-4082-a41f-856b8711ac17",
|
||
|
|
"value": "47.96.5.136"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "b39c06f6-c4cb-4227-973c-031f3c50e1c5",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "d38274b9-73ea-4043-bada-8a78d3f6d17f",
|
||
|
|
"value": "47.96.135.49:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0867c2aa-0264-44c2-9ae2-5a19cc7e9b67",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "4b4f7047-3f57-4a8c-b002-8be30c98b62f",
|
||
|
|
"value": "47.96.135.49"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "0229764d-a170-4135-ad22-e103bd77f1c3",
|
||
|
|
"value": "47.96.135.49"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "a86810f2-6f46-47af-aea5-7de2cc5f94e2",
|
||
|
|
"value": "47.96.135.49"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "fcb77305-11c4-42f5-8a78-5f0d30d32720",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c46ee733-2b9a-4bf5-8fb7-a6153615d90a",
|
||
|
|
"value": "116.62.120.97:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0f32d68e-67c8-48a1-a966-bd47d0e5ad35",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "4df58302-f760-4856-9685-6c0d666d3eb6",
|
||
|
|
"value": "116.62.120.97"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "86a2f841-4625-43fe-855f-1b4237394e1e",
|
||
|
|
"value": "116.62.120.97"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "cfaec2a1-be12-45e2-b940-8ae89fb71ccf",
|
||
|
|
"value": "116.62.120.97"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "e9000aed-7bce-4e65-a58c-0438a6b83cc4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "43f2a147-1086-4af6-b7d5-7aac9b650478",
|
||
|
|
"value": "123.57.60.94:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "4e9e9e35-b8e2-4c5d-9476-c3155711fb97",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "8d31d68e-d819-4719-8752-5dbe4de8567d",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "6c6dcadc-cb10-454f-859d-3ceda37dfe03",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "6e58249c-6288-400e-a9d6-e1049498d13a",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"uuid": "e22ce872-dcf3-410f-931d-822b86b84717",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438825",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "daad4d38-5152-4ee7-a562-621c08c4049d",
|
||
|
|
"value": "39.105.107.130:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "ad64be73-82f4-4721-bd51-15b27e7ab2ce",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "91565454-f086-434b-b3a5-6f65ca096852",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "be7f6e9a-bc36-4adf-a1e6-0842460bcd4e",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "abc4849f-ab05-43cf-9933-e64b8c885806",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "8ad7cfaf-fc15-44e8-9a40-c310be215e0b",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0bb2dba7-0879-4bd4-8b6a-5a5c580dbaa9",
|
||
|
|
"value": "182.92.233.242:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "ad788f7a-f4e3-49c3-9641-09aa34152af0",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "806a5fb4-fdff-46b8-8c6c-253f54aedbe9",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "a1aaf280-3eaf-4bf3-87d3-41bf25afd35a",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "ba14ecb4-bb70-44d0-b997-65f9c0af346d",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "b58a2ff2-1a5c-41b9-b5f8-7780e54f36d4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c6d33629-3336-427c-877a-7b4765d37739",
|
||
|
|
"value": "47.94.229.250:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "c4ad895f-b508-4a94-aef1-6ee38e14d32d",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "67039082-e26d-4ef8-8850-cd45a1e9a0e9",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9516327d-ac89-48a9-ac39-d4f92cc5dedc",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "87c1d559-bc02-4701-8b72-8bdd1bdad17b",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "93c4fd13-339b-4307-b3ad-1cc5c1a6b7ec",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "5b9d9a63-3ec0-4c63-a8f2-afddb162e39b",
|
||
|
|
"value": "182.92.169.60:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "00dde3c1-6ecc-41d2-9c4a-d43ed9229a35",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "759e04bf-0186-4d8d-aa6d-8a50e8db36eb",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "bec14372-66e6-4c7d-a2b8-f2e532dc55d5",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "68cfa4cc-1f00-49e3-813c-eb07e9e54b8f",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "b1b1f689-4f04-4ebb-8c73-c0702ebc6425",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "010d37f9-ea24-4c06-9fe3-40cf42e70fa9",
|
||
|
|
"value": "47.96.160.242:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e1e06bce-bfd1-48c0-b2f9-f7a4b494ec57",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "f36eba74-2add-4ba2-ac76-a4d4beca129f",
|
||
|
|
"value": "47.96.160.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "1143a506-2081-4816-94a8-3de8cc82758b",
|
||
|
|
"value": "47.96.160.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "300e9ffc-7da3-4d35-b82d-659b488af6ba",
|
||
|
|
"value": "47.96.160.242"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "ba7519c9-a0ee-4e1c-af69-dba72392ee0f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "1f375158-bc9f-48de-be32-b05fc08eb34c",
|
||
|
|
"value": "116.62.231.152:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "7d64bf5f-0327-4034-85a5-e7f46e030472",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "bad53973-081b-4640-9cc7-9984d9271c27",
|
||
|
|
"value": "116.62.231.152"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5d542257-d6a1-4e03-8209-d208f313098f",
|
||
|
|
"value": "116.62.231.152"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "6dc2a788-9365-4839-85c0-36131256a03c",
|
||
|
|
"value": "116.62.231.152"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "59131cc1-f932-48ec-a9bb-d4ff916e6f33",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "808bcf40-b694-410a-94eb-4fd2d63032b7",
|
||
|
|
"value": "47.96.13.99:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "b6a1799d-9d14-4c1d-b8e2-1bc59a580b98",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "54b3dea1-62d6-496e-9b40-e4f23ab07593",
|
||
|
|
"value": "47.96.13.99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "27442dc6-cf7d-499b-8788-0f436f88310f",
|
||
|
|
"value": "47.96.13.99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "3599096f-689d-4b19-8920-41957d5492c9",
|
||
|
|
"value": "47.96.13.99"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"uuid": "704fda16-0453-48e3-89ce-187aeeae5ec6",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "341ff0fd-8edf-4402-943e-07bd5fc3de53",
|
||
|
|
"value": "47.98.173.175:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "91acf1f0-9526-4ac9-b5eb-3961b162bd18",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438826",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "81b72ba7-7406-447c-a1e7-61ef0cc904b9",
|
||
|
|
"value": "47.98.173.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "6cb3440c-2bc7-4ade-9bcb-4e292345d49f",
|
||
|
|
"value": "47.98.173.175"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "262f9255-45c7-4c80-9fc5-fd625e8f24d7",
|
||
|
|
"value": "47.98.173.175"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "c3d80e5b-f965-4c00-81c0-6deff3a9b127",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "b9b3d8a4-3aa2-4b2a-99e3-ec5750017558",
|
||
|
|
"value": "47.97.109.62:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "b10b3c3b-c5b2-4417-8448-451ac98594cf",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "45a41e57-56f1-4326-9c4b-9fdacf853558",
|
||
|
|
"value": "47.97.109.62"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "74cd28d2-e0ed-451e-b4c3-8acee5e1f1cf",
|
||
|
|
"value": "47.97.109.62"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "7c22451e-52b2-415b-af48-882e823ceda9",
|
||
|
|
"value": "47.97.109.62"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "56fd4dc2-4c7a-4b8e-88d8-2a5c1f232f2c",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "1572b37a-80a2-4307-bccf-3345188cb4eb",
|
||
|
|
"value": "139.224.254.181:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "2e24333b-720d-4ac9-8738-001f60489081",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "1b028233-5ca1-45e6-8eb7-6229b6fbf695",
|
||
|
|
"value": "139.224.254.181"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "1f1af81a-45cc-46a9-be34-79b1f395c951",
|
||
|
|
"value": "139.224.254.181"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "c27d1ddc-61ff-4a51-90ca-233b11d43724",
|
||
|
|
"value": "139.224.254.181"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "7e3644da-6bfa-4538-a64f-4c009a76d2ea",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "63540435-6959-4c0e-8b5b-ba357071f0a2",
|
||
|
|
"value": "139.224.45.232:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "3f7cf588-8869-4c5d-96af-4b55bb471fb1",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "8e0ea183-232d-4b7d-9501-252b084ab7bd",
|
||
|
|
"value": "139.224.45.232"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "13591a20-ea95-48af-9020-0e3ecd0fc012",
|
||
|
|
"value": "139.224.45.232"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "2ebb13d8-9185-42c4-956b-40a43dfb7337",
|
||
|
|
"value": "139.224.45.232"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "6818bd1a-ec62-4191-a208-e36d0733e128",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "403666d9-8c83-4bcd-902c-a0656541e844",
|
||
|
|
"value": "47.102.36.88:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "8c440191-d3c2-4cbe-a87b-a9eb699de085",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "7ba57988-c6ed-4a38-946e-ea0bf2eda60e",
|
||
|
|
"value": "47.102.36.88"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "0c303ccf-91b7-4f3d-a6e7-60afa5f0d338",
|
||
|
|
"value": "47.102.36.88"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "71458e32-52a8-4fe5-9d6c-e8a39a5ecc2f",
|
||
|
|
"value": "47.102.36.88"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "cbf176f7-c319-43bb-9df4-c3fb9133a9ed",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "f4a0218c-236a-442f-9032-994c2ae3a05a",
|
||
|
|
"value": "47.101.43.111:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "21b5737d-8c6b-4a69-a4e8-137a3263c2ed",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "f043386f-56cc-4cff-9ca1-04fe2ec3639c",
|
||
|
|
"value": "47.101.43.111"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "068fdefe-4ecc-4c8e-af53-a4ae8be7e4f4",
|
||
|
|
"value": "47.101.43.111"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "1ce8f0e5-844f-4bd1-bcdb-fb5ac7f92377",
|
||
|
|
"value": "47.101.43.111"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"uuid": "2e12bac8-6753-4705-a35e-6c3ffb5e8b63",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "b511e5ff-6a8b-43fe-b87f-826bef7b9dee",
|
||
|
|
"value": "139.196.196.178:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "82890fcc-c1aa-4b79-bf90-b8c47ef7bcfd",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "5297d8c7-1327-4a74-bbe6-6b7cef67f3e3",
|
||
|
|
"value": "139.196.196.178"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9c51a59c-a5d3-46e3-ab08-e56ff48e7227",
|
||
|
|
"value": "139.196.196.178"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438827",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5bc376de-45bb-47b4-90a1-705b3b46d834",
|
||
|
|
"value": "139.196.196.178"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "43eba737-1fab-4605-86a5-cdbd1bd86e61",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "426acc47-7fb1-450c-8d9d-022ca8c45735",
|
||
|
|
"value": "123.57.60.94:8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e2db48e7-8bd7-484a-baa7-5810ec20fa37",
|
||
|
|
"value": "8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "d944b4a9-5a6c-4da9-bf51-f431a057e900",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "8d05f109-c413-43e2-bb0a-1559a33640a5",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "2c011b6f-e75c-4555-ae01-335f2aa62ece",
|
||
|
|
"value": "123.57.60.94"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "ab92e09f-1745-417a-a4d0-c5ce3e86f6fa",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "03de280c-eb85-4506-8adf-8dc6e6f5736e",
|
||
|
|
"value": "39.105.107.130:8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "934b1423-ff2e-47cb-9498-31441d511150",
|
||
|
|
"value": "8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "c7a686f4-84b3-4feb-a2b1-71b21561b2bd",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "4b7e77ea-7dc6-40e3-8224-83dc0d576413",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "166fa85f-9a7d-4194-9d86-38bef3d2235b",
|
||
|
|
"value": "39.105.107.130"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "0ec41c82-4d56-4ba8-a55f-85e5521c8034",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "2b1c3358-d6db-4a26-b818-bee9e972eb74",
|
||
|
|
"value": "182.92.233.242:8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "6a767409-23e2-488d-b4ce-1f2cb0097435",
|
||
|
|
"value": "8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "dd45dd59-0133-4ce4-92b5-7bd11f747382",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "f11f2e9c-e6bf-434d-ab5c-123cc3dabf4c",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "4322beb1-e60c-4ac3-93fb-0e40fe42c7d1",
|
||
|
|
"value": "182.92.233.242"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "6800f22e-605a-4144-b273-85b554ed9ee6",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "606cfa51-9b8b-4087-b191-de049893f38a",
|
||
|
|
"value": "47.94.229.250:8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "086cbd41-16d0-40b7-840d-2662d17bebe8",
|
||
|
|
"value": "8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "7a659e28-69e7-4df8-bbf4-56a279cd9c40",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "6c3f8a33-2c75-4c3b-9751-b3557f2a7a15",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "4151c627-e7bd-4783-ba78-044a92da7abf",
|
||
|
|
"value": "47.94.229.250"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "bd907382-371b-463b-8290-bf424018525f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "a6ed344f-2180-45a4-a603-2ddb5fbb04a2",
|
||
|
|
"value": "182.92.169.60:8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "db1ab497-940d-4b98-ab15-01e686ce7d48",
|
||
|
|
"value": "8081"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "86cd4fbe-2c3e-4a99-a5f6-5ac33a7b59fb",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "accde64c-9f19-4a97-b1d7-4ad7987c90d2",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "9870bcf9-a385-477b-968f-0c85d3253da2",
|
||
|
|
"value": "182.92.169.60"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"uuid": "679baa4b-19c1-4883-81b3-a104194a79a9",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "97170f71-0e28-471d-9b9b-8574151e9868",
|
||
|
|
"value": "47.100.98.234:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e692c06c-e900-40d2-a435-163e691054be",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "c27e8f5f-e64d-4975-9c70-6cb8d735736f",
|
||
|
|
"value": "47.100.98.234"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "776eca24-dd4f-4136-8b42-4ff30e87898f",
|
||
|
|
"value": "47.100.98.234"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438828",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5321d139-76f6-402e-b937-60807897e585",
|
||
|
|
"value": "47.100.98.234"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438830",
|
||
|
|
"uuid": "7fd0ffb2-1f41-4555-a7ff-d75653ab4324",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438830",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "aeee957f-7c3e-4017-905a-56c5cd47bf42",
|
||
|
|
"value": "106.14.175.235:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438830",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "276c4bf4-3cec-4670-8bd4-c83e285fe6a7",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438830",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "747a8bf6-d447-4c23-9c80-c132c2c05987",
|
||
|
|
"value": "106.14.175.235"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438830",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "249b862f-469a-4f2b-9afc-d396741a60d4",
|
||
|
|
"value": "106.14.175.235"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "25e6d33a-674d-43f7-b637-438135a46545",
|
||
|
|
"value": "106.14.175.235"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "7dc76216-7490-40a9-82ca-0bc0296def20",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "98e7dac9-5445-4249-a6e3-4f411470d627",
|
||
|
|
"value": "106.15.193.24:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "04ba1bb4-6593-4be8-9b0d-4711c5376fc6",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "febc338f-20cf-47f5-ac0a-5d6de3adda7e",
|
||
|
|
"value": "106.15.193.24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5bf5e17d-4933-4a29-a63f-7fa6d298bb46",
|
||
|
|
"value": "106.15.193.24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "9ca282d4-d07f-4fed-bdf0-94e88d84a6ac",
|
||
|
|
"value": "106.15.193.24"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "e9fd2c4c-ddb7-4a92-bc3f-305822d1c3d8",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c853de91-eff2-42f0-a848-83d55b2b5b87",
|
||
|
|
"value": "47.100.121.195:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "6c26477f-7e9c-4a62-ab7d-2c635d01e1a4",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "ba5f5099-b405-4fd1-8c67-86bc925a578a",
|
||
|
|
"value": "47.100.121.195"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "3e438d41-89e9-45d9-82e2-4e98e7e5e0ba",
|
||
|
|
"value": "47.100.121.195"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0bada4d4-8407-412c-ad0b-a4534fd53953",
|
||
|
|
"value": "47.100.121.195"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "4f6d7b0c-9ac5-469b-9a8d-eaaae4d533b6",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "326c6e97-7275-4ba7-a9b8-6ee036bd4263",
|
||
|
|
"value": "47.100.59.42:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "be8d57d2-ec90-444e-b76b-e7020f53e9de",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "c66ee8fd-690c-446b-be46-78c732955242",
|
||
|
|
"value": "47.100.59.42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "8fa81c07-1b58-4680-92f0-813a75a7fea6",
|
||
|
|
"value": "47.100.59.42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "39f6354b-5401-41e1-93ed-ff9c485afb31",
|
||
|
|
"value": "47.100.59.42"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "29f950fe-036f-49c2-8799-1d2107d47ff4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "e8563551-a3c7-4a4e-9fc2-e375d7ede0df",
|
||
|
|
"value": "47.100.160.164:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "20274687-c715-4305-aa05-791e16f496be",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "bcdab21b-eaaf-4af4-97fb-faf94661b4e2",
|
||
|
|
"value": "47.100.160.164"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "50c58372-db5f-4e0e-a43a-fd0470817085",
|
||
|
|
"value": "47.100.160.164"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "d6ee9ae7-4c2c-408f-84f7-486203acc012",
|
||
|
|
"value": "47.100.160.164"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "f3f8fac8-7238-4b87-9016-5a26d681d90c",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "b09ae151-e918-4b57-b895-768f0d52153c",
|
||
|
|
"value": "47.101.48.168:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "3b1d031d-0e30-44f3-ac68-c0925df41d3d",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "83052171-0bcc-4450-a0a8-d8b62682fcff",
|
||
|
|
"value": "47.101.48.168"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "a2331de8-e1cb-4202-9cd5-34f9c6570874",
|
||
|
|
"value": "47.101.48.168"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0230b516-7529-4dbe-949f-de75037699d5",
|
||
|
|
"value": "47.101.48.168"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"uuid": "dfc02e44-cdd4-4a61-8c49-15bc8682b537",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0f209673-bbf9-490e-9385-08abf47056e7",
|
||
|
|
"value": "47.101.137.187:8032"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "5135d4f9-1394-4893-b013-ff751124503d",
|
||
|
|
"value": "8032"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "a9b9dbb6-f7f1-42c6-bedf-981a34ff8794",
|
||
|
|
"value": "47.101.137.187"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438831",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "ded31235-75c3-4a1d-87a1-174a2cf392d4",
|
||
|
|
"value": "47.101.137.187"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0783c75d-2c8d-4c3b-bf7c-84f83fce55ea",
|
||
|
|
"value": "47.101.137.187"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "0dc20a1c-1e2b-458c-89f8-ed3a8c7b8db4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c4ff729a-6562-45fc-8059-2a461d3fed53",
|
||
|
|
"value": "139.196.89.210:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e62db744-85b2-46db-80ac-c81b1ffc5aa8",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "6859f343-4915-4e31-8507-e365423eb8bc",
|
||
|
|
"value": "139.196.89.210"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "dbcab2a2-ecc7-4d95-88e2-1029dff8915f",
|
||
|
|
"value": "139.196.89.210"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "e597b368-1a55-40be-a6bc-16d34a52394b",
|
||
|
|
"value": "139.196.89.210"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "3aa79f5c-515a-47a8-b7a2-f18d4053b2a3",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "3658fecd-45a5-466e-bbae-25bb4058b032",
|
||
|
|
"value": "106.15.90.75:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "01c89824-06b8-449f-ae66-6532e617efe9",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "26a7ad37-b40b-479e-955e-3b2b8d3fdcca",
|
||
|
|
"value": "106.15.90.75"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "285f0f93-2b9f-4d03-83fb-77000be036a8",
|
||
|
|
"value": "106.15.90.75"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "9df24a6d-3af5-42ee-9295-50dbc391d210",
|
||
|
|
"value": "106.15.90.75"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "951c5bea-f542-4ba5-8579-3d4b0b561021",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "f4b57498-8730-4fee-9790-ef103bc5175e",
|
||
|
|
"value": "47.93.38.26:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "41bd4eef-9b6a-451d-80fa-3924b9b37739",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "e763036e-0869-4f4f-aafc-147766d52679",
|
||
|
|
"value": "47.93.38.26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "da6338ea-2ec0-4391-8a0e-0a54bb3550a5",
|
||
|
|
"value": "47.93.38.26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "73c697e0-b093-4cc6-8609-1158276a063f",
|
||
|
|
"value": "47.93.38.26"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "d6c08187-2610-456c-81f7-9be5f6d93e99",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "80c9cd5e-f16e-4e69-8f66-88e123d73e33",
|
||
|
|
"value": "39.106.135.228:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "7d43a6e6-e1fb-4b21-aaa3-022f422d6ee8",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "830a1148-6e63-4a28-9d44-b195e3d1eb07",
|
||
|
|
"value": "39.106.135.228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "f2c6b100-a932-444f-baab-c31d2102f4d0",
|
||
|
|
"value": "39.106.135.228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "222cc76a-6ecb-4703-9445-25db47a06a58",
|
||
|
|
"value": "39.106.135.228"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "8f7ee65f-af9f-4739-ba09-e31fd295b71a",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "897e4436-0c3a-4763-a2dc-e09687b49a95",
|
||
|
|
"value": "47.95.198.228:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "a9a92fc1-0265-4be8-b5ff-ec33cc444380",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "3de6338b-519b-47b6-bd61-df4566a96559",
|
||
|
|
"value": "47.95.198.228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "dd00fd42-753e-4244-bdb1-bb82afa456e1",
|
||
|
|
"value": "47.95.198.228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "e08a1f13-581d-417a-bd47-afc1bbaece12",
|
||
|
|
"value": "47.95.198.228"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "6cb75b00-6d46-41b0-9168-ffe6ca22f203",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "2a83d0f7-69ce-4fd6-8584-a9fe22879a74",
|
||
|
|
"value": "101.201.68.58:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "8c44c72b-a62f-4e5b-af49-0f4a407fef52",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "1e482be0-80de-4790-9f14-6eaa8d460881",
|
||
|
|
"value": "101.201.68.58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "75d8601c-f4a8-42db-a5e5-2a241e168887",
|
||
|
|
"value": "101.201.68.58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "95e55d06-0fda-4b89-8e6e-cbb1feb4c7f1",
|
||
|
|
"value": "101.201.68.58"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438832",
|
||
|
|
"uuid": "41c5818e-25b5-4c5c-abb6-c1335c450bff",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "eb8d9045-82cc-4af1-9abc-ccf6e7315a31",
|
||
|
|
"value": "47.94.194.248:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "bb3fef26-3c5e-41c2-89f3-2f7760ab9fb5",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "3768e436-18f7-49ac-9d83-91de72d3aa8b",
|
||
|
|
"value": "47.94.194.248"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "3b3732ac-36a4-4f98-b5c2-65e89639a2a5",
|
||
|
|
"value": "47.94.194.248"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0b11ea65-7afd-4209-be57-7a56f4f36096",
|
||
|
|
"value": "47.94.194.248"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "92832610-223b-49a8-926a-17003fa15eaa",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "4eec0f13-b876-4542-ac90-1cf4c3062a74",
|
||
|
|
"value": "182.92.243.166:1433"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e49fb938-d979-4ec5-b50d-7a9f1f871ea3",
|
||
|
|
"value": "1433"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "bbc22993-1328-475e-b79c-e367e699a0ee",
|
||
|
|
"value": "182.92.243.166"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "6705e695-5984-41db-b791-17ae338ed94a",
|
||
|
|
"value": "182.92.243.166"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "a3eb02b1-020f-4148-bd4d-a4749c3016b3",
|
||
|
|
"value": "182.92.243.166"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "ddfe6c02-70cd-4a21-b051-2367586334f9",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "2b9fa5c2-ee0d-42f7-9de7-45849a7a7196",
|
||
|
|
"value": "47.95.168.191:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "ff17c184-d99b-4124-9b94-9aa1babf22d3",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "b30f60a9-a0b9-4291-b815-9093e0053abb",
|
||
|
|
"value": "47.95.168.191"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "ccf184ff-526f-4e4b-930e-228e47d2ac42",
|
||
|
|
"value": "47.95.168.191"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "3b5b09f9-7e86-4968-93ba-4241fd17d771",
|
||
|
|
"value": "47.95.168.191"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "5e7661ee-2af2-4011-b1d2-0ae729a94b3f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "a94cbb0a-dff5-46b2-8995-83d3fd9c69db",
|
||
|
|
"value": "47.98.121.179:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "980e9d29-55c5-4713-b420-285a823d0d4e",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "4cceae53-5b8a-469d-8c90-e84db4df8b07",
|
||
|
|
"value": "47.98.121.179"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "10609710-3a34-4ff0-a0f1-f951f97f04af",
|
||
|
|
"value": "47.98.121.179"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "ed54ffa5-89a6-4e8c-a605-3694f5f79454",
|
||
|
|
"value": "47.98.121.179"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "75987c32-6c64-4550-831f-c2511748db98",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "da77c967-9bdd-4a5e-a907-4a44d8cb12af",
|
||
|
|
"value": "47.96.106.167:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0213a49d-07e5-4fd4-925d-598f309c5dab",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "f073a381-50d6-4ee5-b78f-00e928ad4594",
|
||
|
|
"value": "47.96.106.167"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "e20a822a-05b2-444f-88f4-7570296449b4",
|
||
|
|
"value": "47.96.106.167"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "74eb0369-323e-4939-b3e2-99d5e4e04739",
|
||
|
|
"value": "47.96.106.167"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "cd1ca96f-2462-4c47-8a0d-6569a6ba95c5",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "e4dea665-2b5b-4c03-ba3d-7ebcd87f50c3",
|
||
|
|
"value": "116.62.142.53:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "14a021a9-a547-4aef-a902-afa19ac8f1c2",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "ae67edd2-2409-43cc-b2f6-23dd7a787504",
|
||
|
|
"value": "116.62.142.53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "59fcce7d-ff12-4064-b6a8-2fee39e7aae5",
|
||
|
|
"value": "116.62.142.53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "f120e3ef-03cc-4665-8890-e9677c032a57",
|
||
|
|
"value": "116.62.142.53"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438833",
|
||
|
|
"uuid": "e9c54b08-da29-48c5-b710-7984d39fd852",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "2f0ae6d8-0228-4411-b44b-e92df3956fc8",
|
||
|
|
"value": "121.40.70.23:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "22c7bf4d-f526-4f1e-aaeb-3f8e8e70f103",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "bb77417c-ada7-40e4-9d09-5854b1b80ef1",
|
||
|
|
"value": "121.40.70.23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9a1a6f91-4b1f-4d3a-90a3-0ddb54333b54",
|
||
|
|
"value": "121.40.70.23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "d5dff4b1-f8ce-4227-8964-9098abee11be",
|
||
|
|
"value": "121.40.70.23"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "1940017b-ef8c-4dc6-8af2-04e8e22d1fd5",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0e8b5615-14fd-464f-a5f2-47423e00a220",
|
||
|
|
"value": "118.31.53.137:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "0660b772-feb9-446e-bf93-f49edec5477d",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "77e2f3ac-9099-4e0c-84ca-8577dcb67f59",
|
||
|
|
"value": "118.31.53.137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "2edf7f23-801a-4b85-851d-d2e035c3b5a9",
|
||
|
|
"value": "118.31.53.137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "25d6b4c4-1e8f-4b5e-9bc4-a2df2e93e692",
|
||
|
|
"value": "118.31.53.137"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "5516e33a-0e3a-4941-9543-0328569422de",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "318ce5f5-5973-4a1a-8b94-2cc0b2eec345",
|
||
|
|
"value": "47.98.50.198:80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "e86ddece-4a0e-4fad-967a-da8012b7100b",
|
||
|
|
"value": "80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "4327557c-755d-488e-9f9c-3ced6cb2b651",
|
||
|
|
"value": "47.98.50.198"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "c615ade5-ba27-4f45-a32a-07f5eacd74b4",
|
||
|
|
"value": "47.98.50.198"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "c023e88f-a569-4f7f-b5b1-c922b24ca285",
|
||
|
|
"value": "47.98.50.198"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "10817907-196b-4c07-99e4-69861319ed6f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "38d9f7f0-5961-42ec-b55e-d50069c1eded",
|
||
|
|
"value": "39.106.40.121:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "35e34aa2-e9d5-4f1f-833d-239597ce9ae6",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "483af80c-3fca-4f0c-a8c0-7445c4d2b5ba",
|
||
|
|
"value": "39.106.40.121"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "4f3d4a6e-39ab-49c5-9577-e2ebfbb7a236",
|
||
|
|
"value": "39.106.40.121"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "3bd5f747-8e89-4ea5-b8b8-a6abc4a2ffd2",
|
||
|
|
"value": "39.106.40.121"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "c28df328-5876-4866-93b7-65a512e85576",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "f6f5d003-e642-49c8-a479-72b375c57c63",
|
||
|
|
"value": "101.200.63.187:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "54be6b11-7578-473c-9007-807a5608fb98",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "dcf393d3-3b30-43ab-ae3d-61e546d72289",
|
||
|
|
"value": "101.200.63.187"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "8d6c65b9-8986-447a-8c77-24587d65f4d8",
|
||
|
|
"value": "101.200.63.187"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "df227207-e707-45b9-a659-0b1086ec0dbc",
|
||
|
|
"value": "101.200.63.187"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "fa33510b-37b2-4da8-a838-65d11dfcdd6f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "0ed0401b-b0e2-45ef-a236-4fc10dc48865",
|
||
|
|
"value": "101.201.35.96:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "c22fb631-09e2-4e73-aefe-d3ec92a93cfe",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "6a0a1d88-7fe4-4a05-a82c-5c2239eba619",
|
||
|
|
"value": "101.201.35.96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "57d5d6a8-b21d-456f-b193-898a704157f0",
|
||
|
|
"value": "101.201.35.96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "f1870faa-aa81-49d4-b433-48e7999b8865",
|
||
|
|
"value": "101.201.35.96"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "9ddc5691-1d70-43fd-b23e-35dd4939d234",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "c4ee0f3b-520e-4806-a1c5-f3f7866737e3",
|
||
|
|
"value": "39.107.231.100:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "246e7a18-2ccc-492a-ad88-7bf1de58b712",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "cdc025c1-93e4-4caf-8d59-dcbe52b721c1",
|
||
|
|
"value": "39.107.231.100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "52cadf72-5cd5-47c3-a8b3-e0652a7ac526",
|
||
|
|
"value": "39.107.231.100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "6dfa99b0-1110-45ad-b503-e023fa713fd7",
|
||
|
|
"value": "39.107.231.100"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"uuid": "51aa3a93-1a99-41f5-8724-10785549b550",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438834",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "dfd631f9-130c-4e7d-9247-9e29a2b662f3",
|
||
|
|
"value": "47.95.12.152:53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "f8fe381b-7c02-4d08-90aa-c0a07ce721a5",
|
||
|
|
"value": "53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "d2ffa476-fa9e-4d37-b272-8634a409c80a",
|
||
|
|
"value": "47.95.12.152"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "1187cc78-7a88-4d45-b475-c118bf08cf2f",
|
||
|
|
"value": "47.95.12.152"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "809ca686-e012-4da1-bdcf-4b448157f48d",
|
||
|
|
"value": "47.95.12.152"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "e5137cbf-4008-4d08-96af-958b2f33866c",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "be95567e-80b2-40a2-80a7-a78de966f7a2",
|
||
|
|
"value": "47.94.20.102:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "a580c0d3-d7a9-41ef-b2cf-6645225d751b",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "960cc5f2-d2ea-4143-87c2-5b1e3562fa0c",
|
||
|
|
"value": "47.94.20.102"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "3bfcff79-acaa-4da4-a6d9-d8b97ee2d372",
|
||
|
|
"value": "47.94.20.102"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "89face3d-734a-463a-9791-e90bf04bea6d",
|
||
|
|
"value": "47.94.20.102"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "7f10d38f-a39c-4819-b927-57186a8dfaf5",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "b089d4a2-a7e6-4f05-b6dc-cbea627568d3",
|
||
|
|
"value": "101.201.69.42:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "fa5784e6-3105-4f4f-92da-8d070541b6ee",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "e841519f-a965-403c-b31c-f1f6ab15be88",
|
||
|
|
"value": "101.201.69.42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "17349ef5-a87e-4aae-8f29-21cf9d0da4b6",
|
||
|
|
"value": "101.201.69.42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5d8e5eec-cfeb-4d0f-991d-8f549bdd9eb5",
|
||
|
|
"value": "101.201.69.42"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "6e5d30ad-a935-4575-a34b-6065f07bc651",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "66d42237-27d1-4b97-b182-8b4234ded084",
|
||
|
|
"value": "47.94.202.137:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "6ab1746b-5f1b-445b-ad90-ebcd42fba1e5",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "96f24b3c-20f0-4718-81ce-4a8ef2e75227",
|
||
|
|
"value": "47.94.202.137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9baf0d6e-1cf0-4d1b-9267-33bc602aae96",
|
||
|
|
"value": "47.94.202.137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "0332c16a-d23b-47b2-be90-1b6e885cd9db",
|
||
|
|
"value": "47.94.202.137"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "baf4224b-9fb2-41ae-99dd-83f500def7ea",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "4763a6c1-080f-4745-b0f3-f6062bb79b03",
|
||
|
|
"value": "47.94.193.44:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "8c56ed7c-9c05-439c-8451-9ce05dfe1da5",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "9d272570-1211-4c7a-998b-900b645a5ce7",
|
||
|
|
"value": "47.94.193.44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "cae4e966-e549-4749-a903-94398d3cb01f",
|
||
|
|
"value": "47.94.193.44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "2ca49fd1-0daf-4167-8962-e20dfffbe5db",
|
||
|
|
"value": "47.94.193.44"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "13cebdf5-2f89-453b-bcd8-7d15383a5db3",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "6f08db83-f3dc-42c7-a90f-f10e11abd086",
|
||
|
|
"value": "47.94.227.15:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "a0e5d930-d783-46d2-812c-e3a253a45e96",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "29cbcb3c-a892-48b2-9b42-22cf6eb39c1c",
|
||
|
|
"value": "47.94.227.15"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9c58a218-e556-492b-aa9a-8f7809ff8513",
|
||
|
|
"value": "47.94.227.15"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "b82bfa25-8ce3-42cd-9806-3e3b0942b1f6",
|
||
|
|
"value": "47.94.227.15"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "b82cbe06-83d0-4ba7-b28c-f8b3536b9442",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "9f143d11-ec56-41a7-89cc-ec95de8c8423",
|
||
|
|
"value": "47.94.143.163:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "74072530-7018-4854-b7d9-8cc7084e7985",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "c6dc041f-536d-4304-8dd6-03a94a60d92b",
|
||
|
|
"value": "47.94.143.163"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5f2f7e99-375b-46eb-a807-96f9bed4066d",
|
||
|
|
"value": "47.94.143.163"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "74157422-d5f2-4ced-92d5-cc02fa6fd922",
|
||
|
|
"value": "47.94.143.163"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"uuid": "5a7cf58b-c3bc-4138-842f-03ba713da33c",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438835",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "eac7652a-181a-4f4f-8e60-3d636f2c48a4",
|
||
|
|
"value": "39.106.13.202:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "d3b8a96d-9efe-4700-99a8-791d48f87529",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "98e64be7-50e0-437f-9df1-a525c031d4fa",
|
||
|
|
"value": "39.106.13.202"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "14aa2cdb-503f-4e65-9aef-982c045d0d54",
|
||
|
|
"value": "39.106.13.202"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "f6984ba0-a640-43fb-ae90-db3323028391",
|
||
|
|
"value": "39.106.13.202"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"uuid": "aa9720af-6b4d-4b74-be56-fab913743322",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "9117e6ca-3f98-4122-ae54-3424abad3e22",
|
||
|
|
"value": "47.93.47.186:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "af486b2a-3349-4df5-a43d-248b58f8d893",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "a80f3f56-5e49-413d-9b31-bdf6d7be342c",
|
||
|
|
"value": "47.93.47.186"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "626b7f59-ba28-4ea8-b571-c346f3366866",
|
||
|
|
"value": "47.93.47.186"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "24816148-0b08-486d-a0f6-92da80b81002",
|
||
|
|
"value": "47.93.47.186"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"uuid": "10916456-5426-4b20-b742-1c08fd4b24b2",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "88eb38d5-3b5a-429b-9aa0-e256137ff3fe",
|
||
|
|
"value": "59.110.226.246:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "b4a14b24-a283-4d59-96e8-a966bd776c86",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "268677f6-3012-4546-adc9-7bd9307d52f2",
|
||
|
|
"value": "59.110.226.246"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "409f0124-b427-472f-be18-1eb733e44b08",
|
||
|
|
"value": "59.110.226.246"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "cde72253-8396-4245-9afb-4a216952d057",
|
||
|
|
"value": "59.110.226.246"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "Enriched via the url_import module",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||
|
|
"meta-category": "network",
|
||
|
|
"name": "url",
|
||
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||
|
|
"template_version": "9",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"uuid": "9d3a1048-ba45-4883-bbde-067765df730d",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "url",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "1818b94b-a37a-4b0b-899c-a988328c3871",
|
||
|
|
"value": "47.94.200.23:443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "port",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "port",
|
||
|
|
"uuid": "352ede0e-32fd-4c35-9365-08079bf14151",
|
||
|
|
"value": "443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "host",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "d1d45326-bb51-4132-a3a1-aeeb1f894075",
|
||
|
|
"value": "47.94.200.23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain_without_tld",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "0b776fb4-d357-4c5e-ac9d-930dc30e3910",
|
||
|
|
"value": "47.94.200.23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "domain",
|
||
|
|
"timestamp": "1725438836",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "50d0932f-8f49-4167-9b2b-e68eb2083c3c",
|
||
|
|
"value": "47.94.200.23"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Report object to describe a report along with its metadata.",
|
||
|
|
"meta-category": "misc",
|
||
|
|
"name": "report",
|
||
|
|
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
|
||
|
|
"template_version": "8",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"uuid": "f0e607b1-da55-4daa-9dca-502f307ab27d",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "link",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "834275a2-e24c-4d3b-8197-755d5f702269",
|
||
|
|
"value": "https://www.trendmicro.com/en_us/research/24/i/earth-lusca-ktlvdoor.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "summary",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9db6478f-7868-4ca4-b9ae-b583aaa293f0",
|
||
|
|
"value": "During our monitoring of the Chinese-speaking threat actor Earth Lusca, we discovered a new multiplatform backdoor written in Golang, named KTLVdoor, which has both Microsoft Windows and Linux versions.\r\n KTLVdoor is a highly obfuscated malware that masquerades as different system utilities, allowing attackers to carry out a variety of tasks including file manipulation, command execution, and remote port scanning.\r\n The malware's configuration and communication involve sophisticated encryption and obfuscation techniques to hinder malware analysis.\r\n The scale of the attack campaign is significant, with over 50 C&C servers found hosted at a China-based company; it remains unclear whether the entire infrastructure is exclusive to Earth Lusca or shared with other threat actors."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "title",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "37dba09b-4ce9-4afc-bcd6-d223f35910a3",
|
||
|
|
"value": "Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "type",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "9406faad-047f-40dc-adc2-34301727c8c6",
|
||
|
|
"value": "Blog"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "JVBERi0xLjcKJbXtrvsKNjQgMCBvYmoKPDwgL0xlbmd0aCA2NSAwIFIKICAgL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnichL3JrjZJjiW296e4y4xF3XabzbYN9ELTQkBKWghaFG53VjX0R5W6hveX85xDmvkX0RISyD/I65+7DTQaZ6av+/nf36Xn/2bNXz+/X//t+l+//tvV+nef80v/1Jm/e25fI0/8+y//5ev/+PqnK33Z//7lH77+w9/fX//wr///P/ob3t3H9yrP33P7HnN91X5/p+fv93e8+P4eZeRmuFFTGt3+o+VVz6/9f7+GnzpelPj75z9Gr+N80azfeY2v1Ot3m/3r969n4LWVr9TWd87j6xcQOf85otRKsF+A2034GZqBI6WvHyBqA2I9v8MH7IvPaB60gX0BLLN8/VzADD5gS2fgrABnnRtM3/czt5+N4Aye8aXvVtLX9QdMavP7QRqifN+pn4j6PbAM5Ts/6wnETNkRl2GenW2v3zz/UdOfIPZ3B3blE3Fx9Pc8H7nxPYBcjbYmQLzxWZw+bLKGmFq8dAHuWtoOaHBnRvbHuRWN756Eyht89vXS062fO92+czmX9h+vlb57Gniml/LQy8rPMwE/UF/c62cLV8EsbbR3Wc8XHkTJRJSUL4PryoDH86EA03e5G58nwgfwvH+0+Ua0hhUt33NNYWxEJ6JMkvg9JgZc+c6cMeL7eZOBpXRbhmeKdrYMYyfhAcco/GRpBjY9b//i8bL4eH+25gGNGkB9/QGffZ389QP9GNzW1/4jl6OC0h8w3ZrtM7JnQ9b3HOniUJKBxlsw8mcGD/hMnfPyx6sm/qzeAxnNGGjET5ALlVbj43yAexave5YLL18FwD04bNsR2xkjU5sVB/aQw0NxRhWlEKyYpp3qREQa3ARHGPG9ELdRQsbxByXMhk3K4gH+wpuw8Zjne7ORbip2SAylFm2gUxn/ei/yD2M0NvSuN5Emn08UferG1Gri489iX9iU1TSwpU3RC4wB/eK2ib8VrNQgNAte18UM27z4uUVEf1j7M7i8juPzPl0/duB8nZ4VeSj/d8y9dCLAqmy6YFXPEt4JH6iL4AI4HmK5DG5gmEaClXtrDNomXLnvxkMCdDI5EMbXL/u5OGNPmG8HRyriOfbBJTLkAiyw54KDYBPOw0HtVhvzfOAhLb6PhMAzUfy4PdPi68pYm4qKne3r61gtHLdn/dr36psHP+tXn206mZoj2sBKPQj9JBD/eKU78Wz5W9J945TpuPwCgnzi2Rcj1Zs8TUfIwOeU8cish8B+iOq8ysDUbl54BhvzN5isBt/mD7hzzyJ2u3INATDdCxAn/yx5T/pBLbpcOsG7k5bvAthY1wViT0O/KDpZPLjA1Pdv8uuVRoX65qVXZPDoPayclo8acJrvWSUcwD3t58BypYZ+cDfOc/kvblG88e71HLxBRgaO/oAi6Iejf10/hiH3ii3nlX0gOndTQsuDGOQwGzFNKrnw2vScTWBaHvvcTXIhSi8P1G8O0fb4B4hKyrQXXwaT6m+7VSY+A3EDQpMhKukep/gBew5mbuDgGXv4xMXnSY7AcHQuwLTnlwZmfs9oxMCm15eu35OjcwQGLx0sW+IJogWT6BqfL7K910BtgVHJs+DPxc/F0rFdEAGwPPb9B+ziWZ3Pz83T8DiYHJf/Eh3ap/eO2JnEEjojNARXMZPODa78SquD8ChXsL4foKZIaY5FWAtz6ye8v31jDMOlAAe6iBBLsl8aWPdO6BdjHHsDjJiiXUIPh/P1KnbRA8ZqFdz0P8TwFTeOROadE8POkgvB9y7+AOJdl3h8U04TsQIUt0oaZf7WTeTLW3ikT1R+CT/kjI9cvNIhEaZ78LgJY/AYLhOmez57TQ5CodAw1WQAiYVAtC4+ZSsbsMuFG+MDsY/MEqLiJVTPXEVKgoYBi3lhyDMpHGLsiS82XmJw6pTAeFAMQ+ZD8dDmP6tE0uckYz1O+dAQVQLkc1NeQGQJmEa/93PdtPEVIqIhuriT/l4lFuJ6eGDTCq8tJ6a7iuYqyaeKW1BQNJgL4ZKiYUyOkqx4AVFrCgZzwhQDNkYifrwUF6CN6r7r5fcdp2FXtMuMmGclGzeZ0ZZh3OT7lPGwPUVPpOF76CjKjSfGVsU2UNKfyQskPl6C+62PoknywqSfD5ukI/kQG1abg9qwO59/T13i5CNAXpwIP9FEwU2MhzIktmzyJ5DYHzj7GFdsWOKYKEViW6dLkXiDSXESI/GFVl2Q1ChxK1KSJFlBno9j9z6YPzisvnguTWIx0ouJdqlLzik6iMblSRvJ5JFwgRIEm0awVYMbeSrW2cFNSoF4JMqLMNgKRUpMViocZUp8VMoMl8Mmr6M9OddnsFcguD5dX/FHnC87odgx2pIlSOnN2X21SjAHXz1JlynJWLG5X7JlWXsbHhgCssFGNQ+MSwkwdvLBzCILirGOB17JdYRMeOkX8YM1g8Z/+SuIyTb05IryzSVNWTyFFMqXUO42jbQSJjQ5hof2L4f5fH4/cA+90PY+pT0mDvK5bKXQVWPuyRXnm0N94A9p9cGUQjaP5X7gLGk38wsJ/NMkR0rQKWkQSXNIujefwRjtBpz9rgnMvibSLStF3CWOkR2FmJk/EEujf7jPL87PjR2NjySpLpK6bTqJorItpM1WemTSjiTTrEgHuBFScuVxVs5u6oCLB9gmbB6gPZpOeySDkzxJsi1kKyfZTmEgSLaTVDFdwksWPNtj+/CwD4l/Ya+es7O4u8UO6AMHvfWqn0xp5WvyF5Sjkk7bgZi8agND44CtaXWR70QQM3sBPLGGJjqZ7PDMlsoDTUk/wGQpqDiID0zjReHyPrOVqDU77GKGKfP9BEyB4EYd8JRYYWI5R55cKzaOaMtzdw4Ll7itD//ebl/RTiLUPWc/KRIzBt8YUsbFPdkKKQfZtxkKYx4thIjkXNyFjGfWrZZrP/BcP3kbL20h3dJWtOc15JCMOVX9opi9zIZUQjJu4NrJZr9tCQbHPWEC0AHrZiBGhqXKn0DtNGWSv5gyE01Kgqm6YQhG6Qd0208iI6wkRN6r/MFaUi1EILjvgvjfx+N1ZDqNQ79z+VIODIiq8olGmiKbuf0GM8KsPDCwLtr6Zko/kNFsnKud0pDtsM6Dc/kHc2cxQNLAbGR3XN8O+cKty3wHd4D8y2hELIn8optt53KmxR+4Pg+zvNHN7K95nivx56vzt+uGa+Vf/uHrP/71ypV+luffaZfDQ5XZrtrnP56d/evv13/429/df3d/pa+//u36P//yn35L7S9//y+//V26//Jv//j1P/+W0l/+/V9/e6Cf39L4y99//W8A/ov9379+/U+/lfaXvz4P5fSX//23kf7yn//5n//l6z/+9og6f/n7n//7tzyB+e3/+uv/eJmvB9b2v/7n5zt/+y3nvzzP/i///uvf/uv/8+vv/+23XB35+9f/8E+/tb/827/8+7/+13/+J/z4P/31mgtOgtwa5PffzWBukxE5w5ifX3ADH81tQOUB4tE/rgfTweENfgR1A43DG1gSQHvBDxDPRhrCbJSzQZcz0OQQA1vh20w0x/MPzzC44G2VLzPKfCAT3wxMnY/a9WOwaZQGVoysQTU1OE+CerPpReef76RfZzgKpl5e7VheExIvPl7w58Zxm34ntwJAWqIbOArmMQ0yzRWzNCuXwa1zETRyU1mxSg1DediC1hC/NnMvVphrUrho3JWLDqz10PaxT8+ZbCU2lg6jE3x+8NzgGQJ/E8LOTcZBgk9r4Rs35A65lww0ARhjMGtChtOKfydkEqhBZu/KUG815ARCsnM+AT4zMxCW/AIvTxaLxOP5OUkZdsRn6QvkJQONOxjIdy3cTQa//zoXf1sxFtshvNvYJx43Lx8+nvjA0NAeTmKLi5V5uNjUWMxKjLnh6dr59tturQduXBZNE+RuTPIRUgzsXDU7NQ/Y78VFvyv33UQNbcul82WP7I0aWrjYqAFDH95pZDu0UsYOCZbKbVxNDjOThDDgCR+ZGRwwvWfHDMycnAk5eLw0zu/R1u
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "report-file",
|
||
|
|
"timestamp": "1725438974",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "0edc0d23-c69e-4556-b895-84b77c39a66d",
|
||
|
|
"value": "Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion _ Trend Micro (US).pdf"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|